qakbot | d212370174b869b6b7ff4839f81f20c663a00dd8cacfa6cdc2a409e93abbe0fb

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
21/06/2023, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dysttto.dll
Size 1.1MB
Sample230621-td8f2aac92
SHA256 d212370174b869b6b7ff4839f81f20c663a00dd8cacfa6cdc2a409e93abbe0fb
MD5 82d5d107b67d9b136e7c0fc3d70af16c
SHA1 062e4c96fc4852e67a98cf5a9efdd2332f609244
SHA512 1d42f9a90075d0f174d7042b3a99519927e6df5fad3bbcc3fed221fb1dc0cb4ab2a6bc744d6ee8635a08200d6d142bed2c211478b3033e07b4ef6f43a5fa8203
SSDEEP 24576:I3sUlO2TYFXw4M+B08NDtUduyNVUnxM/jj5wDekjggYL:B5zVBHDtAnUxSSeIggY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot obama270 1687338804 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.1382

Botnet

obama270

Campaign

1687338804

70.28.50.223:1194
201.208.135.13:2222
24.234.80.122:995
81.150.169.174:2222
121.121.100.202:995
105.184.8.190:995
12.172.173.82:21
184.182.66.109:443
64.229.117.208:2222
77.126.99.230:443
80.12.88.148:2222
87.252.106.235:995
12.172.173.82:32101
201.225.216.60:2222
116.88.76.28:443
217.165.255.105:443
92.27.86.48:2222
103.123.223.131:443
90.104.151.37:2222
27.0.48.233:443
72.205.104.134:443
12.172.173.82:2087
31.53.29.188:2222
37.14.229.220:2222
89.181.227.42:2222
182.75.189.42:995
70.28.50.223:2078
62.35.230.21:995
198.255.148.59:443
88.171.156.150:50000
89.152.20.11:2222
161.142.100.114:995
122.184.143.86:443
223.166.13.95:995
197.83.246.187:443
79.168.224.165:2222
201.244.108.183:995
178.175.187.254:443
176.142.207.63:443
86.160.253.50:443
116.75.63.162:443
103.141.50.46:995
41.129.104.142:443
92.188.241.102:443
103.212.19.254:995
172.115.17.50:443
2.49.63.237:2222
47.199.241.39:443
64.121.161.102:443
187.199.128.160:32103
197.0.40.156:443
110.159.115.244:443
47.21.51.138:443
151.3.191.5:443
82.28.123.50:443
89.114.140.100:443
124.149.132.112:2222
91.160.70.68:32100
92.59.250.137:3389
75.109.111.89:443
103.144.201.52:2078
103.139.243.205:443
86.208.35.220:2222
60.189.130.84:995
70.51.132.7:2222
72.134.124.16:443
104.35.24.154:443
124.122.47.219:443
71.31.9.226:995
113.193.95.244:443
41.227.190.59:443
109.220.83.213:2222
12.172.173.82:22
47.34.30.133:443
168.149.47.12:443
68.186.65.132:443
149.74.159.67:2222
184.176.35.223:2222
87.149.121.9:995
151.62.196.183:443
77.86.98.236:443
86.195.14.72:2222
24.198.114.130:995
89.158.150.253:443
89.129.109.27:2222
96.87.28.170:2222
213.55.33.103:443
2.82.8.80:443
81.150.169.174:2083
70.54.111.35:2222
70.160.67.203:443
88.126.94.4:50000
70.28.50.223:3389
113.11.92.30:443
45.2.61.134:3389
70.49.205.191:2222
183.87.163.165:443
162.248.14.107:443
70.28.50.223:32100
147.147.30.126:2222
84.215.202.8:443
49.175.72.81:443
1.221.179.74:443
82.125.44.236:2222
102.158.46.89:443
201.171.159.196:443
66.241.183.99:443
23.234.237.3:443
76.178.148.107:2222
136.232.179.26:443
12.172.173.82:993
174.4.89.3:443
199.27.66.213:443
81.229.117.95:2222
92.9.45.20:2222
12.172.173.82:20
91.169.12.198:32100
213.91.235.146:443
12.172.173.82:50001
12.172.173.82:465

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4444	PowerShell.exe
4444	PowerShell.exe
4924	rundll32.exe
4924	rundll32.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe
2940	wermgr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4444	PowerShell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 3628	4636	rundll32.exe	79
PID 4636 wrote to memory of 3628	4636	rundll32.exe	79
PID 4636 wrote to memory of 3628	4636	rundll32.exe	79
PID 4444 wrote to memory of 4068	4444	PowerShell.exe	89
PID 4444 wrote to memory of 4068	4444	PowerShell.exe	89
PID 4068 wrote to memory of 4924	4068	rundll32.exe	90
PID 4068 wrote to memory of 4924	4068	rundll32.exe	90
PID 4068 wrote to memory of 4924	4068	rundll32.exe	90
PID 4924 wrote to memory of 2940	4924	rundll32.exe	91
PID 4924 wrote to memory of 2940	4924	rundll32.exe	91
PID 4924 wrote to memory of 2940	4924	rundll32.exe	91
PID 4924 wrote to memory of 2940	4924	rundll32.exe	91
PID 4924 wrote to memory of 2940	4924	rundll32.exe	91
PID 4924 wrote to memory of 2940	4924	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dysttto.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dysttto.dll,#1
  2⤵
  PID:3628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1036

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
"PowerShell.exe" -noexit -command Set-Location -literalPath 'C:\Users\Admin\AppData\Local\Temp'
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" .\dysttto.dll,more
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" .\dysttto.dll,more
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\SysWOW64\wermgr.exe
      C:\Windows\SysWOW64\wermgr.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_5pgajhwu.vtj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5pgajhwu.vtj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/2940-162-0x0000000000C20000-0x0000000000C22000-memory.dmp

Download

memory/2940-173-0x0000000000BB0000-0x0000000000BD4000-memory.dmp

Download

memory/2940-172-0x0000000000BB0000-0x0000000000BD4000-memory.dmp

Download

memory/2940-171-0x0000000000BB0000-0x0000000000BD4000-memory.dmp

Download

memory/2940-170-0x0000000000BB0000-0x0000000000BD4000-memory.dmp

Download

memory/2940-169-0x0000000000BB0000-0x0000000000BD4000-memory.dmp

Download

memory/2940-163-0x0000000000BB0000-0x0000000000BD4000-memory.dmp

Download

memory/4444-148-0x000002286CC60000-0x000002286CC70000-memory.dmp

Download

memory/4444-152-0x000002286CC60000-0x000002286CC70000-memory.dmp

Download

memory/4444-153-0x000002286CC60000-0x000002286CC70000-memory.dmp

Download

memory/4444-151-0x000002286CC60000-0x000002286CC70000-memory.dmp

Download

memory/4444-150-0x000002286CC20000-0x000002286CC3E000-memory.dmp

Download

memory/4444-149-0x000002286DC00000-0x000002286DC76000-memory.dmp

Download

memory/4444-147-0x000002286DB30000-0x000002286DB74000-memory.dmp

Download

memory/4444-144-0x000002286CB90000-0x000002286CBB2000-memory.dmp

Download

memory/4444-146-0x000002286CC60000-0x000002286CC70000-memory.dmp

Download

memory/4444-145-0x000002286CC60000-0x000002286CC70000-memory.dmp

Download

memory/4924-155-0x0000000002160000-0x0000000002163000-memory.dmp

Download

memory/4924-156-0x0000000010000000-0x0000000010024000-memory.dmp

Download