qakbot | 8b4ab5aa06ef9fd1a22b64e472dab1b9ddcf4f20b5c3f3b6c46a52ee9cf7bd75

Resubmissions

23/06/2023, 14:16

230623-rla5dsfc7710

23/06/2023, 04:50

230623-fgkmgscb353

Analysis

max time kernel
209s
max time network
176s
platform
windows10-1703_x64
resource
win10-20230621-en
resource tags

arch:x64arch:x86image:win10-20230621-enlocale:en-usos:windows10-1703-x64system
submitted
23/06/2023, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1_qbot.dll
Size 1.3MB
Sample230623-rla5dsfc77
SHA256 8b4ab5aa06ef9fd1a22b64e472dab1b9ddcf4f20b5c3f3b6c46a52ee9cf7bd75
MD5 9f8a7a3bb9d1452c19dc6c8e74fc72b1
SHA1 aae3619afbff1fdfe8941a830d3cd100dc5610b8
SHA512 8f51ca1ab752ce4b187b42145b5818e597d6314cc81e9e055e368ee2af2a663096b2e807112fc925dacc657d134c45c4f725288240c991c3d507bc3c67da8022
SSDEEP 24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4ylQ:QbkS7XB1EsOSNPSp0EAt2bUeM4ylQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot obama271 1687438904 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.1405

Botnet

obama271

Campaign

1687438904

70.28.50.223:2083
103.141.50.79:995
184.182.66.109:443
122.184.143.82:443
91.254.145.252:443
37.14.229.220:2222
64.229.117.208:2222
77.126.99.230:443
87.252.106.235:995
12.172.173.82:32101
95.230.110.222:995
88.169.33.180:2222
70.28.50.223:1194
72.80.94.230:443
191.191.1.254:995
209.171.160.69:995
45.62.67.129:443
24.234.80.122:995
81.150.169.174:2222
121.121.100.202:995
92.148.54.239:2222
105.184.83.153:995
70.51.132.7:2222
190.249.245.224:443
208.180.17.32:2222
78.192.109.105:2222
72.205.104.134:443
86.248.228.57:2078
41.129.104.142:443
70.51.247.250:2222
87.220.204.58:2222
24.234.220.88:995
66.35.127.23:2222
201.244.108.183:995
70.28.50.223:2222
98.187.21.2:443
70.28.50.223:2078
142.127.25.253:2222
92.27.86.48:2222
12.172.173.82:2087
86.128.15.251:2222
62.35.230.21:995
150.195.117.207:443
47.16.77.99:2222
198.255.148.59:443
136.35.241.159:443
109.220.83.213:2222
69.159.156.197:2222
103.123.223.131:443
86.160.253.50:443
92.188.241.102:443
172.115.17.50:443
89.181.227.42:2222
41.98.253.136:443
187.199.128.160:32103
2.82.8.80:443
184.82.237.226:443
89.152.20.11:2222
47.21.51.138:443
65.95.192.151:2222
197.83.246.187:443
217.165.255.105:443
12.172.173.82:22
67.71.53.228:2222
79.168.224.165:2222
119.82.91.203:2078
116.75.63.242:443
110.159.115.244:443
45.62.75.217:443
142.154.58.207:443
88.171.156.150:50000
86.178.33.59:2222
73.29.92.128:443
72.134.124.16:443
104.35.24.154:443
71.31.9.226:995
171.96.205.23:443
113.11.92.30:443
89.79.229.50:443
90.63.198.45:995
27.99.32.26:2222
173.178.151.233:443
181.171.231.230:443
151.69.32.238:443
2.49.63.237:2222
178.175.187.254:443
68.186.65.132:443
103.139.243.205:443
113.193.95.38:443
184.176.35.223:2222
24.198.114.130:995
96.87.28.170:2222
41.227.190.59:443
151.3.191.5:443
89.158.150.253:443
86.178.238.140:50000
103.144.201.52:2078
190.133.135.49:995
12.172.173.82:995
93.163.74.91:443
142.79.110.85:443
151.62.193.97:443
147.147.30.126:2222
124.149.132.112:2222
70.49.205.191:2222
162.248.14.107:443
27.0.48.233:443
77.86.98.236:443
67.87.119.216:2078
70.28.50.223:32100
86.222.103.217:2222
12.172.173.82:20
98.4.43.111:443
84.215.202.8:443
102.157.134.72:443
85.95.113.17:995
103.153.180.55:995
201.171.159.196:443
92.20.199.185:2222
85.61.165.153:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	2524	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4932	rundll32.exe
4932	rundll32.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe
3196	wermgr.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2524	2504	rundll32.exe	66
PID 2504 wrote to memory of 2524	2504	rundll32.exe	66
PID 2504 wrote to memory of 2524	2504	rundll32.exe	66
PID 2848 wrote to memory of 3580	2848	cmd.exe	73
PID 2848 wrote to memory of 3580	2848	cmd.exe	73
PID 3580 wrote to memory of 4932	3580	rundll32.exe	74
PID 3580 wrote to memory of 4932	3580	rundll32.exe	74
PID 3580 wrote to memory of 4932	3580	rundll32.exe	74
PID 4932 wrote to memory of 3196	4932	rundll32.exe	75
PID 4932 wrote to memory of 3196	4932	rundll32.exe	75
PID 4932 wrote to memory of 3196	4932	rundll32.exe	75
PID 4932 wrote to memory of 3196	4932	rundll32.exe	75
PID 4932 wrote to memory of 3196	4932	rundll32.exe	75
PID 4932 wrote to memory of 3196	4932	rundll32.exe	75

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1_qbot.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1_qbot.dll,#1
  2⤵
  PID:2524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 616
    3⤵
    - Program crash
    PID:3036

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1348

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\system32\rundll32.exe
  rundll32.exe 1_qbot.dll zertc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe 1_qbot.dll zertc
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Windows\SysWOW64\wermgr.exe
      C:\Windows\SysWOW64\wermgr.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2524-121-0x0000000068DC0000-0x0000000068EEC000-memory.dmp

Download

memory/3196-134-0x00000000029E0000-0x00000000029E2000-memory.dmp

Download

memory/3196-135-0x00000000029B0000-0x00000000029D4000-memory.dmp

Download

memory/3196-142-0x00000000029B0000-0x00000000029D4000-memory.dmp

Download

memory/3196-145-0x00000000029B0000-0x00000000029D4000-memory.dmp

Download

memory/3196-146-0x00000000029B0000-0x00000000029D4000-memory.dmp

Download

memory/3196-147-0x00000000029B0000-0x00000000029D4000-memory.dmp

Download

memory/3196-148-0x00000000029B0000-0x00000000029D4000-memory.dmp

Download

memory/4932-128-0x0000000000910000-0x0000000000913000-memory.dmp

Download

memory/4932-129-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/4932-141-0x0000000068DC0000-0x0000000068EEC000-memory.dmp

Download