qakbot | 799b7a01e7941fa8baf90b3bc4c6397ca2974429b835949540b0b88162f4fc81

Resubmissions

30/11/2023, 22:16

231130-164rwacb4310

30/11/2023, 22:13

231130-1472hsca4210

29/11/2023, 16:48

231129-vbamnaab9w10

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2023, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
799b7a01e7941fa8baf90b3bc4c6397ca2974429b835949540b0b88162f4fc81dll.dll
Size 695KB
Sample231129-vbamnaab9w
SHA256 799b7a01e7941fa8baf90b3bc4c6397ca2974429b835949540b0b88162f4fc81
MD5 7f848e8045da39b62f447cfefcfbc4d0
SHA1 19434176868e295ae703d60e61751d9f755831bd
SHA512 a98f36849b10d34a67dddb6e604385ddb8759cbe31027a5da4d53267289b0e43cc53f05b2e54ec4309bbd2dcb7ba86ef0fa1cde2bb5dc23ebd61db10cb96c6a8
SSDEEP 12288:nieL1vc1PdFjpmw5qS6xnGWPE/N285UT+QD1lNMA:i81IFnqnPEl5w9M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot obama207 1664363417 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.895

Botnet

obama207

Campaign

1664363417

217.165.146.158:993
41.97.179.58:443
86.132.13.49:2078
197.203.50.195:443
85.245.143.94:443
86.196.181.62:2222
102.190.190.242:995
105.184.133.198:995
179.111.23.186:32101
179.251.119.206:995
84.3.85.30:443
39.44.5.104:995
197.41.235.69:995
193.3.19.137:443
186.81.122.168:443
103.173.121.17:443
41.104.80.233:443
102.189.184.12:995
156.199.90.139:443
14.168.180.223:443
41.140.98.37:995
156.205.3.210:993
139.228.33.176:2222
134.35.12.0:443
49.205.197.13:443
131.100.40.13:995
73.252.27.208:995
82.217.55.20:443
176.177.136.35:443
180.232.159.9:443
41.68.209.102:995
186.90.144.235:2222
191.92.125.254:443
41.96.204.133:443
58.186.75.42:443
85.86.242.245:443
187.193.143.111:443
200.175.173.80:443
197.49.68.15:995
186.50.139.45:995
41.68.155.190:443
186.72.236.88:995
187.150.143.159:443
105.69.189.28:995
160.177.207.113:8443
41.102.97.28:443
193.254.32.156:443
88.168.84.62:443
156.218.169.48:995
41.105.159.42:443
186.53.115.151:995
186.48.206.63:995
151.231.60.200:2083
196.217.32.15:443
102.157.212.143:443
189.189.89.32:443
181.177.156.209:443
85.94.178.73:995
201.209.4.2:443
41.69.236.243:995
74.133.189.36:443
149.126.159.254:443
41.104.132.166:443
188.157.6.170:443
197.160.22.10:443
187.189.68.8:443
109.128.221.164:995
92.98.73.123:443
154.237.235.43:995
212.102.56.47:443
110.238.39.214:443
185.233.79.238:995
154.237.60.254:995
181.206.46.7:443
186.16.163.94:443
75.71.96.226:995
181.105.32.5:443
41.227.228.31:443
197.203.142.42:443
118.174.89.216:443
41.107.112.236:995
105.96.207.25:443
111.125.157.230:443
68.224.229.42:443
190.44.40.48:995
88.232.207.24:443
72.88.245.71:443
119.82.111.158:443
100.1.5.250:995
96.234.66.76:995
186.64.67.34:443
197.94.84.128:443
41.96.130.46:80
88.245.168.200:2222
110.4.255.247:443
89.211.217.38:995
76.169.76.44:2222
68.53.110.74:995
41.69.103.179:995
194.166.205.204:995
89.211.223.138:2222
85.98.206.165:995
177.103.94.155:32101
72.66.96.129:995
176.42.245.2:995
186.154.92.181:443
88.231.221.198:995
102.38.97.229:995
45.51.148.111:993
87.243.113.104:995
84.38.133.191:443
123.240.131.1:443
191.84.204.214:995
91.116.160.252:443
151.234.63.48:990
99.253.251.74:443
41.40.146.5:995

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3400	2164	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2164	1304	rundll32.exe	85
PID 1304 wrote to memory of 2164	1304	rundll32.exe	85
PID 1304 wrote to memory of 2164	1304	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\799b7a01e7941fa8baf90b3bc4c6397ca2974429b835949540b0b88162f4fc81dll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\799b7a01e7941fa8baf90b3bc4c6397ca2974429b835949540b0b88162f4fc81dll.dll,#1
  2⤵
  PID:2164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 664
    3⤵
    - Program crash
    PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2164 -ip 2164
1⤵
PID:1232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2164-0-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/2164-1-0x0000000002AE0000-0x0000000002B22000-memory.dmp

Download

memory/2164-3-0x0000000002510000-0x0000000002532000-memory.dmp

Download

memory/2164-2-0x0000000002510000-0x0000000002532000-memory.dmp

Download

memory/2164-4-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/2164-5-0x0000000002AE0000-0x0000000002B22000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads