qakbot | a27df79ba5f04d6a09189e6d01c301e6ddbf082c67c2853ec2f4bbfdf2b51a56

Analysis

max time kernel
64s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/02/2024, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a27df79ba5f04d6a09189e6d01c301e6ddbf082c67c2853ec2f4bbfdf2b51a56.dll
Size 1.5MB
Sample240226-1fe1tsge92
SHA256 a27df79ba5f04d6a09189e6d01c301e6ddbf082c67c2853ec2f4bbfdf2b51a56
MD5 e1dbda07124bece1d5d847715c28afbc
SHA1 95bb7058f29ddcec37aaaa0e3348e30361e86d38
SHA512 c07332e92435dc83b4aa8368f041d873f22e7977658027a8085da7bf96d47352b1e11ff6cca52517790da08493e21f43d8b8f2314a6f775ad3555b2faf01b3ee
SSDEEP 24576:c/LFmDoE1Zjaqi/3ymfSBjDHubkX0YuSw7zMYQ0a4lFbp:cjivD9EimfEuYXXuSoWx+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot aa 1651135890 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.573

Botnet

Campaign

1651135890

149.135.101.20:443
103.139.243.207:990
1.161.104.149:995
185.249.85.175:443
113.89.5.252:995
202.134.152.2:2222
41.107.132.203:443
191.250.245.193:443
117.248.109.38:21
86.195.158.178:2222
71.13.93.154:2222
45.9.20.200:443
103.87.95.133:2222
173.174.216.62:443
187.58.79.229:993
203.122.46.130:443
32.221.224.140:995
175.145.235.37:443
81.155.87.247:2078
140.82.63.183:443
45.76.167.26:443
45.76.167.26:995
149.28.238.199:995
149.28.238.199:443
144.202.2.175:995
144.202.3.39:995
144.202.2.175:443
144.202.3.39:443
140.82.63.183:995
45.63.1.12:995
45.63.1.12:443
70.46.220.114:443
45.241.145.100:995
217.164.210.192:443
5.32.41.45:443
83.110.218.155:993
37.210.160.58:2222
86.98.208.214:2222
92.132.172.197:2222
121.7.223.59:2222
172.114.160.81:995
37.186.54.254:995
196.203.37.215:80
24.178.196.158:2222
120.150.218.241:995
91.177.173.10:995
31.35.28.29:443
24.139.72.117:443
217.128.122.65:2222
82.152.39.39:443
148.0.57.85:443
104.34.212.7:32103
176.67.56.94:443
208.107.221.224:443
182.191.92.203:995
103.88.226.30:443
41.84.234.144:995
103.107.113.120:443
24.152.219.253:995
46.107.48.202:443
197.161.54.85:993
1.161.104.149:443
74.14.7.71:2222
93.48.80.198:995
39.49.7.245:995
80.11.74.81:2222
89.86.33.217:443
2.34.12.8:443
38.70.253.226:2222
47.23.89.62:993
172.114.160.81:443
75.99.168.194:443
108.60.213.141:443
2.50.4.57:443
102.65.38.74:443
69.14.172.24:443
72.76.94.99:443
47.23.89.62:995
41.228.22.180:443
148.64.96.100:443
180.129.20.164:995
140.82.49.12:443
78.180.88.120:443
46.176.222.34:995
187.207.47.198:61202
89.101.97.139:443
103.246.242.202:443
75.99.168.194:61201
197.89.108.36:443
39.52.23.208:995
94.59.56.46:2222
172.115.177.204:2222
39.44.144.64:995
174.69.215.101:443
67.209.195.198:443
94.59.56.46:1194
83.110.94.89:443
31.215.98.103:443
39.57.23.116:995
190.74.239.37:2222
180.183.102.114:2222
67.165.206.193:993
45.46.53.140:2222
102.182.232.3:995
121.74.167.191:995
189.146.78.175:443
173.21.10.71:2222
73.151.236.31:443
76.25.142.196:443
191.99.191.28:443
41.38.167.179:995
187.250.114.15:443
187.208.137.144:443
190.252.242.69:443
37.34.253.233:443
47.156.191.217:443
186.64.67.3:443
70.51.153.227:2222
201.172.23.68:2222
72.12.115.71:22
179.99.49.37:32101
40.134.246.185:995
100.1.108.246:443
24.55.67.176:443
174.95.174.163:2222
101.50.120.166:995
179.158.105.44:443
187.102.135.142:2222
72.252.157.172:990
72.252.157.172:995
191.112.14.1:443
109.12.111.14:443
101.109.187.37:443
94.36.195.250:2222
120.61.3.142:443
84.241.8.23:32103
85.246.82.244:443
39.41.184.13:995
98.22.246.169:443
189.243.13.151:443
63.143.92.99:995
167.86.165.74:443
82.41.63.217:443
188.211.190.128:61202
176.205.194.145:2078
79.129.121.68:995
122.178.90.3:50001
197.94.84.67:443
187.201.245.132:22
187.52.231.156:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3944	4140	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 4140	4916	rundll32.exe	84
PID 4916 wrote to memory of 4140	4916	rundll32.exe	84
PID 4916 wrote to memory of 4140	4916	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a27df79ba5f04d6a09189e6d01c301e6ddbf082c67c2853ec2f4bbfdf2b51a56.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a27df79ba5f04d6a09189e6d01c301e6ddbf082c67c2853ec2f4bbfdf2b51a56.dll,#1
  2⤵
  PID:4140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 684
    3⤵
    - Program crash
    PID:3944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4140 -ip 4140
1⤵
PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4140-0-0x0000000000D60000-0x0000000000EDC000-memory.dmp

Download

memory/4140-1-0x0000000000730000-0x0000000000731000-memory.dmp

Download

memory/4140-2-0x0000000002940000-0x00000000029CA000-memory.dmp

Download

memory/4140-3-0x0000000002A60000-0x0000000002AEF000-memory.dmp

Download

memory/4140-6-0x0000000002A60000-0x0000000002AEF000-memory.dmp

Download

memory/4140-4-0x0000000002A60000-0x0000000002AEF000-memory.dmp

Download

memory/4140-7-0x0000000000D60000-0x0000000000EDC000-memory.dmp

Download

memory/4140-8-0x0000000002940000-0x00000000029CA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads