qakbot | f407120d5118eb9f93c290461e19bfb20a456a85919c80cc47b4229716131732

Analysis

max time kernel
136s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2024 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f407120d5118eb9f93c290461e19bfb20a456a85919c80cc47b4229716131732.dll
Size

1.2MB
MD5

ef041480476edfeb4a194ef6f66e7fe4
SHA1

53878e928ae5f61f2a1232ed59ce0e92f9c3861b
SHA256

f407120d5118eb9f93c290461e19bfb20a456a85919c80cc47b4229716131732
SHA512

9f0701593f87ec48da894fdbe728556b5821aa0927a782dd867b39e0d93590d82c78520f956ae761cf1d20bd7498ff909fcd67edf466f81b0ce58aaa0be9ef1a
SSDEEP

12288:qHp8QR4RE4VrnNW2ooodjLmVG0iDpAeSCsdyBvFn5PffhsHmN0ZVR1Ox3LLo/ibe:qJLR4RvJW2VLyQCGyL5Pnhzgq33o/

Score

10^/10

qakbot biden12 1615580905 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.194

Botnet

biden12

Campaign

1615580905

24.229.150.54:995

109.12.111.14:443

173.21.10.71:2222

81.214.126.173:2222

75.118.1.141:443

98.252.118.134:443

71.74.12.34:443

186.31.77.42:443

81.97.154.100:443

71.117.132.169:443

24.139.72.117:443

67.165.206.193:993

106.51.52.111:443

47.196.192.184:443

71.197.126.250:443

24.95.61.62:443

47.22.148.6:443

195.12.154.8:443

71.163.223.159:443

197.45.110.165:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2664 1612 WerFault.exe rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 2540 svchost.exe

pid	pid_target	process	target process
2664	1612	WerFault.exe	rundll32.exe

description	pid	process
Token: SeManageVolumePrivilege	2540	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2300 wrote to memory of 1612	2300	rundll32.exe	rundll32.exe
PID 2300 wrote to memory of 1612	2300	rundll32.exe	rundll32.exe
PID 2300 wrote to memory of 1612	2300	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f407120d5118eb9f93c290461e19bfb20a456a85919c80cc47b4229716131732.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f407120d5118eb9f93c290461e19bfb20a456a85919c80cc47b4229716131732.dll,#1
2⤵
PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 760
3⤵
- Program crash
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1612 -ip 1612
1⤵
PID:4116

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2152

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-0-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/1612-1-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/1612-2-0x0000000002AC0000-0x0000000002AF9000-memory.dmp

Filesize
228KB

Download
memory/1612-3-0x0000000004130000-0x000000000416B000-memory.dmp

Filesize
236KB

Download
memory/2540-5-0x0000014C21240000-0x0000014C21250000-memory.dmp

Filesize
64KB

Download
memory/2540-21-0x0000014C21340000-0x0000014C21350000-memory.dmp

Filesize
64KB

Download
memory/2540-37-0x0000014C29650000-0x0000014C29651000-memory.dmp

Filesize
4KB

Download
memory/2540-39-0x0000014C29690000-0x0000014C29691000-memory.dmp

Filesize
4KB

Download
memory/2540-40-0x0000014C29680000-0x0000014C29681000-memory.dmp

Filesize
4KB

Download
memory/2540-41-0x0000014C29790000-0x0000014C29791000-memory.dmp

Filesize
4KB

Download