qakbot | cb9b2fc56d48aaa738f2811ebbd70cd703bababdf717fa4936c3f17752ffbdec

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84dfcb2f46ff6d54b13c1975b4d40c90_NeikiAnalytics.dll
Size

158KB
MD5

84dfcb2f46ff6d54b13c1975b4d40c90
SHA1

711f28f1b4f2ecec49bf8334ef201863c27432d7
SHA256

cb9b2fc56d48aaa738f2811ebbd70cd703bababdf717fa4936c3f17752ffbdec
SHA512

befd235d2203d9f2e8b74be9eb375602ef3b1d238894bed3c02e462eed0eb80f3ad6391515f500208638c2c48bade7cfca48b6f5acd666423f747c440cbdce95
SSDEEP

3072:SgikbXp3BvScvqzzxVvAAWJ6AzxHTBfZl0O/yaJv:VTdRXvqXxh1WJJzxHTBRlf/

Score

10^/10

qakbot obama228 1670998169 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

obama228

Campaign

1670998169

78.101.91.215:2222

49.175.72.56:443

64.237.214.193:443

79.77.142.22:2222

173.18.126.3:443

23.242.141.218:2222

121.121.100.148:995

172.90.139.138:2222

172.248.42.122:443

94.63.65.146:443

98.145.23.67:443

12.172.173.82:990

91.68.227.219:443

12.172.173.82:993

75.99.125.236:2222

49.245.119.12:2222

74.66.134.24:443

173.239.94.212:443

91.169.12.198:32100

184.68.116.146:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
2220	rundll32.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe
2172	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2220 rundll32.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2304 wrote to memory of 2220	2304	rundll32.exe	rundll32.exe
PID 2304 wrote to memory of 2220	2304	rundll32.exe	rundll32.exe
PID 2304 wrote to memory of 2220	2304	rundll32.exe	rundll32.exe
PID 2304 wrote to memory of 2220	2304	rundll32.exe	rundll32.exe
PID 2304 wrote to memory of 2220	2304	rundll32.exe	rundll32.exe
PID 2304 wrote to memory of 2220	2304	rundll32.exe	rundll32.exe
PID 2304 wrote to memory of 2220	2304	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2172	2220	rundll32.exe	wermgr.exe
PID 2220 wrote to memory of 2172	2220	rundll32.exe	wermgr.exe
PID 2220 wrote to memory of 2172	2220	rundll32.exe	wermgr.exe
PID 2220 wrote to memory of 2172	2220	rundll32.exe	wermgr.exe
PID 2220 wrote to memory of 2172	2220	rundll32.exe	wermgr.exe
PID 2220 wrote to memory of 2172	2220	rundll32.exe	wermgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84dfcb2f46ff6d54b13c1975b4d40c90_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\84dfcb2f46ff6d54b13c1975b4d40c90_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2172-0-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2172-2-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/2172-4-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/2172-5-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/2172-6-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/2172-7-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/2172-8-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/2172-9-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/2172-10-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/2172-13-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download