qakbot | 67127f9d94810aaab88190eaad9328948186a531009b2b9e98470236c624ae81

Analysis

max time kernel
110s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-08-2024 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a32054753565349777d62ad999e0b770N.dll
Size

1.0MB
MD5

a32054753565349777d62ad999e0b770
SHA1

f3c8622c488b37c89ee0f6daa844fbe23c8fd5da
SHA256

67127f9d94810aaab88190eaad9328948186a531009b2b9e98470236c624ae81
SHA512

5e8b9d4823152b922093743a7311eed12110b290132c3ba648fe3ea3886291d5f01a2c47dd7599996737b0a2147dea12cd3065461a54097c81ff74cf107bc5ba
SSDEEP

24576:A9Aa+GoDK4lxB0D+eS9YUE89guJp7aYpsI4LyI5WeHocqi8ORED:A9t4lxB05TOkmI5WeHdq

Score

10^/10

qakbot biden51 1622188821 banker discovery stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

biden51

Campaign

1622188821

75.67.192.125:443

96.61.23.88:995

140.82.49.12:443

188.26.91.212:443

144.139.47.206:443

24.152.219.253:995

95.77.223.148:443

92.59.35.196:2222

68.186.192.69:443

207.246.116.237:995

45.77.117.108:2222

207.246.77.75:8443

207.246.77.75:443

144.202.38.185:443

144.202.38.185:995

207.246.77.75:2222

45.77.117.108:995

149.28.98.196:995

45.77.115.208:995

45.77.115.208:8443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4436	3900	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 3900	1124	rundll32.exe	83
PID 1124 wrote to memory of 3900	1124	rundll32.exe	83
PID 1124 wrote to memory of 3900	1124	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a32054753565349777d62ad999e0b770N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a32054753565349777d62ad999e0b770N.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 676
    3⤵
    - Program crash
    PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3900 -ip 3900
1⤵
PID:4504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3900-0-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3900-4-0x00000000012D0000-0x000000000130D000-memory.dmp

Filesize
244KB

Download
memory/3900-6-0x0000000001550000-0x000000000158D000-memory.dmp

Filesize
244KB

Download
memory/3900-5-0x0000000001550000-0x000000000158D000-memory.dmp

Filesize
244KB

Download
memory/3900-8-0x0000000001550000-0x000000000158D000-memory.dmp

Filesize
244KB

Download
memory/3900-9-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3900-10-0x00000000012D0000-0x000000000130D000-memory.dmp

Filesize
244KB

Download