qakbot | 91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b

General

Target

91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b.dll
Size

367KB
MD5

99fac0e2ce4cdb8050e840b62318d6f1
SHA1

f690c8ac8ba4fc9d8edf9e45d3c1f82fe034e40c
SHA256

91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b
SHA512

e17cafe8183ee246a975b128ab811c1165e80dfde43fea86f47a58991a0198e1147e6152d131f4d793ff992d41b06ec0ff3f6f9457f29be0b2b324d7880176fc
SSDEEP

6144:IY75ZesN73wU7HuAmHKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJy:IqfTVByqTwr03pdf8vhhOKJy

Score

10^/10

qakbot obama07 1614243368 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

obama07

Campaign

1614243368

C2

71.163.223.159:443

87.202.87.210:2222

98.192.185.86:443

78.180.179.136:443

115.133.243.6:443

140.82.49.12:443

2.7.116.188:2222

83.110.11.244:2222

187.250.39.162:443

213.60.147.140:443

188.26.91.212:443

86.236.77.68:2222

172.87.157.235:3389

79.115.174.55:443

113.22.175.141:443

217.133.54.140:32100

83.110.109.106:2222

176.181.247.197:443

59.90.246.200:443

173.21.10.71:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

692 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1108 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1860 regsvr32.exe
1860 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1860 regsvr32.exe

pid	process
692	regsvr32.exe

pid	process
1108	schtasks.exe

pid	process
1860	regsvr32.exe
1860	regsvr32.exe

pid	process
1860	regsvr32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1720 wrote to memory of 1860	1720	regsvr32.exe	regsvr32.exe
PID 1720 wrote to memory of 1860	1720	regsvr32.exe	regsvr32.exe
PID 1720 wrote to memory of 1860	1720	regsvr32.exe	regsvr32.exe
PID 1720 wrote to memory of 1860	1720	regsvr32.exe	regsvr32.exe
PID 1720 wrote to memory of 1860	1720	regsvr32.exe	regsvr32.exe
PID 1720 wrote to memory of 1860	1720	regsvr32.exe	regsvr32.exe
PID 1720 wrote to memory of 1860	1720	regsvr32.exe	regsvr32.exe
PID 1860 wrote to memory of 1200	1860	regsvr32.exe	explorer.exe
PID 1860 wrote to memory of 1200	1860	regsvr32.exe	explorer.exe
PID 1860 wrote to memory of 1200	1860	regsvr32.exe	explorer.exe
PID 1860 wrote to memory of 1200	1860	regsvr32.exe	explorer.exe
PID 1860 wrote to memory of 1200	1860	regsvr32.exe	explorer.exe
PID 1860 wrote to memory of 1200	1860	regsvr32.exe	explorer.exe
PID 1200 wrote to memory of 1108	1200	explorer.exe	schtasks.exe
PID 1200 wrote to memory of 1108	1200	explorer.exe	schtasks.exe
PID 1200 wrote to memory of 1108	1200	explorer.exe	schtasks.exe
PID 1200 wrote to memory of 1108	1200	explorer.exe	schtasks.exe
PID 696 wrote to memory of 1304	696	taskeng.exe	regsvr32.exe
PID 696 wrote to memory of 1304	696	taskeng.exe	regsvr32.exe
PID 696 wrote to memory of 1304	696	taskeng.exe	regsvr32.exe
PID 696 wrote to memory of 1304	696	taskeng.exe	regsvr32.exe
PID 696 wrote to memory of 1304	696	taskeng.exe	regsvr32.exe
PID 1304 wrote to memory of 692	1304	regsvr32.exe	regsvr32.exe
PID 1304 wrote to memory of 692	1304	regsvr32.exe	regsvr32.exe
PID 1304 wrote to memory of 692	1304	regsvr32.exe	regsvr32.exe
PID 1304 wrote to memory of 692	1304	regsvr32.exe	regsvr32.exe
PID 1304 wrote to memory of 692	1304	regsvr32.exe	regsvr32.exe
PID 1304 wrote to memory of 692	1304	regsvr32.exe	regsvr32.exe
PID 1304 wrote to memory of 692	1304	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn plqunaqwj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b.dll\"" /SC ONCE /Z /ST 19:02 /ET 19:14
4⤵
- Creates scheduled task(s)
PID:1108

C:\Windows\system32\taskeng.exe
taskeng.exe {5E7CD9E2-29A2-4BFA-95EA-7C2A0A00C7A1} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:696

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b.dll"
3⤵
- Loads dropped DLL
PID:692

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b.dll
Filesize
367KB

MD5
be56b94c17def87ebc48d53102687dfa

SHA1
016495925d9edffb4088cc2cec1d8fbcff6e2220

SHA256
50dc0e489c0646b661443d4ed96868b44ae6ba9ac32f38a57d8501c62056965d

SHA512
e5b7756b7f255a4ae3046f0a6e5f2728b22cd5eccf30f781360a16128be0040daa34fa2dcc4401aec843772a33dc9e377a58023817fa0588d124479b9ea1298c

Download Submit
\Users\Admin\AppData\Local\Temp\91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b.dll
Filesize
367KB

MD5
be56b94c17def87ebc48d53102687dfa

SHA1
016495925d9edffb4088cc2cec1d8fbcff6e2220

SHA256
50dc0e489c0646b661443d4ed96868b44ae6ba9ac32f38a57d8501c62056965d

SHA512
e5b7756b7f255a4ae3046f0a6e5f2728b22cd5eccf30f781360a16128be0040daa34fa2dcc4401aec843772a33dc9e377a58023817fa0588d124479b9ea1298c

Download Submit
memory/692-69-0x0000000000000000-mapping.dmp

Download
memory/1108-64-0x0000000000000000-mapping.dmp

Download
memory/1200-60-0x0000000000000000-mapping.dmp

Download
memory/1200-62-0x00000000749E1000-0x00000000749E3000-memory.dmp

Filesize
8KB

Download
memory/1200-63-0x0000000000080000-0x00000000000B5000-memory.dmp

Filesize
212KB

Download
memory/1200-65-0x0000000000080000-0x00000000000B5000-memory.dmp

Filesize
212KB

Download
memory/1304-66-0x0000000000000000-mapping.dmp

Download
memory/1720-54-0x000007FEFC161000-0x000007FEFC163000-memory.dmp

Filesize
8KB

Download
memory/1860-59-0x0000000010000000-0x0000000011000000-memory.dmp

Filesize
16.0MB

Download
memory/1860-58-0x0000000002380000-0x0000000003380000-memory.dmp

Filesize
16.0MB

Download
memory/1860-57-0x0000000010000000-0x0000000011000000-memory.dmp

Filesize
16.0MB

Download
memory/1860-56-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1860-55-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads