qakbot | 91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b

General

Target

91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b.dll
Size

367KB
MD5

99fac0e2ce4cdb8050e840b62318d6f1
SHA1

f690c8ac8ba4fc9d8edf9e45d3c1f82fe034e40c
SHA256

91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b
SHA512

e17cafe8183ee246a975b128ab811c1165e80dfde43fea86f47a58991a0198e1147e6152d131f4d793ff992d41b06ec0ff3f6f9457f29be0b2b324d7880176fc
SSDEEP

6144:IY75ZesN73wU7HuAmHKmlEwrPmRPWEpWFn2E6lyDntvhhOU35RJy:IqfTVByqTwr03pdf8vhhOKJy

Score

10^/10

qakbot obama07 1614243368 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

obama07

Campaign

1614243368

C2

71.163.223.159:443

87.202.87.210:2222

98.192.185.86:443

78.180.179.136:443

115.133.243.6:443

140.82.49.12:443

2.7.116.188:2222

83.110.11.244:2222

187.250.39.162:443

213.60.147.140:443

188.26.91.212:443

86.236.77.68:2222

172.87.157.235:3389

79.115.174.55:443

113.22.175.141:443

217.133.54.140:32100

83.110.109.106:2222

176.181.247.197:443

59.90.246.200:443

173.21.10.71:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4692 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2564 4692 WerFault.exe regsvr32.exe

pid	process
4692	regsvr32.exe

pid	pid_target	process	target process
2564	4692	WerFault.exe	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2556 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exe

pid process

5032 regsvr32.exe
5032 regsvr32.exe
5032 regsvr32.exe
5032 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

5032 regsvr32.exe

pid	process
2556	schtasks.exe

pid	process
5032	regsvr32.exe
5032	regsvr32.exe
5032	regsvr32.exe
5032	regsvr32.exe

pid	process
5032	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 2632 wrote to memory of 5032	2632	regsvr32.exe	regsvr32.exe
PID 2632 wrote to memory of 5032	2632	regsvr32.exe	regsvr32.exe
PID 2632 wrote to memory of 5032	2632	regsvr32.exe	regsvr32.exe
PID 5032 wrote to memory of 4248	5032	regsvr32.exe	explorer.exe
PID 5032 wrote to memory of 4248	5032	regsvr32.exe	explorer.exe
PID 5032 wrote to memory of 4248	5032	regsvr32.exe	explorer.exe
PID 5032 wrote to memory of 4248	5032	regsvr32.exe	explorer.exe
PID 5032 wrote to memory of 4248	5032	regsvr32.exe	explorer.exe
PID 4248 wrote to memory of 2556	4248	explorer.exe	schtasks.exe
PID 4248 wrote to memory of 2556	4248	explorer.exe	schtasks.exe
PID 4248 wrote to memory of 2556	4248	explorer.exe	schtasks.exe
PID 2352 wrote to memory of 4692	2352	regsvr32.exe	regsvr32.exe
PID 2352 wrote to memory of 4692	2352	regsvr32.exe	regsvr32.exe
PID 2352 wrote to memory of 4692	2352	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2632

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b.dll
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5032

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4248

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mnqxgmeclx /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b.dll\"" /SC ONCE /Z /ST 19:02 /ET 19:14
4⤵
- Creates scheduled task(s)
PID:2556

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b.dll"
2⤵
- Loads dropped DLL
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 588
3⤵
- Program crash
PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4692 -ip 4692
1⤵
PID:3716

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b.dll
Filesize
367KB

MD5
be56b94c17def87ebc48d53102687dfa

SHA1
016495925d9edffb4088cc2cec1d8fbcff6e2220

SHA256
50dc0e489c0646b661443d4ed96868b44ae6ba9ac32f38a57d8501c62056965d

SHA512
e5b7756b7f255a4ae3046f0a6e5f2728b22cd5eccf30f781360a16128be0040daa34fa2dcc4401aec843772a33dc9e377a58023817fa0588d124479b9ea1298c

Download Submit
C:\Users\Admin\AppData\Local\Temp\91b2699d3ab9975d1c1648e46826114e85275df98757594561011576ad7d502b.dll
Filesize
367KB

MD5
be56b94c17def87ebc48d53102687dfa

SHA1
016495925d9edffb4088cc2cec1d8fbcff6e2220

SHA256
50dc0e489c0646b661443d4ed96868b44ae6ba9ac32f38a57d8501c62056965d

SHA512
e5b7756b7f255a4ae3046f0a6e5f2728b22cd5eccf30f781360a16128be0040daa34fa2dcc4401aec843772a33dc9e377a58023817fa0588d124479b9ea1298c

Download Submit
memory/2556-137-0x0000000000000000-mapping.dmp

Download
memory/4248-136-0x0000000000000000-mapping.dmp

Download
memory/4248-138-0x0000000001040000-0x0000000001075000-memory.dmp

Filesize
212KB

Download
memory/4248-139-0x0000000001040000-0x0000000001075000-memory.dmp

Filesize
212KB

Download
memory/4692-141-0x0000000000000000-mapping.dmp

Download
memory/4692-143-0x0000000010000000-0x0000000011000000-memory.dmp

Filesize
16.0MB

Download
memory/5032-132-0x0000000000000000-mapping.dmp

Download
memory/5032-133-0x0000000010000000-0x0000000011000000-memory.dmp

Filesize
16.0MB

Download
memory/5032-134-0x0000000002990000-0x0000000003990000-memory.dmp

Filesize
16.0MB

Download
memory/5032-135-0x0000000010000000-0x0000000011000000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads