qakbot | bbf736f789ba7eb37fbe1e9f3e6178be4502d9240684edf95b4a38afdaf3a544

General

Target

SecuriteInfo.com.Trojan.Inject4.8682.31861.28816.dll
Size

697KB
MD5

9e26842ba409e75c39530bab8090c877
SHA1

efef96c0d078c363b62c77bb94e2cae6b4777c2c
SHA256

bbf736f789ba7eb37fbe1e9f3e6178be4502d9240684edf95b4a38afdaf3a544
SHA512

3370b38037ccb8632140736c61a76f449a17258f890464be6d726315577b75b147878dbba027773d92726830105f37793015d66652fdf948490acfb1134f6b5e

Score

10^/10

qakbot obama12 1615574918 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

obama12

Campaign

1615574918

C2

197.45.110.165:995

97.69.160.4:2222

216.201.162.158:443

172.78.30.215:443

105.198.236.99:443

24.117.107.120:443

75.136.40.155:443

77.27.204.204:995

86.175.79.249:443

140.82.49.12:443

189.210.115.207:443

71.41.184.10:3389

193.248.221.184:2222

76.25.142.196:443

83.110.108.38:2222

92.59.35.196:2222

73.25.124.140:2222

75.67.192.125:443

176.205.222.30:2078

83.196.56.65:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

628 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1664 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1172 rundll32.exe
1172 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1172 rundll32.exe

pid	process
628	regsvr32.exe

pid	process
1664	schtasks.exe

pid	process
1172	rundll32.exe
1172	rundll32.exe

pid	process
1172	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1648 wrote to memory of 1172	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1172	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1172	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1172	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1172	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1172	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1172	1648	rundll32.exe	rundll32.exe
PID 1172 wrote to memory of 848	1172	rundll32.exe	explorer.exe
PID 1172 wrote to memory of 848	1172	rundll32.exe	explorer.exe
PID 1172 wrote to memory of 848	1172	rundll32.exe	explorer.exe
PID 1172 wrote to memory of 848	1172	rundll32.exe	explorer.exe
PID 1172 wrote to memory of 848	1172	rundll32.exe	explorer.exe
PID 1172 wrote to memory of 848	1172	rundll32.exe	explorer.exe
PID 848 wrote to memory of 1664	848	explorer.exe	schtasks.exe
PID 848 wrote to memory of 1664	848	explorer.exe	schtasks.exe
PID 848 wrote to memory of 1664	848	explorer.exe	schtasks.exe
PID 848 wrote to memory of 1664	848	explorer.exe	schtasks.exe
PID 340 wrote to memory of 992	340	taskeng.exe	regsvr32.exe
PID 340 wrote to memory of 992	340	taskeng.exe	regsvr32.exe
PID 340 wrote to memory of 992	340	taskeng.exe	regsvr32.exe
PID 340 wrote to memory of 992	340	taskeng.exe	regsvr32.exe
PID 340 wrote to memory of 992	340	taskeng.exe	regsvr32.exe
PID 992 wrote to memory of 628	992	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 628	992	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 628	992	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 628	992	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 628	992	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 628	992	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 628	992	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.8682.31861.28816.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.8682.31861.28816.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn aurfcmhkew /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.8682.31861.28816.dll\"" /SC ONCE /Z /ST 22:39 /ET 22:51
4⤵
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\taskeng.exe
taskeng.exe {17024778-9A5A-46B9-82DF-DFACE9499F05} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:340

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.8682.31861.28816.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.8682.31861.28816.dll"
3⤵
- Loads dropped DLL
PID:628

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.8682.31861.28816.dll
MD5
556e3173627df288592621c4d7ccf0c5

SHA1
100bc1706bac86b3c3408fc17481c12317537b84

SHA256
a7b33517122c6228be7a96ba6e6ca497f7726084e14ab6cfffea2168d3b6eb49

SHA512
8cd7c8a4124eaa8d50cf6ef6ffcf0f4385f105a1ff29f9cc69a9cd3d5e557c0608d81169e8c4b562c24b36761ad583e41287f7f2877a6b471ade1f77db9f4a6e

Download Submit
\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.8682.31861.28816.dll
MD5
556e3173627df288592621c4d7ccf0c5

SHA1
100bc1706bac86b3c3408fc17481c12317537b84

SHA256
a7b33517122c6228be7a96ba6e6ca497f7726084e14ab6cfffea2168d3b6eb49

SHA512
8cd7c8a4124eaa8d50cf6ef6ffcf0f4385f105a1ff29f9cc69a9cd3d5e557c0608d81169e8c4b562c24b36761ad583e41287f7f2877a6b471ade1f77db9f4a6e

Download Submit
memory/628-17-0x0000000000000000-mapping.dmp

Download
memory/848-11-0x0000000000080000-0x00000000000B5000-memory.dmp

Filesize
212KB

Download
memory/848-13-0x0000000000080000-0x00000000000B5000-memory.dmp

Filesize
212KB

Download
memory/848-7-0x0000000000000000-mapping.dmp

Download
memory/848-9-0x0000000074271000-0x0000000074273000-memory.dmp

Filesize
8KB

Download
memory/992-15-0x000007FEFB6F1000-0x000007FEFB6F3000-memory.dmp

Filesize
8KB

Download
memory/992-14-0x0000000000000000-mapping.dmp

Download
memory/1172-10-0x0000000000B80000-0x0000000000BB5000-memory.dmp

Filesize
212KB

Download
memory/1172-6-0x0000000000B80000-0x0000000000BB5000-memory.dmp

Filesize
212KB

Download
memory/1172-2-0x0000000000000000-mapping.dmp

Download
memory/1172-5-0x00000000002E0000-0x0000000000313000-memory.dmp

Filesize
204KB

Download
memory/1172-4-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/1172-3-0x0000000074B31000-0x0000000074B33000-memory.dmp

Filesize
8KB

Download
memory/1664-12-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads