qakbot | bbf736f789ba7eb37fbe1e9f3e6178be4502d9240684edf95b4a38afdaf3a544

General

Target

bbf736f789ba7eb37fbe1e9f3e6178be4502d9240684edf95b4a38afdaf3a544.dll
Size

697KB
MD5

9e26842ba409e75c39530bab8090c877
SHA1

efef96c0d078c363b62c77bb94e2cae6b4777c2c
SHA256

bbf736f789ba7eb37fbe1e9f3e6178be4502d9240684edf95b4a38afdaf3a544
SHA512

3370b38037ccb8632140736c61a76f449a17258f890464be6d726315577b75b147878dbba027773d92726830105f37793015d66652fdf948490acfb1134f6b5e

Score

10^/10

qakbot obama12 1615574918 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

obama12

Campaign

1615574918

C2

197.45.110.165:995

97.69.160.4:2222

216.201.162.158:443

172.78.30.215:443

105.198.236.99:443

24.117.107.120:443

75.136.40.155:443

77.27.204.204:995

86.175.79.249:443

140.82.49.12:443

189.210.115.207:443

71.41.184.10:3389

193.248.221.184:2222

76.25.142.196:443

83.110.108.38:2222

92.59.35.196:2222

73.25.124.140:2222

75.67.192.125:443

176.205.222.30:2078

83.196.56.65:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

928 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2004 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1988 rundll32.exe
1988 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1988 rundll32.exe

pid	process
928	regsvr32.exe

pid	process
2004	schtasks.exe

pid	process
1988	rundll32.exe
1988	rundll32.exe

pid	process
1988	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1072 wrote to memory of 1988	1072	rundll32.exe	rundll32.exe
PID 1072 wrote to memory of 1988	1072	rundll32.exe	rundll32.exe
PID 1072 wrote to memory of 1988	1072	rundll32.exe	rundll32.exe
PID 1072 wrote to memory of 1988	1072	rundll32.exe	rundll32.exe
PID 1072 wrote to memory of 1988	1072	rundll32.exe	rundll32.exe
PID 1072 wrote to memory of 1988	1072	rundll32.exe	rundll32.exe
PID 1072 wrote to memory of 1988	1072	rundll32.exe	rundll32.exe
PID 1988 wrote to memory of 1824	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 1824	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 1824	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 1824	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 1824	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 1824	1988	rundll32.exe	explorer.exe
PID 1824 wrote to memory of 2004	1824	explorer.exe	schtasks.exe
PID 1824 wrote to memory of 2004	1824	explorer.exe	schtasks.exe
PID 1824 wrote to memory of 2004	1824	explorer.exe	schtasks.exe
PID 1824 wrote to memory of 2004	1824	explorer.exe	schtasks.exe
PID 916 wrote to memory of 1944	916	taskeng.exe	regsvr32.exe
PID 916 wrote to memory of 1944	916	taskeng.exe	regsvr32.exe
PID 916 wrote to memory of 1944	916	taskeng.exe	regsvr32.exe
PID 916 wrote to memory of 1944	916	taskeng.exe	regsvr32.exe
PID 916 wrote to memory of 1944	916	taskeng.exe	regsvr32.exe
PID 1944 wrote to memory of 928	1944	regsvr32.exe	regsvr32.exe
PID 1944 wrote to memory of 928	1944	regsvr32.exe	regsvr32.exe
PID 1944 wrote to memory of 928	1944	regsvr32.exe	regsvr32.exe
PID 1944 wrote to memory of 928	1944	regsvr32.exe	regsvr32.exe
PID 1944 wrote to memory of 928	1944	regsvr32.exe	regsvr32.exe
PID 1944 wrote to memory of 928	1944	regsvr32.exe	regsvr32.exe
PID 1944 wrote to memory of 928	1944	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bbf736f789ba7eb37fbe1e9f3e6178be4502d9240684edf95b4a38afdaf3a544.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bbf736f789ba7eb37fbe1e9f3e6178be4502d9240684edf95b4a38afdaf3a544.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vkxazapv /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\bbf736f789ba7eb37fbe1e9f3e6178be4502d9240684edf95b4a38afdaf3a544.dll\"" /SC ONCE /Z /ST 04:06 /ET 04:18
4⤵
- Creates scheduled task(s)
PID:2004

C:\Windows\system32\taskeng.exe
taskeng.exe {105CB81B-282E-4616-A859-E2B481E35E25} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\bbf736f789ba7eb37fbe1e9f3e6178be4502d9240684edf95b4a38afdaf3a544.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\bbf736f789ba7eb37fbe1e9f3e6178be4502d9240684edf95b4a38afdaf3a544.dll"
3⤵
- Loads dropped DLL
PID:928

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bbf736f789ba7eb37fbe1e9f3e6178be4502d9240684edf95b4a38afdaf3a544.dll
MD5
556e3173627df288592621c4d7ccf0c5

SHA1
100bc1706bac86b3c3408fc17481c12317537b84

SHA256
a7b33517122c6228be7a96ba6e6ca497f7726084e14ab6cfffea2168d3b6eb49

SHA512
8cd7c8a4124eaa8d50cf6ef6ffcf0f4385f105a1ff29f9cc69a9cd3d5e557c0608d81169e8c4b562c24b36761ad583e41287f7f2877a6b471ade1f77db9f4a6e

Download Submit
\Users\Admin\AppData\Local\Temp\bbf736f789ba7eb37fbe1e9f3e6178be4502d9240684edf95b4a38afdaf3a544.dll
MD5
556e3173627df288592621c4d7ccf0c5

SHA1
100bc1706bac86b3c3408fc17481c12317537b84

SHA256
a7b33517122c6228be7a96ba6e6ca497f7726084e14ab6cfffea2168d3b6eb49

SHA512
8cd7c8a4124eaa8d50cf6ef6ffcf0f4385f105a1ff29f9cc69a9cd3d5e557c0608d81169e8c4b562c24b36761ad583e41287f7f2877a6b471ade1f77db9f4a6e

Download Submit
memory/928-17-0x0000000000000000-mapping.dmp

Download
memory/1824-12-0x0000000000080000-0x00000000000B5000-memory.dmp

Filesize
212KB

Download
memory/1824-7-0x0000000000000000-mapping.dmp

Download
memory/1824-9-0x0000000074A91000-0x0000000074A93000-memory.dmp

Filesize
8KB

Download
memory/1824-13-0x0000000000080000-0x00000000000B5000-memory.dmp

Filesize
212KB

Download
memory/1944-15-0x000007FEFC011000-0x000007FEFC013000-memory.dmp

Filesize
8KB

Download
memory/1944-14-0x0000000000000000-mapping.dmp

Download
memory/1988-6-0x0000000000AF0000-0x0000000000B25000-memory.dmp

Filesize
212KB

Download
memory/1988-10-0x0000000000AF0000-0x0000000000B25000-memory.dmp

Filesize
212KB

Download
memory/1988-2-0x0000000000000000-mapping.dmp

Download
memory/1988-5-0x0000000000330000-0x0000000000363000-memory.dmp

Filesize
204KB

Download
memory/1988-4-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/1988-3-0x0000000075251000-0x0000000075253000-memory.dmp

Filesize
8KB

Download
memory/2004-11-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads