qakbot | 7ac2ea90e91521c56583f95276a3ce3d9fe372548f1c53f9049eae5d5489bd1b

General

Target

7ac2ea90e91521c56583f95276a3ce3d9fe372548f1c53f9049eae5d5489bd1b.dll
Size

220KB
MD5

61937dd3b1410a3be02b639267ebb946
SHA1

9855ac2345c63e7895ed81fc3b5bdfb74bfef82c
SHA256

7ac2ea90e91521c56583f95276a3ce3d9fe372548f1c53f9049eae5d5489bd1b
SHA512

90759932f0d96c5b7de99b642ce5c908f9385c847d738f4144ab63b6080d072d9e839e1c0d07d3473bbf63ac7534bd4f93a23c8aef4d92593734cd1ec87861c2

Score

10^/10

qakbot obama30 1618843418 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

obama30

Campaign

1618843418

C2

83.110.109.164:2222

75.67.192.125:443

189.210.115.207:443

47.196.192.184:443

72.252.201.69:443

151.205.102.42:443

81.97.154.100:443

24.117.107.120:443

140.82.49.12:443

78.63.226.32:443

72.240.200.181:2222

75.137.47.174:443

71.41.184.10:3389

73.25.124.140:2222

149.28.101.90:8443

149.28.101.90:2222

45.77.115.208:995

45.77.115.208:8443

207.246.77.75:8443

207.246.77.75:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3940 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

800 3940 WerFault.exe regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2160 schtasks.exe

pid	process
3940	regsvr32.exe

pid	pid_target	process	target process
800	3940	WerFault.exe	regsvr32.exe

pid	process
2160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

regsvr32.exeWerFault.exe

pid	process
4036	regsvr32.exe
4036	regsvr32.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

4036 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 800 WerFault.exe
Token: SeBackupPrivilege 800 WerFault.exe
Token: SeDebugPrivilege 800 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	800	WerFault.exe
Token: SeBackupPrivilege	800	WerFault.exe
Token: SeDebugPrivilege	800	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 1968 wrote to memory of 4036	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 4036	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 4036	1968	regsvr32.exe	regsvr32.exe
PID 4036 wrote to memory of 1816	4036	regsvr32.exe	explorer.exe
PID 4036 wrote to memory of 1816	4036	regsvr32.exe	explorer.exe
PID 4036 wrote to memory of 1816	4036	regsvr32.exe	explorer.exe
PID 4036 wrote to memory of 1816	4036	regsvr32.exe	explorer.exe
PID 4036 wrote to memory of 1816	4036	regsvr32.exe	explorer.exe
PID 1816 wrote to memory of 2160	1816	explorer.exe	schtasks.exe
PID 1816 wrote to memory of 2160	1816	explorer.exe	schtasks.exe
PID 1816 wrote to memory of 2160	1816	explorer.exe	schtasks.exe
PID 756 wrote to memory of 3940	756	regsvr32.exe	regsvr32.exe
PID 756 wrote to memory of 3940	756	regsvr32.exe	regsvr32.exe
PID 756 wrote to memory of 3940	756	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7ac2ea90e91521c56583f95276a3ce3d9fe372548f1c53f9049eae5d5489bd1b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\7ac2ea90e91521c56583f95276a3ce3d9fe372548f1c53f9049eae5d5489bd1b.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4036

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn swvdara /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\7ac2ea90e91521c56583f95276a3ce3d9fe372548f1c53f9049eae5d5489bd1b.dll\"" /SC ONCE /Z /ST 21:01 /ET 21:13
4⤵
- Creates scheduled task(s)
PID:2160

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\7ac2ea90e91521c56583f95276a3ce3d9fe372548f1c53f9049eae5d5489bd1b.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\7ac2ea90e91521c56583f95276a3ce3d9fe372548f1c53f9049eae5d5489bd1b.dll"
2⤵
- Loads dropped DLL
PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 596
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:800

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ac2ea90e91521c56583f95276a3ce3d9fe372548f1c53f9049eae5d5489bd1b.dll
MD5
8878d09f91a11eca5972ed210b31d5c2

SHA1
8328929f89fd85d21e2a85af0178502af39b61b5

SHA256
dad6c7e3a36789097201ea7ea45720dab161498aa4d80210a2246d840dca891d

SHA512
50e4ce8d7bbaa37672683e407c45b08024a2481b7b192880fd3aa0b5d538b1046485e32550b1a979c4a74e633ce74982e6d60b3efa194fb7a24dd0028274be08

Download Submit
\Users\Admin\AppData\Local\Temp\7ac2ea90e91521c56583f95276a3ce3d9fe372548f1c53f9049eae5d5489bd1b.dll
MD5
8878d09f91a11eca5972ed210b31d5c2

SHA1
8328929f89fd85d21e2a85af0178502af39b61b5

SHA256
dad6c7e3a36789097201ea7ea45720dab161498aa4d80210a2246d840dca891d

SHA512
50e4ce8d7bbaa37672683e407c45b08024a2481b7b192880fd3aa0b5d538b1046485e32550b1a979c4a74e633ce74982e6d60b3efa194fb7a24dd0028274be08

Download Submit
memory/1816-115-0x0000000000000000-mapping.dmp

Download
memory/1816-119-0x0000000000AE0000-0x0000000000B19000-memory.dmp

Filesize
228KB

Download
memory/2160-116-0x0000000000000000-mapping.dmp

Download
memory/3940-121-0x0000000000000000-mapping.dmp

Download
memory/4036-114-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads