qakbot | 11a37b108a01f9c6bcb2bbf4f7cd72d407280b9f3d33c223cc67bc2c6656c012

General

Target

d17397b16b127f8e525f5b6acc121b1a.dll
Size

797KB
MD5

d17397b16b127f8e525f5b6acc121b1a
SHA1

cdf9c51d9fa1f1fd1eb4f4e231f67bbc826ba6d6
SHA256

11a37b108a01f9c6bcb2bbf4f7cd72d407280b9f3d33c223cc67bc2c6656c012
SHA512

cd1a27726ee4d1982f3fb627315e65419f0b4bfe42bb3e3e2d83ae2193543787580fa9ba7e9b2bdf190975cc2172be39b7ba262a5b59b8db1d0459fc630caf32

Score

10^/10

qakbot obama32 1618995682 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

obama32

Campaign

1618995682

C2

190.85.91.154:443

140.82.49.12:443

96.37.113.36:993

73.25.124.140:2222

71.41.184.10:3389

50.244.112.106:443

78.63.226.32:443

24.152.219.253:995

105.198.236.99:443

149.28.101.90:8443

149.28.101.90:443

149.28.101.90:2222

45.77.115.208:8443

207.246.77.75:8443

207.246.77.75:2222

207.246.116.237:2222

45.77.117.108:995

144.202.38.185:2222

207.246.77.75:995

207.246.77.75:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 2 IoCs

Processes:

regsvr32.exe

pid process

2064 regsvr32.exe
2064 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2816 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

380 rundll32.exe
380 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

380 rundll32.exe

pid	process
2064	regsvr32.exe
2064	regsvr32.exe

pid	process
2816	schtasks.exe

pid	process
380	rundll32.exe
380	rundll32.exe

pid	process
380	rundll32.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 804 wrote to memory of 380	804	rundll32.exe	rundll32.exe
PID 804 wrote to memory of 380	804	rundll32.exe	rundll32.exe
PID 804 wrote to memory of 380	804	rundll32.exe	rundll32.exe
PID 380 wrote to memory of 3960	380	rundll32.exe	cmd.exe
PID 380 wrote to memory of 3960	380	rundll32.exe	cmd.exe
PID 380 wrote to memory of 3960	380	rundll32.exe	cmd.exe
PID 380 wrote to memory of 492	380	rundll32.exe	explorer.exe
PID 380 wrote to memory of 492	380	rundll32.exe	explorer.exe
PID 380 wrote to memory of 492	380	rundll32.exe	explorer.exe
PID 380 wrote to memory of 492	380	rundll32.exe	explorer.exe
PID 380 wrote to memory of 492	380	rundll32.exe	explorer.exe
PID 492 wrote to memory of 2816	492	explorer.exe	schtasks.exe
PID 492 wrote to memory of 2816	492	explorer.exe	schtasks.exe
PID 492 wrote to memory of 2816	492	explorer.exe	schtasks.exe
PID 2204 wrote to memory of 2064	2204	regsvr32.exe	regsvr32.exe
PID 2204 wrote to memory of 2064	2204	regsvr32.exe	regsvr32.exe
PID 2204 wrote to memory of 2064	2204	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d17397b16b127f8e525f5b6acc121b1a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:804

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d17397b16b127f8e525f5b6acc121b1a.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:380

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo summer
3⤵
PID:3960

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:492

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hhbzfqr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\d17397b16b127f8e525f5b6acc121b1a.dll\"" /SC ONCE /Z /ST 15:19 /ET 15:31
4⤵
- Creates scheduled task(s)
PID:2816

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\d17397b16b127f8e525f5b6acc121b1a.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2204

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\d17397b16b127f8e525f5b6acc121b1a.dll"
2⤵
- Loads dropped DLL
PID:2064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d17397b16b127f8e525f5b6acc121b1a.dll

MD5
74366b02e066613286bafba1c6a97231

SHA1
2390a40ddd858f5e9f815007f9b2006ede8f6b0b

SHA256
fd199bd9fd5c26fdf2e3cd48607db9e99b03f94a9489e4b5e33795218177d875

SHA512
ed1dd34ced545e354015ef042606a92ef4f6b28b8b8400634f501c344b0b305c4899357bb71e6a7098b672d6a2fd38aa6ed67968c0c4969f5124927c04a2b212

Download Submit
\Users\Admin\AppData\Local\Temp\d17397b16b127f8e525f5b6acc121b1a.dll

MD5
74366b02e066613286bafba1c6a97231

SHA1
2390a40ddd858f5e9f815007f9b2006ede8f6b0b

SHA256
fd199bd9fd5c26fdf2e3cd48607db9e99b03f94a9489e4b5e33795218177d875

SHA512
ed1dd34ced545e354015ef042606a92ef4f6b28b8b8400634f501c344b0b305c4899357bb71e6a7098b672d6a2fd38aa6ed67968c0c4969f5124927c04a2b212

Download Submit
\Users\Admin\AppData\Local\Temp\d17397b16b127f8e525f5b6acc121b1a.dll

MD5
74366b02e066613286bafba1c6a97231

SHA1
2390a40ddd858f5e9f815007f9b2006ede8f6b0b

SHA256
fd199bd9fd5c26fdf2e3cd48607db9e99b03f94a9489e4b5e33795218177d875

SHA512
ed1dd34ced545e354015ef042606a92ef4f6b28b8b8400634f501c344b0b305c4899357bb71e6a7098b672d6a2fd38aa6ed67968c0c4969f5124927c04a2b212

Download Submit
memory/380-114-0x0000000000000000-mapping.dmp

Download
memory/380-116-0x0000000074370000-0x00000000743A9000-memory.dmp

Filesize
228KB

Download
memory/380-117-0x0000000074370000-0x0000000074457000-memory.dmp

Filesize
924KB

Download
memory/380-118-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/492-119-0x0000000000000000-mapping.dmp

Download
memory/492-123-0x00000000032B0000-0x00000000032E9000-memory.dmp

Filesize
228KB

Download
memory/2064-125-0x0000000000000000-mapping.dmp

Download
memory/2816-120-0x0000000000000000-mapping.dmp

Download
memory/3960-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads