qakbot | e2a71c4d93e8689b654de050c7ce3bbc4dd728e9a07c2a9386694bd7877d45f7

General

Target

file.dll
Size

407KB
MD5

cd19a50f42bc88d64b9009c8c8e6ea0c
SHA1

60f24eced89ce58dcc6f4ebd178f1573529d80e7
SHA256

e2a71c4d93e8689b654de050c7ce3bbc4dd728e9a07c2a9386694bd7877d45f7
SHA512

9daa1f9edeedc43845ca1a7141c2dd3f48a7f602fd588d3a3c462f360979a0f690933cdd8e110927d6e0b4535ff5119fc2630e33fd229d227146ac2d514268d0

Score

10^/10

qakbot obama05 1613729859 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

obama05

Campaign

1613729859

C2

86.160.137.132:443

172.87.157.235:3389

106.51.85.162:443

108.31.15.10:995

38.92.225.121:443

173.184.119.153:995

81.150.181.168:2222

71.187.170.235:443

188.25.63.105:443

71.117.132.169:443

193.248.221.184:2222

85.52.72.32:2222

87.202.87.210:2222

78.185.59.190:443

2.7.116.188:2222

81.97.154.100:443

24.50.118.93:443

98.121.187.78:443

108.29.32.251:443

24.152.219.253:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

996 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1584 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1176 regsvr32.exe
1176 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1176 regsvr32.exe

pid	process
996	regsvr32.exe

pid	process
1584	schtasks.exe

pid	process
1176	regsvr32.exe
1176	regsvr32.exe

pid	process
1176	regsvr32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1652 wrote to memory of 1176	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 1176	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 1176	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 1176	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 1176	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 1176	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 1176	1652	regsvr32.exe	regsvr32.exe
PID 1176 wrote to memory of 1464	1176	regsvr32.exe	explorer.exe
PID 1176 wrote to memory of 1464	1176	regsvr32.exe	explorer.exe
PID 1176 wrote to memory of 1464	1176	regsvr32.exe	explorer.exe
PID 1176 wrote to memory of 1464	1176	regsvr32.exe	explorer.exe
PID 1176 wrote to memory of 1464	1176	regsvr32.exe	explorer.exe
PID 1176 wrote to memory of 1464	1176	regsvr32.exe	explorer.exe
PID 1464 wrote to memory of 1584	1464	explorer.exe	schtasks.exe
PID 1464 wrote to memory of 1584	1464	explorer.exe	schtasks.exe
PID 1464 wrote to memory of 1584	1464	explorer.exe	schtasks.exe
PID 1464 wrote to memory of 1584	1464	explorer.exe	schtasks.exe
PID 1796 wrote to memory of 1100	1796	taskeng.exe	regsvr32.exe
PID 1796 wrote to memory of 1100	1796	taskeng.exe	regsvr32.exe
PID 1796 wrote to memory of 1100	1796	taskeng.exe	regsvr32.exe
PID 1796 wrote to memory of 1100	1796	taskeng.exe	regsvr32.exe
PID 1796 wrote to memory of 1100	1796	taskeng.exe	regsvr32.exe
PID 1100 wrote to memory of 996	1100	regsvr32.exe	regsvr32.exe
PID 1100 wrote to memory of 996	1100	regsvr32.exe	regsvr32.exe
PID 1100 wrote to memory of 996	1100	regsvr32.exe	regsvr32.exe
PID 1100 wrote to memory of 996	1100	regsvr32.exe	regsvr32.exe
PID 1100 wrote to memory of 996	1100	regsvr32.exe	regsvr32.exe
PID 1100 wrote to memory of 996	1100	regsvr32.exe	regsvr32.exe
PID 1100 wrote to memory of 996	1100	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\file.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ynuwzbneu /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\file.dll\"" /SC ONCE /Z /ST 03:18 /ET 03:30
4⤵
- Creates scheduled task(s)
PID:1584

C:\Windows\system32\taskeng.exe
taskeng.exe {E3BD5AA5-401D-4014-8C08-239F4EF27D08} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\file.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\file.dll"
3⤵
- Loads dropped DLL
PID:996

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\file.dll
MD5
163b4f32afcf04b5b478e29e9b639a21

SHA1
2b8b6a5cc2805d83195f65683ad95b336e79efd9

SHA256
6a65c1bfa2263773316ff5035a3b4453371227e6f14a09b0161e52c32d905063

SHA512
56db39d1716ac62bb503c0e849062d2f03595c2545772dff06ee2d1ebc22bcc3ebdd1867746a0be57be44ec80dc06192ff670857bb14137c67298ffc6086bd8f

Download Submit
\Users\Admin\AppData\Local\Temp\file.dll
MD5
163b4f32afcf04b5b478e29e9b639a21

SHA1
2b8b6a5cc2805d83195f65683ad95b336e79efd9

SHA256
6a65c1bfa2263773316ff5035a3b4453371227e6f14a09b0161e52c32d905063

SHA512
56db39d1716ac62bb503c0e849062d2f03595c2545772dff06ee2d1ebc22bcc3ebdd1867746a0be57be44ec80dc06192ff670857bb14137c67298ffc6086bd8f

Download Submit
memory/996-72-0x0000000000000000-mapping.dmp

Download
memory/1100-69-0x0000000000000000-mapping.dmp

Download
memory/1176-63-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download
memory/1176-62-0x0000000000380000-0x0000000000400000-memory.dmp

Filesize
512KB

Download
memory/1176-61-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download
memory/1176-60-0x0000000000000000-mapping.dmp

Download
memory/1464-64-0x0000000000000000-mapping.dmp

Download
memory/1464-66-0x0000000074091000-0x0000000074093000-memory.dmp

Filesize
8KB

Download
memory/1464-68-0x0000000000080000-0x00000000000B5000-memory.dmp

Filesize
212KB

Download
memory/1584-67-0x0000000000000000-mapping.dmp

Download
memory/1652-59-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads