qakbot | b40188405f04c26fdc881efb86e25f1a6d9613a6de8d9cbf229d838e014fb1c9

General

Target

file.dll
Size

407KB
MD5

ed000669e4b968dbeba014d74fa39ee6
SHA1

b1f0766843cffb0e163a17129b7e368ba860d8bc
SHA256

b40188405f04c26fdc881efb86e25f1a6d9613a6de8d9cbf229d838e014fb1c9
SHA512

0846d09902c8b96c00eca837076c1a1f6c0e9e0f83c60865fc9cdaef267262f6d65b2512e60cd0231428e27e175dfe19ef75eec3ba90ea343e6929a3e017c062

Score

10^/10

qakbot obama05 1613729859 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

obama05

Campaign

1613729859

C2

86.160.137.132:443

172.87.157.235:3389

106.51.85.162:443

108.31.15.10:995

38.92.225.121:443

173.184.119.153:995

81.150.181.168:2222

71.187.170.235:443

188.25.63.105:443

71.117.132.169:443

193.248.221.184:2222

85.52.72.32:2222

87.202.87.210:2222

78.185.59.190:443

2.7.116.188:2222

81.97.154.100:443

24.50.118.93:443

98.121.187.78:443

108.29.32.251:443

24.152.219.253:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

876 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1144 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1812 regsvr32.exe
1812 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1812 regsvr32.exe

pid	process
876	regsvr32.exe

pid	process
1144	schtasks.exe

pid	process
1812	regsvr32.exe
1812	regsvr32.exe

pid	process
1812	regsvr32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 756 wrote to memory of 1812	756	regsvr32.exe	regsvr32.exe
PID 756 wrote to memory of 1812	756	regsvr32.exe	regsvr32.exe
PID 756 wrote to memory of 1812	756	regsvr32.exe	regsvr32.exe
PID 756 wrote to memory of 1812	756	regsvr32.exe	regsvr32.exe
PID 756 wrote to memory of 1812	756	regsvr32.exe	regsvr32.exe
PID 756 wrote to memory of 1812	756	regsvr32.exe	regsvr32.exe
PID 756 wrote to memory of 1812	756	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 1700	1812	regsvr32.exe	explorer.exe
PID 1812 wrote to memory of 1700	1812	regsvr32.exe	explorer.exe
PID 1812 wrote to memory of 1700	1812	regsvr32.exe	explorer.exe
PID 1812 wrote to memory of 1700	1812	regsvr32.exe	explorer.exe
PID 1812 wrote to memory of 1700	1812	regsvr32.exe	explorer.exe
PID 1812 wrote to memory of 1700	1812	regsvr32.exe	explorer.exe
PID 1700 wrote to memory of 1144	1700	explorer.exe	schtasks.exe
PID 1700 wrote to memory of 1144	1700	explorer.exe	schtasks.exe
PID 1700 wrote to memory of 1144	1700	explorer.exe	schtasks.exe
PID 1700 wrote to memory of 1144	1700	explorer.exe	schtasks.exe
PID 360 wrote to memory of 1692	360	taskeng.exe	regsvr32.exe
PID 360 wrote to memory of 1692	360	taskeng.exe	regsvr32.exe
PID 360 wrote to memory of 1692	360	taskeng.exe	regsvr32.exe
PID 360 wrote to memory of 1692	360	taskeng.exe	regsvr32.exe
PID 360 wrote to memory of 1692	360	taskeng.exe	regsvr32.exe
PID 1692 wrote to memory of 876	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 876	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 876	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 876	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 876	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 876	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 876	1692	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\file.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn twgvmnim /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\file.dll\"" /SC ONCE /Z /ST 03:18 /ET 03:30
4⤵
- Creates scheduled task(s)
PID:1144

C:\Windows\system32\taskeng.exe
taskeng.exe {018B8401-253A-4920-9563-B18B1581AC46} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:360

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\file.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\file.dll"
3⤵
- Loads dropped DLL
PID:876

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\file.dll
MD5
73e7cce971f30300f50a8a9a8f4fe39b

SHA1
337b5003fee08c32154b81035399b1a53a57028a

SHA256
17cbef6d5ac2e1449b40147333a70a36b2878ee82d0db6a2064bf01961055eca

SHA512
6cc2157181da86cdca5fc0407e5654551290ff4d3e32de0f27d623c964421b8f313ac6c17ff58b7475bfc8ff48ffdcaf3c34f6d64dbb6bfde5b8c09726e2a1e1

Download Submit
\Users\Admin\AppData\Local\Temp\file.dll
MD5
73e7cce971f30300f50a8a9a8f4fe39b

SHA1
337b5003fee08c32154b81035399b1a53a57028a

SHA256
17cbef6d5ac2e1449b40147333a70a36b2878ee82d0db6a2064bf01961055eca

SHA512
6cc2157181da86cdca5fc0407e5654551290ff4d3e32de0f27d623c964421b8f313ac6c17ff58b7475bfc8ff48ffdcaf3c34f6d64dbb6bfde5b8c09726e2a1e1

Download Submit
memory/756-59-0x000007FEFB701000-0x000007FEFB703000-memory.dmp

Filesize
8KB

Download
memory/876-72-0x0000000000000000-mapping.dmp

Download
memory/1144-67-0x0000000000000000-mapping.dmp

Download
memory/1692-69-0x0000000000000000-mapping.dmp

Download
memory/1700-66-0x00000000740C1000-0x00000000740C3000-memory.dmp

Filesize
8KB

Download
memory/1700-64-0x0000000000000000-mapping.dmp

Download
memory/1700-68-0x00000000000C0000-0x00000000000F5000-memory.dmp

Filesize
212KB

Download
memory/1812-63-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download
memory/1812-62-0x00000000001D0000-0x0000000000250000-memory.dmp

Filesize
512KB

Download
memory/1812-61-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1812-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads