qakbot | f7a43d8a19da8ff312d0e4c20d0374fd1e8ef60a754ecd5d5031d8c4ca9878ab

General

Target

file.dll
Size

407KB
MD5

b5aaeae67b12e63c7d5ac56b7bd0ac70
SHA1

afcc67439634a7ea0cbaff9e1c4dad311f3e79f8
SHA256

f7a43d8a19da8ff312d0e4c20d0374fd1e8ef60a754ecd5d5031d8c4ca9878ab
SHA512

c09b19464d6607e5049dfee3a35e1a2e98bf180663d3431aa911d901313774feabe36e712d8a1ad781718311d74b405950da8223b42ae3f1041307f424defc81

Score

10^/10

qakbot obama05 1613729859 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

obama05

Campaign

1613729859

C2

86.160.137.132:443

172.87.157.235:3389

106.51.85.162:443

108.31.15.10:995

38.92.225.121:443

173.184.119.153:995

81.150.181.168:2222

71.187.170.235:443

188.25.63.105:443

71.117.132.169:443

193.248.221.184:2222

85.52.72.32:2222

87.202.87.210:2222

78.185.59.190:443

2.7.116.188:2222

81.97.154.100:443

24.50.118.93:443

98.121.187.78:443

108.29.32.251:443

24.152.219.253:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1120 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1016 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1268 regsvr32.exe
1268 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1268 regsvr32.exe

pid	process
1120	regsvr32.exe

pid	process
1016	schtasks.exe

pid	process
1268	regsvr32.exe
1268	regsvr32.exe

pid	process
1268	regsvr32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1948 wrote to memory of 1268	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 1268	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 1268	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 1268	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 1268	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 1268	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 1268	1948	regsvr32.exe	regsvr32.exe
PID 1268 wrote to memory of 1756	1268	regsvr32.exe	explorer.exe
PID 1268 wrote to memory of 1756	1268	regsvr32.exe	explorer.exe
PID 1268 wrote to memory of 1756	1268	regsvr32.exe	explorer.exe
PID 1268 wrote to memory of 1756	1268	regsvr32.exe	explorer.exe
PID 1268 wrote to memory of 1756	1268	regsvr32.exe	explorer.exe
PID 1268 wrote to memory of 1756	1268	regsvr32.exe	explorer.exe
PID 1756 wrote to memory of 1016	1756	explorer.exe	schtasks.exe
PID 1756 wrote to memory of 1016	1756	explorer.exe	schtasks.exe
PID 1756 wrote to memory of 1016	1756	explorer.exe	schtasks.exe
PID 1756 wrote to memory of 1016	1756	explorer.exe	schtasks.exe
PID 1848 wrote to memory of 1548	1848	taskeng.exe	regsvr32.exe
PID 1848 wrote to memory of 1548	1848	taskeng.exe	regsvr32.exe
PID 1848 wrote to memory of 1548	1848	taskeng.exe	regsvr32.exe
PID 1848 wrote to memory of 1548	1848	taskeng.exe	regsvr32.exe
PID 1848 wrote to memory of 1548	1848	taskeng.exe	regsvr32.exe
PID 1548 wrote to memory of 1120	1548	regsvr32.exe	regsvr32.exe
PID 1548 wrote to memory of 1120	1548	regsvr32.exe	regsvr32.exe
PID 1548 wrote to memory of 1120	1548	regsvr32.exe	regsvr32.exe
PID 1548 wrote to memory of 1120	1548	regsvr32.exe	regsvr32.exe
PID 1548 wrote to memory of 1120	1548	regsvr32.exe	regsvr32.exe
PID 1548 wrote to memory of 1120	1548	regsvr32.exe	regsvr32.exe
PID 1548 wrote to memory of 1120	1548	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\file.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dkkssbxjz /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\file.dll\"" /SC ONCE /Z /ST 03:29 /ET 03:41
4⤵
- Creates scheduled task(s)
PID:1016

C:\Windows\system32\taskeng.exe
taskeng.exe {9B783932-07AF-4405-B602-1A415D23FFB0} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\file.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\file.dll"
3⤵
- Loads dropped DLL
PID:1120

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\file.dll
MD5
0e8184620ee1611d07c2be019e57f9b3

SHA1
35cd0be4c9b77005d293d4d6b9c5cdc91c23774d

SHA256
13da1a4e45bc68663d301dc856846b33df32874e2f9fd192eb23dad4acb96715

SHA512
f497c572199b788ea6cc549c8acf9a3c39752ffbeb7eb2bc698f66d04796765b113ebbefe1a225b3d248d2d2374865fd5214c94d8f0692b707db98a86fa2f57f

Download Submit
\Users\Admin\AppData\Local\Temp\file.dll
MD5
0e8184620ee1611d07c2be019e57f9b3

SHA1
35cd0be4c9b77005d293d4d6b9c5cdc91c23774d

SHA256
13da1a4e45bc68663d301dc856846b33df32874e2f9fd192eb23dad4acb96715

SHA512
f497c572199b788ea6cc549c8acf9a3c39752ffbeb7eb2bc698f66d04796765b113ebbefe1a225b3d248d2d2374865fd5214c94d8f0692b707db98a86fa2f57f

Download Submit
memory/1016-69-0x0000000000000000-mapping.dmp

Download
memory/1120-73-0x0000000000000000-mapping.dmp

Download
memory/1268-61-0x0000000000000000-mapping.dmp

Download
memory/1268-62-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download
memory/1268-64-0x0000000010000000-0x0000000010067000-memory.dmp

Filesize
412KB

Download
memory/1268-63-0x0000000000940000-0x00000000009C0000-memory.dmp

Filesize
512KB

Download
memory/1548-70-0x0000000000000000-mapping.dmp

Download
memory/1756-68-0x0000000000080000-0x00000000000B5000-memory.dmp

Filesize
212KB

Download
memory/1756-67-0x0000000074171000-0x0000000074173000-memory.dmp

Filesize
8KB

Download
memory/1756-65-0x0000000000000000-mapping.dmp

Download
memory/1948-60-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads