qakbot | 0abfa464ee913e7d5bda6cc61993aa3e600652b70ab2488481ff48b61bd983a9

General

Target

0abfa464ee913e7d5bda6cc61993aa3e600652b70ab2488481ff48b61bd983a9.dll
Size

1021KB
MD5

2b1da17555d7ca769b77f45c8636af6d
SHA1

c7fb8ba77b3ed74d3551e6e811d3df63e0da5df9
SHA256

0abfa464ee913e7d5bda6cc61993aa3e600652b70ab2488481ff48b61bd983a9
SHA512

403f033da3f938a3df6ebc3f9292935b6fff1dc086bbf9535b4e928586b713d4fd6a47bbcf0cfd58e37a6cb4b0baa998e8f24078c6979032eefce70d5d4467dc

Score

10^/10

qakbot obama35 1619617557 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.12

Botnet

obama35

Campaign

1619617557

C2

24.117.107.120:443

75.137.47.174:443

105.198.236.101:443

81.97.154.100:443

216.201.162.158:443

71.187.170.235:443

47.196.192.184:443

136.232.34.70:443

47.22.148.6:443

75.67.192.125:443

24.229.150.54:995

172.78.40.61:443

144.139.47.206:443

71.163.222.243:443

45.63.107.192:995

24.226.156.153:443

190.85.91.154:443

71.41.184.10:3389

140.82.49.12:443

73.25.124.140:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

292 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1812 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1084 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1084 rundll32.exe

pid	process
292	regsvr32.exe

pid	process
1812	schtasks.exe

pid	process
1084	rundll32.exe

pid	process
1084	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1996 wrote to memory of 1084	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1084	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1084	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1084	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1084	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1084	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1084	1996	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 1680	1084	rundll32.exe	explorer.exe
PID 1084 wrote to memory of 1680	1084	rundll32.exe	explorer.exe
PID 1084 wrote to memory of 1680	1084	rundll32.exe	explorer.exe
PID 1084 wrote to memory of 1680	1084	rundll32.exe	explorer.exe
PID 1084 wrote to memory of 1680	1084	rundll32.exe	explorer.exe
PID 1084 wrote to memory of 1680	1084	rundll32.exe	explorer.exe
PID 1680 wrote to memory of 1812	1680	explorer.exe	schtasks.exe
PID 1680 wrote to memory of 1812	1680	explorer.exe	schtasks.exe
PID 1680 wrote to memory of 1812	1680	explorer.exe	schtasks.exe
PID 1680 wrote to memory of 1812	1680	explorer.exe	schtasks.exe
PID 1944 wrote to memory of 268	1944	taskeng.exe	regsvr32.exe
PID 1944 wrote to memory of 268	1944	taskeng.exe	regsvr32.exe
PID 1944 wrote to memory of 268	1944	taskeng.exe	regsvr32.exe
PID 1944 wrote to memory of 268	1944	taskeng.exe	regsvr32.exe
PID 1944 wrote to memory of 268	1944	taskeng.exe	regsvr32.exe
PID 268 wrote to memory of 292	268	regsvr32.exe	regsvr32.exe
PID 268 wrote to memory of 292	268	regsvr32.exe	regsvr32.exe
PID 268 wrote to memory of 292	268	regsvr32.exe	regsvr32.exe
PID 268 wrote to memory of 292	268	regsvr32.exe	regsvr32.exe
PID 268 wrote to memory of 292	268	regsvr32.exe	regsvr32.exe
PID 268 wrote to memory of 292	268	regsvr32.exe	regsvr32.exe
PID 268 wrote to memory of 292	268	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0abfa464ee913e7d5bda6cc61993aa3e600652b70ab2488481ff48b61bd983a9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0abfa464ee913e7d5bda6cc61993aa3e600652b70ab2488481ff48b61bd983a9.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hbchvlfogn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\0abfa464ee913e7d5bda6cc61993aa3e600652b70ab2488481ff48b61bd983a9.dll\"" /SC ONCE /Z /ST 13:24 /ET 13:36
4⤵
- Creates scheduled task(s)
PID:1812

C:\Windows\system32\taskeng.exe
taskeng.exe {0733B1B9-1CF9-4276-9F1A-FCBEE7BA63B1} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\0abfa464ee913e7d5bda6cc61993aa3e600652b70ab2488481ff48b61bd983a9.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\0abfa464ee913e7d5bda6cc61993aa3e600652b70ab2488481ff48b61bd983a9.dll"
3⤵
- Loads dropped DLL
PID:292

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0abfa464ee913e7d5bda6cc61993aa3e600652b70ab2488481ff48b61bd983a9.dll
MD5
0165cffefa53e2b0b1843994bd98a518

SHA1
d453d0b068172185934bfb50df5bd275a2e389e4

SHA256
fe56b20caa0c9a48284e9e5d367e7395808a77abdf3c45772bacf54fade12ae2

SHA512
c942166dd24d5536ec89baa522931eb0fc34a21dc02c569dbae9edfbc5ff0e9c8a337b7cce279c54c637b508b047f9bfee7de8347bc443df407317a6b38ff866

Download Submit
\Users\Admin\AppData\Local\Temp\0abfa464ee913e7d5bda6cc61993aa3e600652b70ab2488481ff48b61bd983a9.dll
MD5
0165cffefa53e2b0b1843994bd98a518

SHA1
d453d0b068172185934bfb50df5bd275a2e389e4

SHA256
fe56b20caa0c9a48284e9e5d367e7395808a77abdf3c45772bacf54fade12ae2

SHA512
c942166dd24d5536ec89baa522931eb0fc34a21dc02c569dbae9edfbc5ff0e9c8a337b7cce279c54c637b508b047f9bfee7de8347bc443df407317a6b38ff866

Download Submit
memory/268-68-0x0000000000000000-mapping.dmp

Download
memory/268-69-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/292-71-0x0000000000000000-mapping.dmp

Download
memory/1084-61-0x0000000000240000-0x0000000000282000-memory.dmp

Filesize
264KB

Download
memory/1084-59-0x0000000000000000-mapping.dmp

Download
memory/1084-62-0x00000000002E0000-0x0000000000319000-memory.dmp

Filesize
228KB

Download
memory/1084-60-0x0000000075D41000-0x0000000075D43000-memory.dmp

Filesize
8KB

Download
memory/1680-66-0x00000000000F0000-0x0000000000129000-memory.dmp

Filesize
228KB

Download
memory/1680-65-0x0000000074421000-0x0000000074423000-memory.dmp

Filesize
8KB

Download
memory/1680-63-0x0000000000000000-mapping.dmp

Download
memory/1812-67-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads