qakbot | 04001f09049769ea95f90499e62fd3d97414c6192b061a1222636b8f6b2fb2dc

General

Target

qkbot.dll
Size

786KB
MD5

2288ee8409d5e60010b03997cbabbe4e
SHA1

2159c11b47bf8ca7bb9cc9bb46ef0a28328525e8
SHA256

04001f09049769ea95f90499e62fd3d97414c6192b061a1222636b8f6b2fb2dc
SHA512

59607283854bc221e12ca20cacfe23e34292f00e7854e78171ed34562152172b851b634cce73d237f7a052669bba48a05bae38d50e28ad74b3c43543519eb5ac

Score

10^/10

qakbot obama10 1615286191 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

obama10

Campaign

1615286191

C2

76.94.200.148:995

140.82.49.12:443

24.95.61.62:443

195.43.173.70:443

197.45.110.165:995

87.202.87.210:2222

79.115.174.55:443

196.151.252.84:443

45.118.216.157:443

77.211.30.202:995

89.3.198.238:443

47.196.192.184:443

86.175.79.249:443

80.227.5.69:443

70.168.130.172:995

83.110.108.38:2222

71.117.132.169:443

184.189.122.72:443

47.22.148.6:443

84.72.35.226:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1696 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1420 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1212 rundll32.exe
1212 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1212 rundll32.exe

pid	process
1696	regsvr32.exe

pid	process
1420	schtasks.exe

pid	process
1212	rundll32.exe
1212	rundll32.exe

pid	process
1212	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1860 wrote to memory of 1212	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 1212	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 1212	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 1212	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 1212	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 1212	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 1212	1860	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1500	1212	rundll32.exe	explorer.exe
PID 1212 wrote to memory of 1500	1212	rundll32.exe	explorer.exe
PID 1212 wrote to memory of 1500	1212	rundll32.exe	explorer.exe
PID 1212 wrote to memory of 1500	1212	rundll32.exe	explorer.exe
PID 1212 wrote to memory of 1500	1212	rundll32.exe	explorer.exe
PID 1212 wrote to memory of 1500	1212	rundll32.exe	explorer.exe
PID 1500 wrote to memory of 1420	1500	explorer.exe	schtasks.exe
PID 1500 wrote to memory of 1420	1500	explorer.exe	schtasks.exe
PID 1500 wrote to memory of 1420	1500	explorer.exe	schtasks.exe
PID 1500 wrote to memory of 1420	1500	explorer.exe	schtasks.exe
PID 1384 wrote to memory of 1724	1384	taskeng.exe	regsvr32.exe
PID 1384 wrote to memory of 1724	1384	taskeng.exe	regsvr32.exe
PID 1384 wrote to memory of 1724	1384	taskeng.exe	regsvr32.exe
PID 1384 wrote to memory of 1724	1384	taskeng.exe	regsvr32.exe
PID 1384 wrote to memory of 1724	1384	taskeng.exe	regsvr32.exe
PID 1724 wrote to memory of 1696	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1696	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1696	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1696	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1696	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1696	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1696	1724	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qkbot.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qkbot.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ywtlyicc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\qkbot.dll\"" /SC ONCE /Z /ST 09:55 /ET 10:07
4⤵
- Creates scheduled task(s)
PID:1420

C:\Windows\system32\taskeng.exe
taskeng.exe {ACDE3ECB-45EF-4EF0-9DC5-9DA9018CA156} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1384

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\qkbot.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\qkbot.dll"
3⤵
- Loads dropped DLL
PID:1696

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\qkbot.dll
MD5
dafbcec2d7ea93b2145b53a8a77ccf78

SHA1
60ab69ce99567f155a88b3c39ea4543edfc666a7

SHA256
af6ddd71feec922819eca33892b256025b1c825276939c745aa0756b609ce789

SHA512
98130e01eed14f1f315ef2128f0eacdc3dff1629d58f12e584875055e8967139a9dd0d2d79dc9f4468d6fc4aad6a95431a36fbf5ae77ae08b5e18bb85707bec7

Download Submit
\Users\Admin\AppData\Local\Temp\qkbot.dll
MD5
dafbcec2d7ea93b2145b53a8a77ccf78

SHA1
60ab69ce99567f155a88b3c39ea4543edfc666a7

SHA256
af6ddd71feec922819eca33892b256025b1c825276939c745aa0756b609ce789

SHA512
98130e01eed14f1f315ef2128f0eacdc3dff1629d58f12e584875055e8967139a9dd0d2d79dc9f4468d6fc4aad6a95431a36fbf5ae77ae08b5e18bb85707bec7

Download Submit
memory/1212-61-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/1212-62-0x0000000001CF0000-0x0000000001DB8000-memory.dmp

Filesize
800KB

Download
memory/1212-63-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1212-64-0x00000000001F0000-0x0000000000270000-memory.dmp

Filesize
512KB

Download
memory/1212-65-0x0000000000580000-0x00000000005B5000-memory.dmp

Filesize
212KB

Download
memory/1212-60-0x0000000000000000-mapping.dmp

Download
memory/1420-69-0x0000000000000000-mapping.dmp

Download
memory/1500-66-0x0000000000000000-mapping.dmp

Download
memory/1500-70-0x00000000000C0000-0x00000000000F5000-memory.dmp

Filesize
212KB

Download
memory/1500-68-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download
memory/1696-74-0x0000000000000000-mapping.dmp

Download
memory/1724-71-0x0000000000000000-mapping.dmp

Download
memory/1724-72-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads