qakbot | 67f8ab4fcab8bd281abc47d294fae4800de19a0a53de3479dccd3f6b218165ae

General

Target

44363.6598177083.dat =^_^=.dll
Size

1.2MB
MD5

b28fb4729ff13c7d5915ecf4b394ba5b
SHA1

a09ab2f16838d6690526937d0ede4c00b6da562c
SHA256

67f8ab4fcab8bd281abc47d294fae4800de19a0a53de3479dccd3f6b218165ae
SHA512

50780715b88a96706bdd9db2caecbf24df4ff9d2541714ad68fab1a540196426563246c42330c7e57a346939c74bd8160b04c2c1ea318b55dd8a0b8fc8b4be3f

Score

10^/10

qakbot obama60 1623855376 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.115

Botnet

obama60

Campaign

1623855376

C2

96.253.46.210:443

189.210.115.207:443

186.144.33.73:443

213.122.113.120:443

47.22.148.6:443

72.252.201.69:443

45.77.117.108:995

45.32.211.207:443

207.246.116.237:8443

45.77.115.208:443

45.77.115.208:995

149.28.101.90:2222

207.246.116.237:443

105.198.236.101:443

144.202.38.185:2222

149.28.101.90:995

207.246.77.75:443

207.246.77.75:995

207.246.77.75:2222

45.77.117.108:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1208 836 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exeWerFault.exe

pid process

836 rundll32.exe
1208 WerFault.exe
1208 WerFault.exe
1208 WerFault.exe
1208 WerFault.exe
1208 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1208 WerFault.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

836 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1208 WerFault.exe

pid	pid_target	process	target process
1208	836	WerFault.exe	rundll32.exe

pid	process
836	rundll32.exe
1208	WerFault.exe
1208	WerFault.exe
1208	WerFault.exe
1208	WerFault.exe
1208	WerFault.exe

pid	process
1208	WerFault.exe

pid	process
836	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1208	WerFault.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1824 wrote to memory of 836	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 836	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 836	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 836	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 836	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 836	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 836	1824	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 1460	836	rundll32.exe	explorer.exe
PID 836 wrote to memory of 1460	836	rundll32.exe	explorer.exe
PID 836 wrote to memory of 1460	836	rundll32.exe	explorer.exe
PID 836 wrote to memory of 1460	836	rundll32.exe	explorer.exe
PID 836 wrote to memory of 1460	836	rundll32.exe	explorer.exe
PID 836 wrote to memory of 1460	836	rundll32.exe	explorer.exe
PID 836 wrote to memory of 1208	836	rundll32.exe	WerFault.exe
PID 836 wrote to memory of 1208	836	rundll32.exe	WerFault.exe
PID 836 wrote to memory of 1208	836	rundll32.exe	WerFault.exe
PID 836 wrote to memory of 1208	836	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\44363.6598177083.dat =^_^=.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\44363.6598177083.dat =^_^=.dll",#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 280
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1208

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-60-0x0000000000000000-mapping.dmp

Download
memory/836-61-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/836-62-0x00000000743C0000-0x00000000743EF000-memory.dmp

Filesize
188KB

Download
memory/836-63-0x00000000743C0000-0x00000000744FC000-memory.dmp

Filesize
1.2MB

Download
memory/836-64-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/1208-68-0x0000000000000000-mapping.dmp

Download
memory/1208-70-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/1460-65-0x0000000000000000-mapping.dmp

Download
memory/1460-67-0x0000000074191000-0x0000000074193000-memory.dmp

Filesize
8KB

Download
memory/1460-69-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing