qakbot | 30c2b92139a3a1241ba843b4124050883eee5633811cd79af428b3569400f8e5

General

Target

44368.5879607639.dat.dll
Size

733KB
MD5

5423261939d21619fa15f6e21368feda
SHA1

09c642c450df41aba28c61b895b8b037223ae70a
SHA256

30c2b92139a3a1241ba843b4124050883eee5633811cd79af428b3569400f8e5
SHA512

2faef188a814a3a770990862c1c8ffe382f64f827a27fd9a4017a20f81c6416697acd212982d2c2f7d2a118508b94a2f34fbd4b5eab698f1b3c869c61f7cf76a

Score

10^/10

qakbot obama61 1623917498 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.115

Botnet

obama61

Campaign

1623917498

C2

86.220.60.247:2222

24.179.77.236:443

68.186.192.69:443

197.45.110.165:995

96.253.46.210:443

186.144.33.73:443

175.136.38.142:443

47.22.148.6:443

76.25.142.196:443

45.32.211.207:443

207.246.116.237:8443

45.77.115.208:443

45.77.115.208:995

149.28.101.90:2222

207.246.116.237:443

144.202.38.185:2222

149.28.101.90:995

207.246.77.75:443

207.246.77.75:995

207.246.77.75:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

672 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

776 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1040 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1040 rundll32.exe

pid	process
672	regsvr32.exe

pid	process
776	schtasks.exe

pid	process
1040	rundll32.exe

pid	process
1040	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1304 wrote to memory of 1040	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1040	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1040	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1040	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1040	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1040	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1040	1304	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 1628	1040	rundll32.exe	explorer.exe
PID 1040 wrote to memory of 1628	1040	rundll32.exe	explorer.exe
PID 1040 wrote to memory of 1628	1040	rundll32.exe	explorer.exe
PID 1040 wrote to memory of 1628	1040	rundll32.exe	explorer.exe
PID 1040 wrote to memory of 1628	1040	rundll32.exe	explorer.exe
PID 1040 wrote to memory of 1628	1040	rundll32.exe	explorer.exe
PID 1628 wrote to memory of 776	1628	explorer.exe	schtasks.exe
PID 1628 wrote to memory of 776	1628	explorer.exe	schtasks.exe
PID 1628 wrote to memory of 776	1628	explorer.exe	schtasks.exe
PID 1628 wrote to memory of 776	1628	explorer.exe	schtasks.exe
PID 1840 wrote to memory of 860	1840	taskeng.exe	regsvr32.exe
PID 1840 wrote to memory of 860	1840	taskeng.exe	regsvr32.exe
PID 1840 wrote to memory of 860	1840	taskeng.exe	regsvr32.exe
PID 1840 wrote to memory of 860	1840	taskeng.exe	regsvr32.exe
PID 1840 wrote to memory of 860	1840	taskeng.exe	regsvr32.exe
PID 860 wrote to memory of 672	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 672	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 672	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 672	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 672	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 672	860	regsvr32.exe	regsvr32.exe
PID 860 wrote to memory of 672	860	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44368.5879607639.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44368.5879607639.dat.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pcvxvaty /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44368.5879607639.dat.dll\"" /SC ONCE /Z /ST 12:54 /ET 13:06
4⤵
- Creates scheduled task(s)
PID:776

C:\Windows\system32\taskeng.exe
taskeng.exe {C420373F-D40C-468A-BD6C-D92A7602A7B0} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44368.5879607639.dat.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\44368.5879607639.dat.dll"
3⤵
- Loads dropped DLL
PID:672

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44368.5879607639.dat.dll
MD5
cd2de7e42eca61bf0971244dca22e495

SHA1
cded30f1ad9136b027f765e70fb4d3e385ed8383

SHA256
1983861d6d930b5309ec769831d65e97af845eb31679b6381e132f2238928a5c

SHA512
5cb12fd05b60863670d44a70419344cb43bfd9f2c0d543291bae9ef8dffcd9d3a80b05af1a84ea6ffe087fc8a8c5de041a962956da5efcf8b5d68546e689117a

Download Submit
\Users\Admin\AppData\Local\Temp\44368.5879607639.dat.dll
MD5
cd2de7e42eca61bf0971244dca22e495

SHA1
cded30f1ad9136b027f765e70fb4d3e385ed8383

SHA256
1983861d6d930b5309ec769831d65e97af845eb31679b6381e132f2238928a5c

SHA512
5cb12fd05b60863670d44a70419344cb43bfd9f2c0d543291bae9ef8dffcd9d3a80b05af1a84ea6ffe087fc8a8c5de041a962956da5efcf8b5d68546e689117a

Download Submit
memory/672-73-0x0000000000000000-mapping.dmp

Download
memory/776-68-0x0000000000000000-mapping.dmp

Download
memory/860-71-0x000007FEFBF11000-0x000007FEFBF13000-memory.dmp

Filesize
8KB

Download
memory/860-70-0x0000000000000000-mapping.dmp

Download
memory/1040-63-0x0000000074D70000-0x0000000074E3D000-memory.dmp

Filesize
820KB

Download
memory/1040-64-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1040-60-0x0000000000000000-mapping.dmp

Download
memory/1040-62-0x0000000074D70000-0x0000000074D9F000-memory.dmp

Filesize
188KB

Download
memory/1040-61-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/1628-67-0x0000000074B01000-0x0000000074B03000-memory.dmp

Filesize
8KB

Download
memory/1628-69-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1628-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads