qakbot | a395600eca0288b1a6c84746245439360e1e9a6e7277126ec0777d74dbc2222c | Triage

Analysis

max time kernel
137s
max time network
122s
platform
windows10_x64
resource
win10v20210408
submitted
24-08-2021 23:53

Sharing

Report Analysis Logs

General

Target

GGrioda.deriiiss4.dll
Size

337KB
MD5

106b4adbd60d3ed9b382941f9e16a939
SHA1

63ae1bc6e8ddc6ff3e92d8c9b8def6b120749aba
SHA256

a395600eca0288b1a6c84746245439360e1e9a6e7277126ec0777d74dbc2222c
SHA512

8efb3dee3a63891ca0c7571e9f22c2bf2735ddf8f93338877ba21c7e1abdefaa1b1bbf864b26005a98bb6743c3f0b178b61482ac6fc749937112ebe3b7d46c51

Score

10^/10

qakbot obama04 1613469138 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

obama04

Campaign

1613469138

C2

50.29.166.232:995

89.137.211.239:995

172.78.30.215:443

193.248.221.184:2222

80.227.5.69:443

216.201.162.158:443

75.67.192.125:443

105.96.8.96:443

77.211.30.202:995

136.232.34.70:443

87.202.87.210:2222

86.245.46.27:2222

90.101.117.122:2222

81.97.154.100:443

47.196.192.184:443

197.161.154.132:443

78.185.59.190:443

202.188.138.162:443

77.27.204.204:995

203.194.110.74:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1308 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2060 1308 WerFault.exe regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2960 schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

regsvr32.exeWerFault.exe

pid	process
2148	regsvr32.exe
2148	regsvr32.exe
2148	regsvr32.exe
2148	regsvr32.exe
2060	WerFault.exe
2060	WerFault.exe
2060	WerFault.exe
2060	WerFault.exe
2060	WerFault.exe
2060	WerFault.exe
2060	WerFault.exe
2060	WerFault.exe
2060	WerFault.exe
2060	WerFault.exe
2060	WerFault.exe
2060	WerFault.exe
2060	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

2148 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2060 WerFault.exe
Token: SeBackupPrivilege 2060 WerFault.exe
Token: SeDebugPrivilege 2060 WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 740 wrote to memory of 2148	740	regsvr32.exe	regsvr32.exe
PID 740 wrote to memory of 2148	740	regsvr32.exe	regsvr32.exe
PID 740 wrote to memory of 2148	740	regsvr32.exe	regsvr32.exe
PID 2148 wrote to memory of 576	2148	regsvr32.exe	explorer.exe
PID 2148 wrote to memory of 576	2148	regsvr32.exe	explorer.exe
PID 2148 wrote to memory of 576	2148	regsvr32.exe	explorer.exe
PID 2148 wrote to memory of 576	2148	regsvr32.exe	explorer.exe
PID 2148 wrote to memory of 576	2148	regsvr32.exe	explorer.exe
PID 576 wrote to memory of 2960	576	explorer.exe	schtasks.exe
PID 576 wrote to memory of 2960	576	explorer.exe	schtasks.exe
PID 576 wrote to memory of 2960	576	explorer.exe	schtasks.exe
PID 3700 wrote to memory of 1308	3700	regsvr32.exe	regsvr32.exe
PID 3700 wrote to memory of 1308	3700	regsvr32.exe	regsvr32.exe
PID 3700 wrote to memory of 1308	3700	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\GGrioda.deriiiss4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\GGrioda.deriiiss4.dll
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2148

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hbkuish /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\GGrioda.deriiiss4.dll\"" /SC ONCE /Z /ST 01:59 /ET 02:11
4⤵
- Creates scheduled task(s)
PID:2960

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\GGrioda.deriiiss4.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3700

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\GGrioda.deriiiss4.dll"
2⤵
- Loads dropped DLL
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 604
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2060

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GGrioda.deriiiss4.dll
MD5
a19607fa114b548e0833966b33874de8

SHA1
2010db35e8a3d08097b82fecab10adf909b62136

SHA256
8357b565067c903199c8dbb75d3785463b141536b169b1cc3280b25b7322f70f

SHA512
52cdf5bdbb0e731a5d2340aacac9b1704c539823a3f2f7f612583f55abe01fd9404aabe4597feded4b76b5a5d49e36b064632daef2bc2c72217f3cd247a34cb1

Download Submit
\Users\Admin\AppData\Local\Temp\GGrioda.deriiiss4.dll
MD5
a19607fa114b548e0833966b33874de8

SHA1
2010db35e8a3d08097b82fecab10adf909b62136

SHA256
8357b565067c903199c8dbb75d3785463b141536b169b1cc3280b25b7322f70f

SHA512
52cdf5bdbb0e731a5d2340aacac9b1704c539823a3f2f7f612583f55abe01fd9404aabe4597feded4b76b5a5d49e36b064632daef2bc2c72217f3cd247a34cb1

Download Submit
memory/576-117-0x0000000000000000-mapping.dmp

Download
memory/576-121-0x0000000002F80000-0x0000000002FB5000-memory.dmp

Filesize
212KB

Download
memory/1308-123-0x0000000000000000-mapping.dmp

Download
memory/2148-114-0x0000000000000000-mapping.dmp

Download
memory/2148-115-0x0000000004660000-0x0000000004683000-memory.dmp

Filesize
140KB

Download
memory/2148-116-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/2960-118-0x0000000000000000-mapping.dmp

Download