qakbot | 153862cb79a2312f54a2307460872006138a649cdac6525df1d04c093c8b1454

General

Target

44459.6948533565.dat.dll
Size

823KB
MD5

5f8b22e659bfc7db9a7043a828da7675
SHA1

91a30a2b1b936ab508b37a713ae35358b3c24150
SHA256

153862cb79a2312f54a2307460872006138a649cdac6525df1d04c093c8b1454
SHA512

edcfbee0f7dbac6050a01703cd96d4bf130568c90a71290eccfb9aae6671274db95f60e1be8df7c51e1e58bc7ee22cc67ac63ffd56f0db8fd7a84d92f83cd3d9

Score

10^/10

qakbot obama100 1632151873 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.318

Botnet

obama100

Campaign

1632151873

C2

45.46.53.140:2222

144.139.47.206:443

189.210.115.207:443

120.150.218.241:995

47.22.148.6:443

140.82.49.12:443

24.139.72.117:443

24.229.150.54:995

24.55.112.61:443

136.232.34.70:443

95.77.223.148:443

173.21.10.71:2222

76.25.142.196:443

96.37.113.36:993

71.74.12.34:443

73.151.236.31:443

67.165.206.193:993

109.12.111.14:443

68.204.7.158:443

105.198.236.99:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1516 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

876 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1380 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1380 rundll32.exe

pid	process
1516	regsvr32.exe

pid	process
876	schtasks.exe

pid	process
1380	rundll32.exe

pid	process
1380	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1652 wrote to memory of 1380	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1380	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1380	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1380	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1380	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1380	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1380	1652	rundll32.exe	rundll32.exe
PID 1380 wrote to memory of 804	1380	rundll32.exe	explorer.exe
PID 1380 wrote to memory of 804	1380	rundll32.exe	explorer.exe
PID 1380 wrote to memory of 804	1380	rundll32.exe	explorer.exe
PID 1380 wrote to memory of 804	1380	rundll32.exe	explorer.exe
PID 1380 wrote to memory of 804	1380	rundll32.exe	explorer.exe
PID 1380 wrote to memory of 804	1380	rundll32.exe	explorer.exe
PID 804 wrote to memory of 876	804	explorer.exe	schtasks.exe
PID 804 wrote to memory of 876	804	explorer.exe	schtasks.exe
PID 804 wrote to memory of 876	804	explorer.exe	schtasks.exe
PID 804 wrote to memory of 876	804	explorer.exe	schtasks.exe
PID 1536 wrote to memory of 1876	1536	taskeng.exe	regsvr32.exe
PID 1536 wrote to memory of 1876	1536	taskeng.exe	regsvr32.exe
PID 1536 wrote to memory of 1876	1536	taskeng.exe	regsvr32.exe
PID 1536 wrote to memory of 1876	1536	taskeng.exe	regsvr32.exe
PID 1536 wrote to memory of 1876	1536	taskeng.exe	regsvr32.exe
PID 1876 wrote to memory of 1516	1876	regsvr32.exe	regsvr32.exe
PID 1876 wrote to memory of 1516	1876	regsvr32.exe	regsvr32.exe
PID 1876 wrote to memory of 1516	1876	regsvr32.exe	regsvr32.exe
PID 1876 wrote to memory of 1516	1876	regsvr32.exe	regsvr32.exe
PID 1876 wrote to memory of 1516	1876	regsvr32.exe	regsvr32.exe
PID 1876 wrote to memory of 1516	1876	regsvr32.exe	regsvr32.exe
PID 1876 wrote to memory of 1516	1876	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44459.6948533565.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44459.6948533565.dat.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:804
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn exynqad /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44459.6948533565.dat.dll\"" /SC ONCE /Z /ST 16:51 /ET 17:03
      4⤵
      Creates scheduled task(s)
      PID:876

C:\Windows\system32\taskeng.exe
taskeng.exe {C6F93998-9B5A-4253-B4D9-56C293F2A84A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44459.6948533565.dat.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\44459.6948533565.dat.dll"
    3⤵
    - Loads dropped DLL
    PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44459.6948533565.dat.dll

MD5
3a29673fa921b807c383314cbc259a63

SHA1
006200be88174b2e0ca6e0f2362f1602c6f71f27

SHA256
0bb98276d290965632a41c6b05dd0a09f983ec315f2022196137fdd5879a25ed

SHA512
4171aa97d65cac7db15caa1beeee81599105fd7383f506a8f23594cf8528cff5d1e6b19d362a4cba8efc90d1c716e671331c359b5c252534eced29f30b33cfa4

Download Submit
\Users\Admin\AppData\Local\Temp\44459.6948533565.dat.dll

MD5
3a29673fa921b807c383314cbc259a63

SHA1
006200be88174b2e0ca6e0f2362f1602c6f71f27

SHA256
0bb98276d290965632a41c6b05dd0a09f983ec315f2022196137fdd5879a25ed

SHA512
4171aa97d65cac7db15caa1beeee81599105fd7383f506a8f23594cf8528cff5d1e6b19d362a4cba8efc90d1c716e671331c359b5c252534eced29f30b33cfa4

Download Submit
memory/804-61-0x0000000074351000-0x0000000074353000-memory.dmp

Filesize
8KB

Download
memory/804-63-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/804-59-0x0000000000000000-mapping.dmp

Download
memory/876-62-0x0000000000000000-mapping.dmp

Download
memory/1380-56-0x00000000745B0000-0x00000000745D1000-memory.dmp

Filesize
132KB

Download
memory/1380-58-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/1380-54-0x0000000000000000-mapping.dmp

Download
memory/1380-57-0x00000000745B0000-0x000000007469A000-memory.dmp

Filesize
936KB

Download
memory/1380-55-0x0000000074C71000-0x0000000074C73000-memory.dmp

Filesize
8KB

Download
memory/1516-67-0x0000000000000000-mapping.dmp

Download
memory/1876-64-0x0000000000000000-mapping.dmp

Download
memory/1876-65-0x000007FEFB781000-0x000007FEFB783000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads