qakbot | 7ff08e2ef9bf6bdd1658fe530daa61867dc35ead4e71be3c6722f9dbe183a52e

General

Target

cd96dffd01d8c33059d6699745287a80.dll
Size

539KB
MD5

cd96dffd01d8c33059d6699745287a80
SHA1

cddd9cf1eb42c90e98f9e95e9c3160be64863708
SHA256

7ff08e2ef9bf6bdd1658fe530daa61867dc35ead4e71be3c6722f9dbe183a52e
SHA512

6c6086647a8f6ce0874266ac7dc339247d55eaac3f610fa76cc26e128db9605306e5013dd786b53ac57c021f5057aaa90729915d6ed6b6fffcf8b4407518eef6

Score

10^/10

qakbot obama102 1632302707 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.318

Botnet

obama102

Campaign

1632302707

C2

120.150.218.241:995

47.22.148.6:443

105.198.236.99:443

95.77.223.148:443

140.82.49.12:443

27.223.92.142:995

73.151.236.31:443

136.232.34.70:443

144.139.47.206:443

45.46.53.140:2222

76.25.142.196:443

173.21.10.71:2222

75.188.35.168:443

71.74.12.34:443

96.37.113.36:993

67.165.206.193:993

189.210.115.207:443

72.252.201.69:443

24.139.72.117:443

24.229.150.54:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1872 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4608 1872 WerFault.exe regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3536 schtasks.exe

pid	process
1872	regsvr32.exe

pid	pid_target	process	target process
4608	1872	WerFault.exe	regsvr32.exe

pid	process
3536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
4172	rundll32.exe
4172	rundll32.exe
4608	WerFault.exe
4608	WerFault.exe
4608	WerFault.exe
4608	WerFault.exe
4608	WerFault.exe
4608	WerFault.exe
4608	WerFault.exe
4608	WerFault.exe
4608	WerFault.exe
4608	WerFault.exe
4608	WerFault.exe
4608	WerFault.exe
4608	WerFault.exe
4608	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

4172 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4608 WerFault.exe
Token: SeBackupPrivilege 4608 WerFault.exe
Token: SeDebugPrivilege 4608 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	4608	WerFault.exe
Token: SeBackupPrivilege	4608	WerFault.exe
Token: SeDebugPrivilege	4608	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 3644 wrote to memory of 4172	3644	rundll32.exe	rundll32.exe
PID 3644 wrote to memory of 4172	3644	rundll32.exe	rundll32.exe
PID 3644 wrote to memory of 4172	3644	rundll32.exe	rundll32.exe
PID 4172 wrote to memory of 4312	4172	rundll32.exe	explorer.exe
PID 4172 wrote to memory of 4312	4172	rundll32.exe	explorer.exe
PID 4172 wrote to memory of 4312	4172	rundll32.exe	explorer.exe
PID 4172 wrote to memory of 4312	4172	rundll32.exe	explorer.exe
PID 4172 wrote to memory of 4312	4172	rundll32.exe	explorer.exe
PID 4312 wrote to memory of 3536	4312	explorer.exe	schtasks.exe
PID 4312 wrote to memory of 3536	4312	explorer.exe	schtasks.exe
PID 4312 wrote to memory of 3536	4312	explorer.exe	schtasks.exe
PID 4368 wrote to memory of 1872	4368	regsvr32.exe	regsvr32.exe
PID 4368 wrote to memory of 1872	4368	regsvr32.exe	regsvr32.exe
PID 4368 wrote to memory of 1872	4368	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd96dffd01d8c33059d6699745287a80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd96dffd01d8c33059d6699745287a80.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4172

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4312

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xgrfbsg /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\cd96dffd01d8c33059d6699745287a80.dll\"" /SC ONCE /Z /ST 06:06 /ET 06:18
4⤵
- Creates scheduled task(s)
PID:3536

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\cd96dffd01d8c33059d6699745287a80.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4368

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\cd96dffd01d8c33059d6699745287a80.dll"
2⤵
- Loads dropped DLL
PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 596
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4608

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cd96dffd01d8c33059d6699745287a80.dll
MD5
07ed2b75839132948fb62b6d9ef1f618

SHA1
beab48d6581d0a404181269de777af37ad91565e

SHA256
3cd7365d546fda2091e705b8466eaa9dae77e0aea385fe95bac6caec45988db2

SHA512
9cf42e33c8d99a3cacb0525bdc27682cdcfd3918ee35443dd8ca40c62be6a28740074007b1c773768ebe3f84372c14162be14875f4ebdaa6f31fb49fb24ca757

Download Submit
\Users\Admin\AppData\Local\Temp\cd96dffd01d8c33059d6699745287a80.dll
MD5
07ed2b75839132948fb62b6d9ef1f618

SHA1
beab48d6581d0a404181269de777af37ad91565e

SHA256
3cd7365d546fda2091e705b8466eaa9dae77e0aea385fe95bac6caec45988db2

SHA512
9cf42e33c8d99a3cacb0525bdc27682cdcfd3918ee35443dd8ca40c62be6a28740074007b1c773768ebe3f84372c14162be14875f4ebdaa6f31fb49fb24ca757

Download Submit
memory/1872-125-0x0000000000000000-mapping.dmp

Download
memory/3536-120-0x0000000000000000-mapping.dmp

Download
memory/4172-115-0x0000000000000000-mapping.dmp

Download
memory/4172-117-0x0000000073900000-0x00000000739A1000-memory.dmp

Filesize
644KB

Download
memory/4172-116-0x0000000073900000-0x0000000073921000-memory.dmp

Filesize
132KB

Download
memory/4172-118-0x0000000000540000-0x000000000068A000-memory.dmp

Filesize
1.3MB

Download
memory/4312-119-0x0000000000000000-mapping.dmp

Download
memory/4312-123-0x00000000004B0000-0x00000000004D1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads