qakbot | dbbf53b95b91d68e321e5551c8a88ef3230ca525a4de1aa5e8219d4d71212f76

General

Target

1ae49fdec64e56bfb02251a971841f9d.dll
Size

823KB
MD5

1ae49fdec64e56bfb02251a971841f9d
SHA1

041d72e8e42d4983b2aa91bdf1e8ec0ec8bd7642
SHA256

dbbf53b95b91d68e321e5551c8a88ef3230ca525a4de1aa5e8219d4d71212f76
SHA512

3e9cbf7949606e21519697401169b7858e3231710c1c0a4db2bd166e0507fefed0a14bac95f4ad1eb9b33b82fed4591e54769c8f99c8e1354d32f9269cbba6c3

Score

10^/10

qakbot obama100 1632151873 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.318

Botnet

obama100

Campaign

1632151873

C2

45.46.53.140:2222

144.139.47.206:443

189.210.115.207:443

120.150.218.241:995

47.22.148.6:443

140.82.49.12:443

24.139.72.117:443

24.229.150.54:995

24.55.112.61:443

136.232.34.70:443

95.77.223.148:443

173.21.10.71:2222

76.25.142.196:443

96.37.113.36:993

71.74.12.34:443

73.151.236.31:443

67.165.206.193:993

109.12.111.14:443

68.204.7.158:443

105.198.236.99:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4044 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1132 4044 WerFault.exe regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2792 schtasks.exe

pid	process
4044	regsvr32.exe

pid	pid_target	process	target process
1132	4044	WerFault.exe	regsvr32.exe

pid	process
2792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
1608	rundll32.exe
1608	rundll32.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1608 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1132 WerFault.exe
Token: SeBackupPrivilege 1132 WerFault.exe
Token: SeDebugPrivilege 1132 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	1132	WerFault.exe
Token: SeBackupPrivilege	1132	WerFault.exe
Token: SeDebugPrivilege	1132	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 1892 wrote to memory of 1608	1892	rundll32.exe	rundll32.exe
PID 1892 wrote to memory of 1608	1892	rundll32.exe	rundll32.exe
PID 1892 wrote to memory of 1608	1892	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 2568	1608	rundll32.exe	explorer.exe
PID 1608 wrote to memory of 2568	1608	rundll32.exe	explorer.exe
PID 1608 wrote to memory of 2568	1608	rundll32.exe	explorer.exe
PID 1608 wrote to memory of 2568	1608	rundll32.exe	explorer.exe
PID 1608 wrote to memory of 2568	1608	rundll32.exe	explorer.exe
PID 2568 wrote to memory of 2792	2568	explorer.exe	schtasks.exe
PID 2568 wrote to memory of 2792	2568	explorer.exe	schtasks.exe
PID 2568 wrote to memory of 2792	2568	explorer.exe	schtasks.exe
PID 3008 wrote to memory of 4044	3008	regsvr32.exe	regsvr32.exe
PID 3008 wrote to memory of 4044	3008	regsvr32.exe	regsvr32.exe
PID 3008 wrote to memory of 4044	3008	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ae49fdec64e56bfb02251a971841f9d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ae49fdec64e56bfb02251a971841f9d.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2568

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dfmhavflv /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\1ae49fdec64e56bfb02251a971841f9d.dll\"" /SC ONCE /Z /ST 21:23 /ET 21:35
4⤵
- Creates scheduled task(s)
PID:2792

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\1ae49fdec64e56bfb02251a971841f9d.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\1ae49fdec64e56bfb02251a971841f9d.dll"
2⤵
- Loads dropped DLL
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 596
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1132

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1ae49fdec64e56bfb02251a971841f9d.dll
MD5
ff40668d8f47c84f17cacf8efbda612f

SHA1
d2b323f1a80815c32f6eb97e28b01998df87e63d

SHA256
96e99254d6f41591591a9e6bda99be12ec01cb3f00daf1954214959c2702e8d2

SHA512
7cf4c0062e04b979228981162284fba7dafbccbc9fd4452ac7d9d1926edf3fa27d722d52ea8ca641c681bcb73c20a7816470a84966f6b59bd4dbfd521c89048c

Download Submit
\Users\Admin\AppData\Local\Temp\1ae49fdec64e56bfb02251a971841f9d.dll
MD5
ff40668d8f47c84f17cacf8efbda612f

SHA1
d2b323f1a80815c32f6eb97e28b01998df87e63d

SHA256
96e99254d6f41591591a9e6bda99be12ec01cb3f00daf1954214959c2702e8d2

SHA512
7cf4c0062e04b979228981162284fba7dafbccbc9fd4452ac7d9d1926edf3fa27d722d52ea8ca641c681bcb73c20a7816470a84966f6b59bd4dbfd521c89048c

Download Submit
memory/1608-115-0x0000000000000000-mapping.dmp

Download
memory/1608-116-0x0000000074420000-0x0000000074441000-memory.dmp

Filesize
132KB

Download
memory/1608-117-0x0000000074420000-0x000000007450A000-memory.dmp

Filesize
936KB

Download
memory/1608-118-0x0000000002F40000-0x0000000002FEE000-memory.dmp

Filesize
696KB

Download
memory/2568-119-0x0000000000000000-mapping.dmp

Download
memory/2568-123-0x0000000000D50000-0x0000000000D71000-memory.dmp

Filesize
132KB

Download
memory/2792-120-0x0000000000000000-mapping.dmp

Download
memory/4044-125-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads