qakbot | 5ac3a36dbb4c23e0a8b04f9d8563c2309d74f9ad9dbfdebac7929ef8552afc0a

General

Target

66e391d04bc0ab2a5e06895a2df14b56.dll
Size

823KB
MD5

66e391d04bc0ab2a5e06895a2df14b56
SHA1

74a683c444719e3d9bbfd9ad1274648acf296cb5
SHA256

5ac3a36dbb4c23e0a8b04f9d8563c2309d74f9ad9dbfdebac7929ef8552afc0a
SHA512

bf48d747221fbb1325477fae499caa5320970c16bf5e3476fce189f4e77fdfe7d6b1f37dea4eb8ac23d9582802db06262c9fab6352c0c4f0697ecc220034dbfe

Score

10^/10

qakbot obama100 1632151873 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.318

Botnet

obama100

Campaign

1632151873

C2

45.46.53.140:2222

144.139.47.206:443

189.210.115.207:443

120.150.218.241:995

47.22.148.6:443

140.82.49.12:443

24.139.72.117:443

24.229.150.54:995

24.55.112.61:443

136.232.34.70:443

95.77.223.148:443

173.21.10.71:2222

76.25.142.196:443

96.37.113.36:993

71.74.12.34:443

73.151.236.31:443

67.165.206.193:993

109.12.111.14:443

68.204.7.158:443

105.198.236.99:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1828 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1500 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

268 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

268 rundll32.exe

pid	process
1828	regsvr32.exe

pid	process
1500	schtasks.exe

pid	process
268	rundll32.exe

pid	process
268	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 652 wrote to memory of 268	652	rundll32.exe	rundll32.exe
PID 652 wrote to memory of 268	652	rundll32.exe	rundll32.exe
PID 652 wrote to memory of 268	652	rundll32.exe	rundll32.exe
PID 652 wrote to memory of 268	652	rundll32.exe	rundll32.exe
PID 652 wrote to memory of 268	652	rundll32.exe	rundll32.exe
PID 652 wrote to memory of 268	652	rundll32.exe	rundll32.exe
PID 652 wrote to memory of 268	652	rundll32.exe	rundll32.exe
PID 268 wrote to memory of 1316	268	rundll32.exe	explorer.exe
PID 268 wrote to memory of 1316	268	rundll32.exe	explorer.exe
PID 268 wrote to memory of 1316	268	rundll32.exe	explorer.exe
PID 268 wrote to memory of 1316	268	rundll32.exe	explorer.exe
PID 268 wrote to memory of 1316	268	rundll32.exe	explorer.exe
PID 268 wrote to memory of 1316	268	rundll32.exe	explorer.exe
PID 1316 wrote to memory of 1500	1316	explorer.exe	schtasks.exe
PID 1316 wrote to memory of 1500	1316	explorer.exe	schtasks.exe
PID 1316 wrote to memory of 1500	1316	explorer.exe	schtasks.exe
PID 1316 wrote to memory of 1500	1316	explorer.exe	schtasks.exe
PID 316 wrote to memory of 744	316	taskeng.exe	regsvr32.exe
PID 316 wrote to memory of 744	316	taskeng.exe	regsvr32.exe
PID 316 wrote to memory of 744	316	taskeng.exe	regsvr32.exe
PID 316 wrote to memory of 744	316	taskeng.exe	regsvr32.exe
PID 316 wrote to memory of 744	316	taskeng.exe	regsvr32.exe
PID 744 wrote to memory of 1828	744	regsvr32.exe	regsvr32.exe
PID 744 wrote to memory of 1828	744	regsvr32.exe	regsvr32.exe
PID 744 wrote to memory of 1828	744	regsvr32.exe	regsvr32.exe
PID 744 wrote to memory of 1828	744	regsvr32.exe	regsvr32.exe
PID 744 wrote to memory of 1828	744	regsvr32.exe	regsvr32.exe
PID 744 wrote to memory of 1828	744	regsvr32.exe	regsvr32.exe
PID 744 wrote to memory of 1828	744	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66e391d04bc0ab2a5e06895a2df14b56.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66e391d04bc0ab2a5e06895a2df14b56.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dnyspvdh /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\66e391d04bc0ab2a5e06895a2df14b56.dll\"" /SC ONCE /Z /ST 08:49 /ET 09:01
4⤵
- Creates scheduled task(s)
PID:1500

C:\Windows\system32\taskeng.exe
taskeng.exe {5A4353D6-3C8C-48D6-A3B4-F90EB88B412C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\66e391d04bc0ab2a5e06895a2df14b56.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\66e391d04bc0ab2a5e06895a2df14b56.dll"
3⤵
- Loads dropped DLL
PID:1828

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\66e391d04bc0ab2a5e06895a2df14b56.dll
MD5
387e8337881f7a0358d993a0441eefeb

SHA1
c994efea3ca2b6e68fce6540d3ace32833e4016f

SHA256
727159a69708609e19a5850eef39a379ae145cbf7da57d96ef631499b44c4820

SHA512
1b214e8ca00819dd0e97345414cd093877c1adee87dc87f4ec2aeb840151df81938ac3092c29d967290c28b173c7e9ed98f1af4fedf46fef9914dcfc6d266172

Download Submit
\Users\Admin\AppData\Local\Temp\66e391d04bc0ab2a5e06895a2df14b56.dll
MD5
387e8337881f7a0358d993a0441eefeb

SHA1
c994efea3ca2b6e68fce6540d3ace32833e4016f

SHA256
727159a69708609e19a5850eef39a379ae145cbf7da57d96ef631499b44c4820

SHA512
1b214e8ca00819dd0e97345414cd093877c1adee87dc87f4ec2aeb840151df81938ac3092c29d967290c28b173c7e9ed98f1af4fedf46fef9914dcfc6d266172

Download Submit
memory/268-59-0x0000000000000000-mapping.dmp

Download
memory/268-60-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/268-62-0x00000000747B0000-0x000000007489A000-memory.dmp

Filesize
936KB

Download
memory/268-61-0x00000000747B0000-0x00000000747D1000-memory.dmp

Filesize
132KB

Download
memory/268-63-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/744-69-0x0000000000000000-mapping.dmp

Download
memory/744-70-0x000007FEFBB31000-0x000007FEFBB33000-memory.dmp

Filesize
8KB

Download
memory/1316-68-0x0000000000310000-0x0000000000331000-memory.dmp

Filesize
132KB

Download
memory/1316-66-0x0000000074551000-0x0000000074553000-memory.dmp

Filesize
8KB

Download
memory/1316-64-0x0000000000000000-mapping.dmp

Download
memory/1500-67-0x0000000000000000-mapping.dmp

Download
memory/1828-72-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads