qakbot | 5ac3a36dbb4c23e0a8b04f9d8563c2309d74f9ad9dbfdebac7929ef8552afc0a

General

Target

66e391d04bc0ab2a5e06895a2df14b56.dll
Size

823KB
MD5

66e391d04bc0ab2a5e06895a2df14b56
SHA1

74a683c444719e3d9bbfd9ad1274648acf296cb5
SHA256

5ac3a36dbb4c23e0a8b04f9d8563c2309d74f9ad9dbfdebac7929ef8552afc0a
SHA512

bf48d747221fbb1325477fae499caa5320970c16bf5e3476fce189f4e77fdfe7d6b1f37dea4eb8ac23d9582802db06262c9fab6352c0c4f0697ecc220034dbfe

Score

10^/10

qakbot obama100 1632151873 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.318

Botnet

obama100

Campaign

1632151873

C2

45.46.53.140:2222

144.139.47.206:443

189.210.115.207:443

120.150.218.241:995

47.22.148.6:443

140.82.49.12:443

24.139.72.117:443

24.229.150.54:995

24.55.112.61:443

136.232.34.70:443

95.77.223.148:443

173.21.10.71:2222

76.25.142.196:443

96.37.113.36:993

71.74.12.34:443

73.151.236.31:443

67.165.206.193:993

109.12.111.14:443

68.204.7.158:443

105.198.236.99:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3628 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1160 3628 WerFault.exe regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2700 schtasks.exe

pid	process
3628	regsvr32.exe

pid	pid_target	process	target process
1160	3628	WerFault.exe	regsvr32.exe

pid	process
2700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
2412	rundll32.exe
2412	rundll32.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2412 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1160 WerFault.exe
Token: SeBackupPrivilege 1160 WerFault.exe
Token: SeDebugPrivilege 1160 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	1160	WerFault.exe
Token: SeBackupPrivilege	1160	WerFault.exe
Token: SeDebugPrivilege	1160	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 2352 wrote to memory of 2412	2352	rundll32.exe	rundll32.exe
PID 2352 wrote to memory of 2412	2352	rundll32.exe	rundll32.exe
PID 2352 wrote to memory of 2412	2352	rundll32.exe	rundll32.exe
PID 2412 wrote to memory of 2672	2412	rundll32.exe	explorer.exe
PID 2412 wrote to memory of 2672	2412	rundll32.exe	explorer.exe
PID 2412 wrote to memory of 2672	2412	rundll32.exe	explorer.exe
PID 2412 wrote to memory of 2672	2412	rundll32.exe	explorer.exe
PID 2412 wrote to memory of 2672	2412	rundll32.exe	explorer.exe
PID 2672 wrote to memory of 2700	2672	explorer.exe	schtasks.exe
PID 2672 wrote to memory of 2700	2672	explorer.exe	schtasks.exe
PID 2672 wrote to memory of 2700	2672	explorer.exe	schtasks.exe
PID 504 wrote to memory of 3628	504	regsvr32.exe	regsvr32.exe
PID 504 wrote to memory of 3628	504	regsvr32.exe	regsvr32.exe
PID 504 wrote to memory of 3628	504	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66e391d04bc0ab2a5e06895a2df14b56.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66e391d04bc0ab2a5e06895a2df14b56.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bxhwbqmiq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\66e391d04bc0ab2a5e06895a2df14b56.dll\"" /SC ONCE /Z /ST 07:04 /ET 07:16
4⤵
- Creates scheduled task(s)
PID:2700

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\66e391d04bc0ab2a5e06895a2df14b56.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:504

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\66e391d04bc0ab2a5e06895a2df14b56.dll"
2⤵
- Loads dropped DLL
PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 612
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1160

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\66e391d04bc0ab2a5e06895a2df14b56.dll
MD5
c111d6be4ad64d17eea130a4ce0b4150

SHA1
c9caaacc781ce46f269ef939d0f25f363ef98c7c

SHA256
ac4cec3504b5e77490f7326d99a1fdc03dd83e249fac52f75505e3bac5e7bebe

SHA512
2ecf0911c72da272842fd0e26c67ab8f7aa15c6a623998e239057859591f39e269fa0275be84eb4e8beb76db1b3d9b165226d9bbb35bd956c6e42a6566d74c45

Download Submit
\Users\Admin\AppData\Local\Temp\66e391d04bc0ab2a5e06895a2df14b56.dll
MD5
c111d6be4ad64d17eea130a4ce0b4150

SHA1
c9caaacc781ce46f269ef939d0f25f363ef98c7c

SHA256
ac4cec3504b5e77490f7326d99a1fdc03dd83e249fac52f75505e3bac5e7bebe

SHA512
2ecf0911c72da272842fd0e26c67ab8f7aa15c6a623998e239057859591f39e269fa0275be84eb4e8beb76db1b3d9b165226d9bbb35bd956c6e42a6566d74c45

Download Submit
memory/2412-115-0x0000000000000000-mapping.dmp

Download
memory/2412-116-0x0000000074330000-0x0000000074351000-memory.dmp

Filesize
132KB

Download
memory/2412-117-0x0000000074330000-0x000000007441A000-memory.dmp

Filesize
936KB

Download
memory/2412-118-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Filesize
4KB

Download
memory/2672-119-0x0000000000000000-mapping.dmp

Download
memory/2672-123-0x0000000002D30000-0x0000000002D51000-memory.dmp

Filesize
132KB

Download
memory/2700-120-0x0000000000000000-mapping.dmp

Download
memory/3628-125-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads