qakbot | 5196c35f3e7a88038805a3da1632baca040a08c2dc391e2e5c416cf11e4e915c

General

Target

3b3cf2efa0dab752f5297eaf87a73e03.dll
Size

823KB
MD5

3b3cf2efa0dab752f5297eaf87a73e03
SHA1

e277a77c66f6a454443458b907c653dd252ef699
SHA256

5196c35f3e7a88038805a3da1632baca040a08c2dc391e2e5c416cf11e4e915c
SHA512

2454660c5764d632d9501796a4868186f254681708e4de66c67cf699ad3a4cd6a3e28fe7419ce80475d7e933ddf225c355c33f60b0f1f87469af8c1df8cccd27

Score

10^/10

qakbot obama100 1632151873 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.318

Botnet

obama100

Campaign

1632151873

C2

45.46.53.140:2222

144.139.47.206:443

189.210.115.207:443

120.150.218.241:995

47.22.148.6:443

140.82.49.12:443

24.139.72.117:443

24.229.150.54:995

24.55.112.61:443

136.232.34.70:443

95.77.223.148:443

173.21.10.71:2222

76.25.142.196:443

96.37.113.36:993

71.74.12.34:443

73.151.236.31:443

67.165.206.193:993

109.12.111.14:443

68.204.7.158:443

105.198.236.99:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1496 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1600 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1988 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1988 rundll32.exe

pid	process
1496	regsvr32.exe

pid	process
1600	schtasks.exe

pid	process
1988	rundll32.exe

pid	process
1988	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 2012 wrote to memory of 1988	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1988	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1988	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1988	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1988	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1988	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1988	2012	rundll32.exe	rundll32.exe
PID 1988 wrote to memory of 1436	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 1436	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 1436	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 1436	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 1436	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 1436	1988	rundll32.exe	explorer.exe
PID 1436 wrote to memory of 1600	1436	explorer.exe	schtasks.exe
PID 1436 wrote to memory of 1600	1436	explorer.exe	schtasks.exe
PID 1436 wrote to memory of 1600	1436	explorer.exe	schtasks.exe
PID 1436 wrote to memory of 1600	1436	explorer.exe	schtasks.exe
PID 552 wrote to memory of 868	552	taskeng.exe	regsvr32.exe
PID 552 wrote to memory of 868	552	taskeng.exe	regsvr32.exe
PID 552 wrote to memory of 868	552	taskeng.exe	regsvr32.exe
PID 552 wrote to memory of 868	552	taskeng.exe	regsvr32.exe
PID 552 wrote to memory of 868	552	taskeng.exe	regsvr32.exe
PID 868 wrote to memory of 1496	868	regsvr32.exe	regsvr32.exe
PID 868 wrote to memory of 1496	868	regsvr32.exe	regsvr32.exe
PID 868 wrote to memory of 1496	868	regsvr32.exe	regsvr32.exe
PID 868 wrote to memory of 1496	868	regsvr32.exe	regsvr32.exe
PID 868 wrote to memory of 1496	868	regsvr32.exe	regsvr32.exe
PID 868 wrote to memory of 1496	868	regsvr32.exe	regsvr32.exe
PID 868 wrote to memory of 1496	868	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b3cf2efa0dab752f5297eaf87a73e03.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b3cf2efa0dab752f5297eaf87a73e03.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1436

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ztnzrfzjs /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\3b3cf2efa0dab752f5297eaf87a73e03.dll\"" /SC ONCE /Z /ST 18:58 /ET 19:10
4⤵
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\taskeng.exe
taskeng.exe {BC277694-7610-428B-874A-EA0C9508137E} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\3b3cf2efa0dab752f5297eaf87a73e03.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\3b3cf2efa0dab752f5297eaf87a73e03.dll"
3⤵
- Loads dropped DLL
PID:1496

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3b3cf2efa0dab752f5297eaf87a73e03.dll
MD5
0b42a393082e84d1dc0be8284e4f2f67

SHA1
db1b589e144ede74a3374c5225774d799731fb8b

SHA256
f6f606f6c3fa53ecc5f76c9bce01ac7562ab7c4d70e163ef212458e44f916aea

SHA512
d5f71ddcab3c4c056af66e10d1fa3bedf95b83b801eec422e74dbfac4ec845e2c9460d3e563a294a140e4e3e10dc593466c53947cab01f0bfd3545905ef6aac4

Download Submit
\Users\Admin\AppData\Local\Temp\3b3cf2efa0dab752f5297eaf87a73e03.dll
MD5
0b42a393082e84d1dc0be8284e4f2f67

SHA1
db1b589e144ede74a3374c5225774d799731fb8b

SHA256
f6f606f6c3fa53ecc5f76c9bce01ac7562ab7c4d70e163ef212458e44f916aea

SHA512
d5f71ddcab3c4c056af66e10d1fa3bedf95b83b801eec422e74dbfac4ec845e2c9460d3e563a294a140e4e3e10dc593466c53947cab01f0bfd3545905ef6aac4

Download Submit
memory/868-63-0x0000000000000000-mapping.dmp

Download
memory/868-64-0x000007FEFB691000-0x000007FEFB693000-memory.dmp

Filesize
8KB

Download
memory/1436-60-0x0000000074251000-0x0000000074253000-memory.dmp

Filesize
8KB

Download
memory/1436-58-0x0000000000000000-mapping.dmp

Download
memory/1436-62-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1496-66-0x0000000000000000-mapping.dmp

Download
memory/1600-61-0x0000000000000000-mapping.dmp

Download
memory/1988-53-0x0000000000000000-mapping.dmp

Download
memory/1988-57-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1988-55-0x0000000074410000-0x0000000074431000-memory.dmp

Filesize
132KB

Download
memory/1988-56-0x0000000074410000-0x00000000744FA000-memory.dmp

Filesize
936KB

Download
memory/1988-54-0x0000000075FA1000-0x0000000075FA3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads