qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a91436b7a51dfd164632e7da459c4fb35f8edfea1dea8c438ee75e3f2e0400c.dll
Size

539KB
MD5

e6426f0a69c1565514f49eabe82559dc
SHA1

214f6fd9ccbe9702425eb468c4a178da13d97e2b
SHA256

7a91436b7a51dfd164632e7da459c4fb35f8edfea1dea8c438ee75e3f2e0400c
SHA512

078938d2bfb690f1f5579f592676ca5e5de71b1204b5038c8001bcef1a4548dd97dcdd6f62cc3ff0ae829dff7eefdb7e3a9406a6d0fbdc3178006bf3c3d5638c

Score

10^/10

qakbot obama102 1632302707 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.318

Botnet

obama102

Campaign

1632302707

120.150.218.241:995

47.22.148.6:443

105.198.236.99:443

95.77.223.148:443

140.82.49.12:443

27.223.92.142:995

73.151.236.31:443

136.232.34.70:443

144.139.47.206:443

45.46.53.140:2222

76.25.142.196:443

173.21.10.71:2222

75.188.35.168:443

71.74.12.34:443

96.37.113.36:993

67.165.206.193:993

189.210.115.207:443

72.252.201.69:443

24.139.72.117:443

24.229.150.54:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3580 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3160 3580 WerFault.exe regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4312 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1432 rundll32.exe
1432 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1432 rundll32.exe

pid	process
3580	regsvr32.exe

pid	pid_target	process	target process
3160	3580	WerFault.exe	regsvr32.exe

pid	process
4312	schtasks.exe

pid	process
1432	rundll32.exe
1432	rundll32.exe

pid	process
1432	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 1220 wrote to memory of 1432	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 1432	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 1432	1220	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 3292	1432	rundll32.exe	explorer.exe
PID 1432 wrote to memory of 3292	1432	rundll32.exe	explorer.exe
PID 1432 wrote to memory of 3292	1432	rundll32.exe	explorer.exe
PID 1432 wrote to memory of 3292	1432	rundll32.exe	explorer.exe
PID 1432 wrote to memory of 3292	1432	rundll32.exe	explorer.exe
PID 3292 wrote to memory of 4312	3292	explorer.exe	schtasks.exe
PID 3292 wrote to memory of 4312	3292	explorer.exe	schtasks.exe
PID 3292 wrote to memory of 4312	3292	explorer.exe	schtasks.exe
PID 220 wrote to memory of 3580	220	regsvr32.exe	regsvr32.exe
PID 220 wrote to memory of 3580	220	regsvr32.exe	regsvr32.exe
PID 220 wrote to memory of 3580	220	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a91436b7a51dfd164632e7da459c4fb35f8edfea1dea8c438ee75e3f2e0400c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a91436b7a51dfd164632e7da459c4fb35f8edfea1dea8c438ee75e3f2e0400c.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3292

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn sztubkdwk /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\7a91436b7a51dfd164632e7da459c4fb35f8edfea1dea8c438ee75e3f2e0400c.dll\"" /SC ONCE /Z /ST 11:24 /ET 11:36
4⤵
- Creates scheduled task(s)
PID:4312

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\7a91436b7a51dfd164632e7da459c4fb35f8edfea1dea8c438ee75e3f2e0400c.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:220

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\7a91436b7a51dfd164632e7da459c4fb35f8edfea1dea8c438ee75e3f2e0400c.dll"
2⤵
- Loads dropped DLL
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 584
3⤵
- Program crash
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3580 -ip 3580
1⤵
PID:3164

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7a91436b7a51dfd164632e7da459c4fb35f8edfea1dea8c438ee75e3f2e0400c.dll
MD5
2c22d62afc6b1ed3f83184ab08b73dd9

SHA1
3df074db21bbb9ac332b362f6b2709db17c4c1ca

SHA256
71ea320984557f4ffd486f749850261914f2c8cba2f84bb977e41fadc409e780

SHA512
a516343e96736f9a6863f38594b0877b6a8f3f4d57e7b7f0c43290ee2a1b268d6058b40140720337d3a172dbd451993259e3e815d62fbbf31b2b9265d02f4a94

Download Submit
C:\Users\Admin\AppData\Local\Temp\7a91436b7a51dfd164632e7da459c4fb35f8edfea1dea8c438ee75e3f2e0400c.dll
MD5
2c22d62afc6b1ed3f83184ab08b73dd9

SHA1
3df074db21bbb9ac332b362f6b2709db17c4c1ca

SHA256
71ea320984557f4ffd486f749850261914f2c8cba2f84bb977e41fadc409e780

SHA512
a516343e96736f9a6863f38594b0877b6a8f3f4d57e7b7f0c43290ee2a1b268d6058b40140720337d3a172dbd451993259e3e815d62fbbf31b2b9265d02f4a94

Download Submit
memory/1432-130-0x0000000075530000-0x00000000755D1000-memory.dmp

Filesize
644KB

Download
memory/1432-131-0x0000000075530000-0x0000000075551000-memory.dmp

Filesize
132KB

Download
memory/1432-132-0x0000000075530000-0x00000000755D1000-memory.dmp

Filesize
644KB

Download
memory/1432-133-0x0000000075530000-0x00000000755D1000-memory.dmp

Filesize
644KB

Download
memory/1432-134-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Filesize
4KB

Download
memory/3292-135-0x0000000000230000-0x0000000000251000-memory.dmp

Filesize
132KB

Download