qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
126s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b.dll
Size

378KB
MD5

7a35246c94d5dd27aff56a7862b1d33e
SHA1

24b38e564c4027dbf26ba3bf766335c5be029faf
SHA256

98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b
SHA512

011e4860daa0f1bc977e6fe1c006c29b93386af5f313170661cd4f5d697b82da906f689050fa37696ee31f8fbfa1bd95339c7f8358bc14b0c63c62f35a46d985

Score

10^/10

qakbot obama104 1632729661 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

obama104

Campaign

1632729661

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4432 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1304 rundll32.exe
1304 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1304 rundll32.exe

pid	process
4432	schtasks.exe

pid	process
1304	rundll32.exe
1304	rundll32.exe

pid	process
1304	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exe

description	pid	process	target process
PID 1620 wrote to memory of 1304	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1304	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1304	1620	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 4572	1304	rundll32.exe	explorer.exe
PID 1304 wrote to memory of 4572	1304	rundll32.exe	explorer.exe
PID 1304 wrote to memory of 4572	1304	rundll32.exe	explorer.exe
PID 1304 wrote to memory of 4572	1304	rundll32.exe	explorer.exe
PID 1304 wrote to memory of 4572	1304	rundll32.exe	explorer.exe
PID 4572 wrote to memory of 4432	4572	explorer.exe	schtasks.exe
PID 4572 wrote to memory of 4432	4572	explorer.exe	schtasks.exe
PID 4572 wrote to memory of 4432	4572	explorer.exe	schtasks.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4572

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xzkidtib /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b.dll\"" /SC ONCE /Z /ST 12:25 /ET 12:37
4⤵
- Creates scheduled task(s)
PID:4432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-134-0x0000000001030000-0x00000000010BD000-memory.dmp

Filesize
564KB

Download
memory/1304-135-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/4572-136-0x00000000005D0000-0x00000000005F1000-memory.dmp

Filesize
132KB

Download