qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d.dll
Size

378KB
MD5

908f17686edf6f7663a40c31e7971225
SHA1

4f2c8a970f0a5ab4c7c27b1b23825ffebd344b1c
SHA256

9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d
SHA512

a154e9b8fc629a18ea08c1019442d383f348ded69c5ba05a6153dce6684ba31ce20cbda880519e615a8102a1ea0049d5e324d2f95ec78531c94f10a3854c46cc

Score

10^/10

qakbot obama104 1632729661 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

obama104

Campaign

1632729661

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3804 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1220 rundll32.exe
1220 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1220 rundll32.exe

pid	process
3804	schtasks.exe

pid	process
1220	rundll32.exe
1220	rundll32.exe

pid	process
1220	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exe

description	pid	process	target process
PID 3868 wrote to memory of 1220	3868	rundll32.exe	rundll32.exe
PID 3868 wrote to memory of 1220	3868	rundll32.exe	rundll32.exe
PID 3868 wrote to memory of 1220	3868	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 3540	1220	rundll32.exe	explorer.exe
PID 1220 wrote to memory of 3540	1220	rundll32.exe	explorer.exe
PID 1220 wrote to memory of 3540	1220	rundll32.exe	explorer.exe
PID 1220 wrote to memory of 3540	1220	rundll32.exe	explorer.exe
PID 1220 wrote to memory of 3540	1220	rundll32.exe	explorer.exe
PID 3540 wrote to memory of 3804	3540	explorer.exe	schtasks.exe
PID 3540 wrote to memory of 3804	3540	explorer.exe	schtasks.exe
PID 3540 wrote to memory of 3804	3540	explorer.exe	schtasks.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3868

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3540

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dyatvmv /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d.dll\"" /SC ONCE /Z /ST 11:24 /ET 11:36
4⤵
- Creates scheduled task(s)
PID:3804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-130-0x0000000002D70000-0x0000000002DB2000-memory.dmp

Filesize
264KB

Download
memory/1220-131-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/3540-132-0x0000000000700000-0x0000000000721000-memory.dmp

Filesize
132KB

Download