qakbot | d90f5fbff4ba9c5e119ff9a921eff71a043666dc76e3e3b3f7d912b87ae9c1af

General

Target

e6c2777b52416027f1c047a255383d46e4826cbd4f84911d94671b9bb29d3894.dll
Size

679KB
MD5

c019e6e884111c417654a878b33c9690
SHA1

1dbaef4c7d519111cf576c9efd127128f8b204fd
SHA256

e6c2777b52416027f1c047a255383d46e4826cbd4f84911d94671b9bb29d3894
SHA512

ebf723f3927c28188b243025aa92f6ab7608bfa26f55d3f304e0a9da644a588374c393f63fee6d061dd98aa9902d07b2bee8c26e83fd02c90453d3535f8aad8f

Score

10^/10

qakbot obama182 1651756499 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.683

Botnet

obama182

Campaign

1651756499

C2

103.107.113.120:443

80.11.74.81:2222

177.102.2.175:32101

24.178.196.158:2222

91.177.173.10:995

181.208.248.227:443

176.67.56.94:443

202.134.152.2:2222

148.0.57.85:443

179.179.162.9:993

40.134.246.185:995

37.186.54.254:995

196.203.37.215:80

120.150.218.241:995

208.107.221.224:443

113.53.151.59:443

70.46.220.114:443

69.14.172.24:443

108.60.213.141:443

24.55.67.176:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1808 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

112 schtasks.exe

pid	process
1808	regsvr32.exe

pid	process
112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeexplorer.exe

pid	process
676	rundll32.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe
1820	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

676 rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1968 wrote to memory of 676	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 676	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 676	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 676	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 676	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 676	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 676	1968	rundll32.exe	rundll32.exe
PID 676 wrote to memory of 1820	676	rundll32.exe	explorer.exe
PID 676 wrote to memory of 1820	676	rundll32.exe	explorer.exe
PID 676 wrote to memory of 1820	676	rundll32.exe	explorer.exe
PID 676 wrote to memory of 1820	676	rundll32.exe	explorer.exe
PID 676 wrote to memory of 1820	676	rundll32.exe	explorer.exe
PID 676 wrote to memory of 1820	676	rundll32.exe	explorer.exe
PID 1820 wrote to memory of 112	1820	explorer.exe	schtasks.exe
PID 1820 wrote to memory of 112	1820	explorer.exe	schtasks.exe
PID 1820 wrote to memory of 112	1820	explorer.exe	schtasks.exe
PID 1820 wrote to memory of 112	1820	explorer.exe	schtasks.exe
PID 1548 wrote to memory of 1544	1548	taskeng.exe	regsvr32.exe
PID 1548 wrote to memory of 1544	1548	taskeng.exe	regsvr32.exe
PID 1548 wrote to memory of 1544	1548	taskeng.exe	regsvr32.exe
PID 1548 wrote to memory of 1544	1548	taskeng.exe	regsvr32.exe
PID 1548 wrote to memory of 1544	1548	taskeng.exe	regsvr32.exe
PID 1544 wrote to memory of 1808	1544	regsvr32.exe	regsvr32.exe
PID 1544 wrote to memory of 1808	1544	regsvr32.exe	regsvr32.exe
PID 1544 wrote to memory of 1808	1544	regsvr32.exe	regsvr32.exe
PID 1544 wrote to memory of 1808	1544	regsvr32.exe	regsvr32.exe
PID 1544 wrote to memory of 1808	1544	regsvr32.exe	regsvr32.exe
PID 1544 wrote to memory of 1808	1544	regsvr32.exe	regsvr32.exe
PID 1544 wrote to memory of 1808	1544	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6c2777b52416027f1c047a255383d46e4826cbd4f84911d94671b9bb29d3894.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6c2777b52416027f1c047a255383d46e4826cbd4f84911d94671b9bb29d3894.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:676

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qsdofdj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\e6c2777b52416027f1c047a255383d46e4826cbd4f84911d94671b9bb29d3894.dll\"" /SC ONCE /Z /ST 14:06 /ET 14:18
4⤵
- Creates scheduled task(s)
PID:112

C:\Windows\system32\taskeng.exe
taskeng.exe {0EE1D346-F158-441F-B3B7-0D75E9AA8711} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\e6c2777b52416027f1c047a255383d46e4826cbd4f84911d94671b9bb29d3894.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\e6c2777b52416027f1c047a255383d46e4826cbd4f84911d94671b9bb29d3894.dll"
3⤵
- Loads dropped DLL
PID:1808

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e6c2777b52416027f1c047a255383d46e4826cbd4f84911d94671b9bb29d3894.dll
Filesize
679KB

MD5
c019e6e884111c417654a878b33c9690

SHA1
1dbaef4c7d519111cf576c9efd127128f8b204fd

SHA256
e6c2777b52416027f1c047a255383d46e4826cbd4f84911d94671b9bb29d3894

SHA512
ebf723f3927c28188b243025aa92f6ab7608bfa26f55d3f304e0a9da644a588374c393f63fee6d061dd98aa9902d07b2bee8c26e83fd02c90453d3535f8aad8f

Download Submit
\Users\Admin\AppData\Local\Temp\e6c2777b52416027f1c047a255383d46e4826cbd4f84911d94671b9bb29d3894.dll
Filesize
679KB

MD5
c019e6e884111c417654a878b33c9690

SHA1
1dbaef4c7d519111cf576c9efd127128f8b204fd

SHA256
e6c2777b52416027f1c047a255383d46e4826cbd4f84911d94671b9bb29d3894

SHA512
ebf723f3927c28188b243025aa92f6ab7608bfa26f55d3f304e0a9da644a588374c393f63fee6d061dd98aa9902d07b2bee8c26e83fd02c90453d3535f8aad8f

Download Submit
memory/112-66-0x0000000000000000-mapping.dmp

Download
memory/676-60-0x0000000000260000-0x0000000000282000-memory.dmp

Filesize
136KB

Download
memory/676-58-0x00000000002F0000-0x0000000000312000-memory.dmp

Filesize
136KB

Download
memory/676-59-0x00000000002F0000-0x0000000000312000-memory.dmp

Filesize
136KB

Download
memory/676-61-0x00000000002F0000-0x0000000000312000-memory.dmp

Filesize
136KB

Download
memory/676-57-0x00000000002F0000-0x0000000000312000-memory.dmp

Filesize
136KB

Download
memory/676-54-0x0000000000000000-mapping.dmp

Download
memory/676-56-0x00000000003C0000-0x000000000046F000-memory.dmp

Filesize
700KB

Download
memory/676-55-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/1544-68-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp

Filesize
8KB

Download
memory/1544-67-0x0000000000000000-mapping.dmp

Download
memory/1808-70-0x0000000000000000-mapping.dmp

Download
memory/1808-73-0x0000000000AD0000-0x0000000000B7F000-memory.dmp

Filesize
700KB

Download
memory/1808-74-0x00000000002A0000-0x00000000002C2000-memory.dmp

Filesize
136KB

Download
memory/1808-75-0x00000000002A0000-0x00000000002C2000-memory.dmp

Filesize
136KB

Download
memory/1808-76-0x00000000002A0000-0x00000000002C2000-memory.dmp

Filesize
136KB

Download
memory/1808-77-0x00000000001F0000-0x0000000000212000-memory.dmp

Filesize
136KB

Download
memory/1808-78-0x00000000002A0000-0x00000000002C2000-memory.dmp

Filesize
136KB

Download
memory/1820-65-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1820-64-0x0000000074691000-0x0000000074693000-memory.dmp

Filesize
8KB

Download
memory/1820-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads