qakbot | 1b3fc9c250b8cf0e52c491376aaa6c1929c3b5e264d59ed77033ee0214bc3f9e

General

Target

1b3fc9c250b8cf0e52c491376aaa6c1929c3b5e264d59ed77033ee0214bc3f9e.dll
Size

1.0MB
MD5

bc5cd9ba1b2f9df9617335a64ef4915f
SHA1

1630dd1cb577c44d3f9f28c06208f660c8d82aed
SHA256

1b3fc9c250b8cf0e52c491376aaa6c1929c3b5e264d59ed77033ee0214bc3f9e
SHA512

020798e77af15e8aafe1c69a115ebdfe51f3f4416d0a4ecb3a441f63c31d07a36f1b5d7d722db088f1508dc057b48e0d6284dcdc6efcddf464c75c83caa98dec

Score

10^/10

qakbot obama189 1655107308 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.688

Botnet

obama189

Campaign

1655107308

C2

91.177.173.10:995

117.248.109.38:21

182.191.92.203:995

39.52.38.164:995

217.165.84.253:993

84.241.8.23:32103

82.152.39.39:443

202.134.152.2:2222

122.118.131.132:995

120.150.218.241:995

222.169.71.98:2222

37.34.253.233:443

93.48.80.198:995

148.0.55.173:443

175.145.235.37:443

41.130.140.32:993

120.61.0.71:443

89.101.97.139:443

62.204.41.187:443

62.204.41.187:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1788 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1216 schtasks.exe

pid	process
1788	regsvr32.exe

pid	process
1216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeexplorer.exeregsvr32.exe

pid	process
1884	rundll32.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe
1788	regsvr32.exe
1312	explorer.exe
1312	explorer.exe
1312	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1884 rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1816 wrote to memory of 1884	1816	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 1884	1816	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 1884	1816	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 1884	1816	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 1884	1816	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 1884	1816	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 1884	1816	rundll32.exe	rundll32.exe
PID 1884 wrote to memory of 1312	1884	rundll32.exe	explorer.exe
PID 1884 wrote to memory of 1312	1884	rundll32.exe	explorer.exe
PID 1884 wrote to memory of 1312	1884	rundll32.exe	explorer.exe
PID 1884 wrote to memory of 1312	1884	rundll32.exe	explorer.exe
PID 1884 wrote to memory of 1312	1884	rundll32.exe	explorer.exe
PID 1884 wrote to memory of 1312	1884	rundll32.exe	explorer.exe
PID 1312 wrote to memory of 1216	1312	explorer.exe	schtasks.exe
PID 1312 wrote to memory of 1216	1312	explorer.exe	schtasks.exe
PID 1312 wrote to memory of 1216	1312	explorer.exe	schtasks.exe
PID 1312 wrote to memory of 1216	1312	explorer.exe	schtasks.exe
PID 1276 wrote to memory of 396	1276	taskeng.exe	regsvr32.exe
PID 1276 wrote to memory of 396	1276	taskeng.exe	regsvr32.exe
PID 1276 wrote to memory of 396	1276	taskeng.exe	regsvr32.exe
PID 1276 wrote to memory of 396	1276	taskeng.exe	regsvr32.exe
PID 1276 wrote to memory of 396	1276	taskeng.exe	regsvr32.exe
PID 396 wrote to memory of 1788	396	regsvr32.exe	regsvr32.exe
PID 396 wrote to memory of 1788	396	regsvr32.exe	regsvr32.exe
PID 396 wrote to memory of 1788	396	regsvr32.exe	regsvr32.exe
PID 396 wrote to memory of 1788	396	regsvr32.exe	regsvr32.exe
PID 396 wrote to memory of 1788	396	regsvr32.exe	regsvr32.exe
PID 396 wrote to memory of 1788	396	regsvr32.exe	regsvr32.exe
PID 396 wrote to memory of 1788	396	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b3fc9c250b8cf0e52c491376aaa6c1929c3b5e264d59ed77033ee0214bc3f9e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b3fc9c250b8cf0e52c491376aaa6c1929c3b5e264d59ed77033ee0214bc3f9e.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn sxbyfpmpop /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\1b3fc9c250b8cf0e52c491376aaa6c1929c3b5e264d59ed77033ee0214bc3f9e.dll\"" /SC ONCE /Z /ST 03:02 /ET 03:14
4⤵
- Creates scheduled task(s)
PID:1216

C:\Windows\system32\taskeng.exe
taskeng.exe {45D0B9BE-00D8-4540-A9DF-8153F0A88EE3} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1276

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\1b3fc9c250b8cf0e52c491376aaa6c1929c3b5e264d59ed77033ee0214bc3f9e.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:396

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\1b3fc9c250b8cf0e52c491376aaa6c1929c3b5e264d59ed77033ee0214bc3f9e.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1788

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1b3fc9c250b8cf0e52c491376aaa6c1929c3b5e264d59ed77033ee0214bc3f9e.dll
Filesize
1.0MB

MD5
bc5cd9ba1b2f9df9617335a64ef4915f

SHA1
1630dd1cb577c44d3f9f28c06208f660c8d82aed

SHA256
1b3fc9c250b8cf0e52c491376aaa6c1929c3b5e264d59ed77033ee0214bc3f9e

SHA512
020798e77af15e8aafe1c69a115ebdfe51f3f4416d0a4ecb3a441f63c31d07a36f1b5d7d722db088f1508dc057b48e0d6284dcdc6efcddf464c75c83caa98dec

Download Submit
\Users\Admin\AppData\Local\Temp\1b3fc9c250b8cf0e52c491376aaa6c1929c3b5e264d59ed77033ee0214bc3f9e.dll
Filesize
1.0MB

MD5
bc5cd9ba1b2f9df9617335a64ef4915f

SHA1
1630dd1cb577c44d3f9f28c06208f660c8d82aed

SHA256
1b3fc9c250b8cf0e52c491376aaa6c1929c3b5e264d59ed77033ee0214bc3f9e

SHA512
020798e77af15e8aafe1c69a115ebdfe51f3f4416d0a4ecb3a441f63c31d07a36f1b5d7d722db088f1508dc057b48e0d6284dcdc6efcddf464c75c83caa98dec

Download Submit
memory/396-69-0x0000000000000000-mapping.dmp

Download
memory/396-70-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download
memory/1216-67-0x0000000000000000-mapping.dmp

Download
memory/1312-62-0x0000000000000000-mapping.dmp

Download
memory/1312-64-0x00000000742B1000-0x00000000742B3000-memory.dmp

Filesize
8KB

Download
memory/1312-66-0x00000000000C0000-0x00000000000E2000-memory.dmp

Filesize
136KB

Download
memory/1312-68-0x00000000000C0000-0x00000000000E2000-memory.dmp

Filesize
136KB

Download
memory/1788-72-0x0000000000000000-mapping.dmp

Download
memory/1788-80-0x0000000000440000-0x0000000000462000-memory.dmp

Filesize
136KB

Download
memory/1788-79-0x00000000003D0000-0x0000000000402000-memory.dmp

Filesize
200KB

Download
memory/1788-77-0x0000000000440000-0x0000000000462000-memory.dmp

Filesize
136KB

Download
memory/1788-78-0x0000000000440000-0x0000000000462000-memory.dmp

Filesize
136KB

Download
memory/1788-76-0x0000000000440000-0x0000000000462000-memory.dmp

Filesize
136KB

Download
memory/1788-75-0x0000000000AF0000-0x0000000000BFC000-memory.dmp

Filesize
1.0MB

Download
memory/1884-65-0x0000000000B40000-0x0000000000B62000-memory.dmp

Filesize
136KB

Download
memory/1884-56-0x0000000000A30000-0x0000000000B3C000-memory.dmp

Filesize
1.0MB

Download
memory/1884-55-0x0000000075D21000-0x0000000075D23000-memory.dmp

Filesize
8KB

Download
memory/1884-57-0x0000000000B40000-0x0000000000B62000-memory.dmp

Filesize
136KB

Download
memory/1884-59-0x0000000000B40000-0x0000000000B62000-memory.dmp

Filesize
136KB

Download
memory/1884-54-0x0000000000000000-mapping.dmp

Download
memory/1884-58-0x0000000000B40000-0x0000000000B62000-memory.dmp

Filesize
136KB

Download
memory/1884-61-0x0000000000B40000-0x0000000000B62000-memory.dmp

Filesize
136KB

Download
memory/1884-60-0x0000000000680000-0x00000000006B2000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads