qakbot | 6ad0e624a0fb43586c708f6811f91c83517b0ace8e3de63914a42304f2b2e674

General

Target

6ad0e624a0fb43586c708f6811f91c83517b0ace8e3de63914a42304f2b2e674.dll
Size

335KB
MD5

bd426e03d5f8fcfd6e15d003a9631911
SHA1

592fd5c48f10c8351957e0e91772d883aa3b89e3
SHA256

6ad0e624a0fb43586c708f6811f91c83517b0ace8e3de63914a42304f2b2e674
SHA512

fc0eb3caa6e0333392d87f1ea07883e5daa5e63a3a2a5c05a6dbe4eed4fca9634822646bff505d8e8f116f7c42014c02cf1aa6432f3c699f021008e2e1d27a57

Score

10^/10

qakbot obama192 1655969261 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama192

Campaign

1655969261

C2

100.38.242.113:995

94.59.252.166:2222

74.14.5.179:2222

71.13.93.154:2222

193.253.44.249:2222

108.60.213.141:443

45.241.231.78:993

217.128.122.65:2222

40.134.246.185:995

1.161.124.241:443

70.46.220.114:443

24.43.99.75:443

32.221.224.140:995

80.11.74.81:2222

31.215.184.140:2222

39.49.85.29:995

67.209.195.198:443

186.90.153.162:2222

148.64.96.100:443

67.165.206.193:993

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1952 1988 WerFault.exe explorer.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

1256 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1256 regsvr32.exe

pid	pid_target	process	target process
1952	1988	WerFault.exe	explorer.exe

pid	process
1256	regsvr32.exe

pid	process
1256	regsvr32.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 304 wrote to memory of 1256	304	regsvr32.exe	regsvr32.exe
PID 304 wrote to memory of 1256	304	regsvr32.exe	regsvr32.exe
PID 304 wrote to memory of 1256	304	regsvr32.exe	regsvr32.exe
PID 304 wrote to memory of 1256	304	regsvr32.exe	regsvr32.exe
PID 304 wrote to memory of 1256	304	regsvr32.exe	regsvr32.exe
PID 304 wrote to memory of 1256	304	regsvr32.exe	regsvr32.exe
PID 304 wrote to memory of 1256	304	regsvr32.exe	regsvr32.exe
PID 1256 wrote to memory of 1988	1256	regsvr32.exe	explorer.exe
PID 1256 wrote to memory of 1988	1256	regsvr32.exe	explorer.exe
PID 1256 wrote to memory of 1988	1256	regsvr32.exe	explorer.exe
PID 1256 wrote to memory of 1988	1256	regsvr32.exe	explorer.exe
PID 1256 wrote to memory of 1988	1256	regsvr32.exe	explorer.exe
PID 1256 wrote to memory of 1988	1256	regsvr32.exe	explorer.exe
PID 1988 wrote to memory of 1952	1988	explorer.exe	WerFault.exe
PID 1988 wrote to memory of 1952	1988	explorer.exe	WerFault.exe
PID 1988 wrote to memory of 1952	1988	explorer.exe	WerFault.exe
PID 1988 wrote to memory of 1952	1988	explorer.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6ad0e624a0fb43586c708f6811f91c83517b0ace8e3de63914a42304f2b2e674.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:304

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\6ad0e624a0fb43586c708f6811f91c83517b0ace8e3de63914a42304f2b2e674.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 396
4⤵
- Program crash
PID:1952

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/304-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/1256-55-0x0000000000000000-mapping.dmp

Download
memory/1256-56-0x0000000075DB1000-0x0000000075DB3000-memory.dmp

Filesize
8KB

Download
memory/1256-57-0x0000000000180000-0x00000000001A2000-memory.dmp

Filesize
136KB

Download
memory/1256-59-0x0000000000180000-0x00000000001A2000-memory.dmp

Filesize
136KB

Download
memory/1256-63-0x0000000000180000-0x00000000001A2000-memory.dmp

Filesize
136KB

Download
memory/1952-65-0x0000000000000000-mapping.dmp

Download
memory/1988-60-0x0000000000000000-mapping.dmp

Download
memory/1988-62-0x00000000742E1000-0x00000000742E3000-memory.dmp

Filesize
8KB

Download
memory/1988-64-0x00000000000C0000-0x00000000000E2000-memory.dmp

Filesize
136KB

Download
memory/1988-66-0x00000000000C0000-0x00000000000E2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing