qakbot | 378e6e3c1ffe0619f23450717f32ece7bf2db152e94467c79bb7b28903e8816f

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
28-06-2022 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c14868ff988ebcf1bd7a5b64706b7ba677e516bff2695a40956cd8942125189a.dll
Size

386KB
MD5

a76d34c6f29624c17ac75399ad4702cb
SHA1

1ed038bdd2f9cc77f34f9adbbf28216ef7f8dd8b
SHA256

c14868ff988ebcf1bd7a5b64706b7ba677e516bff2695a40956cd8942125189a
SHA512

929525919c33a577b906cf5ac81ea60574c36d5060f06289bd77d404faf5932a863aec4fa0b7a355d389acfd638bfcc9bf270dcdc75b21376bc04027cdfe9c0d

Score

10^/10

qakbot obama193 1656010579 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama193

Campaign

1656010579

104.34.212.7:32103

86.200.151.188:2222

41.228.22.180:443

94.59.15.180:2222

45.46.53.140:2222

189.78.107.163:32101

24.178.196.158:2222

179.158.105.44:443

37.34.253.233:443

47.23.89.60:993

176.45.232.204:995

120.150.218.241:995

38.70.253.226:2222

40.134.246.185:995

5.32.41.45:443

72.252.157.93:990

72.252.157.93:993

24.55.67.176:443

93.48.80.198:995

100.38.242.113:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4760 schtasks.exe

pid	process
4760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
3108	regsvr32.exe
3108	regsvr32.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe
2088	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

3108 regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3136 wrote to memory of 3108	3136	regsvr32.exe	regsvr32.exe
PID 3136 wrote to memory of 3108	3136	regsvr32.exe	regsvr32.exe
PID 3136 wrote to memory of 3108	3136	regsvr32.exe	regsvr32.exe
PID 3108 wrote to memory of 2088	3108	regsvr32.exe	explorer.exe
PID 3108 wrote to memory of 2088	3108	regsvr32.exe	explorer.exe
PID 3108 wrote to memory of 2088	3108	regsvr32.exe	explorer.exe
PID 3108 wrote to memory of 2088	3108	regsvr32.exe	explorer.exe
PID 3108 wrote to memory of 2088	3108	regsvr32.exe	explorer.exe
PID 2088 wrote to memory of 4760	2088	explorer.exe	schtasks.exe
PID 2088 wrote to memory of 4760	2088	explorer.exe	schtasks.exe
PID 2088 wrote to memory of 4760	2088	explorer.exe	schtasks.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c14868ff988ebcf1bd7a5b64706b7ba677e516bff2695a40956cd8942125189a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3136

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\c14868ff988ebcf1bd7a5b64706b7ba677e516bff2695a40956cd8942125189a.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3108

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 09:25 /tn ggalnjw /ET 09:36 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYwAxADQAOAA2ADgAZgBmADkAOAA4AGUAYgBjAGYAMQBiAGQANwBhADUAYgA2ADQANwAwADYAYgA3AGIAYQA2ADcANwBlADUAMQA2AGIAZgBmADIANgA5ADUAYQA0ADAAOQA1ADYAYwBkADgAOQA0ADIAMQAyADUAMQA4ADkAYQAuAGQAbABsACIA" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:4760

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2088-132-0x0000000000000000-mapping.dmp

Download
memory/2088-135-0x00000000001D0000-0x00000000001F2000-memory.dmp

Filesize
136KB

Download
memory/2088-136-0x00000000001D0000-0x00000000001F2000-memory.dmp

Filesize
136KB

Download
memory/3108-130-0x0000000000000000-mapping.dmp

Download
memory/3108-131-0x00000000022D0000-0x00000000022F2000-memory.dmp

Filesize
136KB

Download
memory/3108-133-0x00000000022D0000-0x00000000022F2000-memory.dmp

Filesize
136KB

Download
memory/4760-134-0x0000000000000000-mapping.dmp

Download