qakbot | 0a70a89d7b7ac4048e3558f7cbc0023f425d8136b3d6e81ecdc56cc8769a0b59

General

Target

e84c9cf05be5c7911a553395bf6977b22078b3e74cd22afb98268831c2ecb77b.dll
Size

370KB
MD5

42edbe2e6d2bd757c086f717d897979c
SHA1

f893b18036d8cce2eb54d072861a7a9d0fabdd60
SHA256

e84c9cf05be5c7911a553395bf6977b22078b3e74cd22afb98268831c2ecb77b
SHA512

30d681cece79bf7e326882fc92dde640dc539a3f022298611dd9e03e08de243f60faf8590f473befc0bd6c8f028899f5c61a93d2dd86b0045a114653bb541ba0

Score

10^/10

qakbot obama195 1656400725 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama195

Campaign

1656400725

C2

74.14.5.179:2222

104.34.212.7:32103

142.186.49.224:2222

93.48.80.198:995

94.59.15.180:2222

217.128.122.65:2222

45.241.173.232:993

24.43.99.75:443

89.101.97.139:443

70.46.220.114:443

32.221.224.140:995

67.209.195.198:443

37.34.253.233:443

80.11.74.81:2222

81.214.215.234:443

67.165.206.193:993

173.174.216.62:443

186.90.153.162:2222

148.64.96.100:443

176.205.23.138:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

992 schtasks.exe

pid	process
992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
112	regsvr32.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

112 regsvr32.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1928 wrote to memory of 112	1928	regsvr32.exe	regsvr32.exe
PID 1928 wrote to memory of 112	1928	regsvr32.exe	regsvr32.exe
PID 1928 wrote to memory of 112	1928	regsvr32.exe	regsvr32.exe
PID 1928 wrote to memory of 112	1928	regsvr32.exe	regsvr32.exe
PID 1928 wrote to memory of 112	1928	regsvr32.exe	regsvr32.exe
PID 1928 wrote to memory of 112	1928	regsvr32.exe	regsvr32.exe
PID 1928 wrote to memory of 112	1928	regsvr32.exe	regsvr32.exe
PID 112 wrote to memory of 2044	112	regsvr32.exe	explorer.exe
PID 112 wrote to memory of 2044	112	regsvr32.exe	explorer.exe
PID 112 wrote to memory of 2044	112	regsvr32.exe	explorer.exe
PID 112 wrote to memory of 2044	112	regsvr32.exe	explorer.exe
PID 112 wrote to memory of 2044	112	regsvr32.exe	explorer.exe
PID 112 wrote to memory of 2044	112	regsvr32.exe	explorer.exe
PID 2044 wrote to memory of 992	2044	explorer.exe	schtasks.exe
PID 2044 wrote to memory of 992	2044	explorer.exe	schtasks.exe
PID 2044 wrote to memory of 992	2044	explorer.exe	schtasks.exe
PID 2044 wrote to memory of 992	2044	explorer.exe	schtasks.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e84c9cf05be5c7911a553395bf6977b22078b3e74cd22afb98268831c2ecb77b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e84c9cf05be5c7911a553395bf6977b22078b3e74cd22afb98268831c2ecb77b.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 09:14 /tn zueoxsviuw /ET 09:25 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAZQA4ADQAYwA5AGMAZgAwADUAYgBlADUAYwA3ADkAMQAxAGEANQA1ADMAMwA5ADUAYgBmADYAOQA3ADcAYgAyADIAMAA3ADgAYgAzAGUANwA0AGMAZAAyADIAYQBmAGIAOQA4ADIANgA4ADgAMwAxAGMAMgBlAGMAYgA3ADcAYgAuAGQAbABsACIA" /SC ONCE
      4⤵
      Creates scheduled task(s)
      PID:992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-55-0x0000000000000000-mapping.dmp

Download
memory/112-56-0x0000000076011000-0x0000000076013000-memory.dmp

Filesize
8KB

Download
memory/112-57-0x0000000000100000-0x0000000000122000-memory.dmp

Filesize
136KB

Download
memory/112-59-0x0000000000100000-0x0000000000122000-memory.dmp

Filesize
136KB

Download
memory/112-63-0x0000000000100000-0x0000000000122000-memory.dmp

Filesize
136KB

Download
memory/992-65-0x0000000000000000-mapping.dmp

Download
memory/1928-54-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Filesize
8KB

Download
memory/2044-60-0x0000000000000000-mapping.dmp

Download
memory/2044-62-0x00000000749F1000-0x00000000749F3000-memory.dmp

Filesize
8KB

Download
memory/2044-64-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/2044-66-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads