qakbot | 81343a9be0c301685f76fa2185dc8b28c0e8aebdca6f23ba12a4412685e286f6

General

Target

50600999_420925.img
Size

2.6MB
MD5

5531d308f169eb4387f80202b68333a0
SHA1

bac447aa3281946bca9c501d8c18fcf2f5a1c0d1
SHA256

81343a9be0c301685f76fa2185dc8b28c0e8aebdca6f23ba12a4412685e286f6
SHA512

75ef718691db75eebc044590c499982acd1a83e9986eb0be15a951ed5ccc7401a58a5d7a146989977bb32180e4a2f0c44913b1adc54641e50a4bbb3d9b0e85ad

Score

10^/10

qakbot obama186 1654596660 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.694

Botnet

obama186

Campaign

1654596660

C2

67.165.206.193:993

63.143.92.99:995

74.14.5.179:2222

182.191.92.203:995

197.89.8.51:443

89.101.97.139:443

86.97.9.190:443

124.40.244.115:2222

80.11.74.81:2222

41.215.153.104:995

179.100.20.32:32101

31.35.28.29:443

202.134.152.2:2222

109.12.111.14:443

93.48.80.198:995

120.150.218.241:995

41.38.167.179:995

177.94.57.126:32101

173.174.216.62:443

1.161.101.20:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

1740 rundll32.exe
1740 rundll32.exe
1740 rundll32.exe
1740 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1040 schtasks.exe

pid	process
1040	schtasks.exe

Suspicious behavior: EnumeratesProcesses 59 IoCs

Processes:

rundll32.exeexplorer.exe

pid	process
1740	rundll32.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe
1000	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1740 rundll32.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

7zG.exeAUDIODG.EXE

description	pid	process
Token: SeRestorePrivilege	972	7zG.exe
Token: 35	972	7zG.exe
Token: SeSecurityPrivilege	972	7zG.exe
Token: SeSecurityPrivilege	972	7zG.exe
Token: 33	1432	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1432	AUDIODG.EXE
Token: 33	1432	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1432	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zG.exe

pid process

972 7zG.exe

pid	process
972	7zG.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

cmd.exerundll32.exerundll32.exeexplorer.exe

description	pid	process	target process
PID 1176 wrote to memory of 1708	1176	cmd.exe	isoburn.exe
PID 1176 wrote to memory of 1708	1176	cmd.exe	isoburn.exe
PID 1176 wrote to memory of 1708	1176	cmd.exe	isoburn.exe
PID 1424 wrote to memory of 1740	1424	rundll32.exe	rundll32.exe
PID 1424 wrote to memory of 1740	1424	rundll32.exe	rundll32.exe
PID 1424 wrote to memory of 1740	1424	rundll32.exe	rundll32.exe
PID 1424 wrote to memory of 1740	1424	rundll32.exe	rundll32.exe
PID 1424 wrote to memory of 1740	1424	rundll32.exe	rundll32.exe
PID 1424 wrote to memory of 1740	1424	rundll32.exe	rundll32.exe
PID 1424 wrote to memory of 1740	1424	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 1000	1740	rundll32.exe	explorer.exe
PID 1740 wrote to memory of 1000	1740	rundll32.exe	explorer.exe
PID 1740 wrote to memory of 1000	1740	rundll32.exe	explorer.exe
PID 1740 wrote to memory of 1000	1740	rundll32.exe	explorer.exe
PID 1740 wrote to memory of 1000	1740	rundll32.exe	explorer.exe
PID 1740 wrote to memory of 1000	1740	rundll32.exe	explorer.exe
PID 1000 wrote to memory of 1040	1000	explorer.exe	schtasks.exe
PID 1000 wrote to memory of 1040	1000	explorer.exe	schtasks.exe
PID 1000 wrote to memory of 1040	1000	explorer.exe	schtasks.exe
PID 1000 wrote to memory of 1040	1000	explorer.exe	schtasks.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\50600999_420925.img
1⤵
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\System32\isoburn.exe
"C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\50600999_420925.img"
2⤵
PID:1708

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
PID:1480

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\50600999_420925\" -spe -an -ai#7zMap28746:110:7zEvent22594
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:972

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" 019338921.dll,DllInstall
1⤵
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" 019338921.dll,DllInstall
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn oiuqydi /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\50600999_420925\019338921.dll\"" /SC ONCE /Z /ST 08:21 /ET 08:33
4⤵
- Creates scheduled task(s)
PID:1040

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\50600999_420925\019338921.dll
Filesize
1.4MB

MD5
889de0fcbdf800a0732d5909c5b16057

SHA1
925b2fa5fdd084651f84f3b3c4381b0a10ef3ad3

SHA256
f9d073248e84c44c6130c379cf845290b701dd9312e4114caf4b3a99f70e3e8e

SHA512
303911ea66cca532b57b5acd3565f13d3500760eda42bf90653154f482e7d640d0cd318c1f9fd97570dbe7b18cd533deee34b3d2416d4c588a9cabfe47d99777

Download Submit
\Users\Admin\AppData\Local\Temp\50600999_420925\019338921.dll
Filesize
1.4MB

MD5
889de0fcbdf800a0732d5909c5b16057

SHA1
925b2fa5fdd084651f84f3b3c4381b0a10ef3ad3

SHA256
f9d073248e84c44c6130c379cf845290b701dd9312e4114caf4b3a99f70e3e8e

SHA512
303911ea66cca532b57b5acd3565f13d3500760eda42bf90653154f482e7d640d0cd318c1f9fd97570dbe7b18cd533deee34b3d2416d4c588a9cabfe47d99777

Download Submit
\Users\Admin\AppData\Local\Temp\50600999_420925\019338921.dll
Filesize
1.4MB

MD5
889de0fcbdf800a0732d5909c5b16057

SHA1
925b2fa5fdd084651f84f3b3c4381b0a10ef3ad3

SHA256
f9d073248e84c44c6130c379cf845290b701dd9312e4114caf4b3a99f70e3e8e

SHA512
303911ea66cca532b57b5acd3565f13d3500760eda42bf90653154f482e7d640d0cd318c1f9fd97570dbe7b18cd533deee34b3d2416d4c588a9cabfe47d99777

Download Submit
\Users\Admin\AppData\Local\Temp\50600999_420925\019338921.dll
Filesize
1.4MB

MD5
889de0fcbdf800a0732d5909c5b16057

SHA1
925b2fa5fdd084651f84f3b3c4381b0a10ef3ad3

SHA256
f9d073248e84c44c6130c379cf845290b701dd9312e4114caf4b3a99f70e3e8e

SHA512
303911ea66cca532b57b5acd3565f13d3500760eda42bf90653154f482e7d640d0cd318c1f9fd97570dbe7b18cd533deee34b3d2416d4c588a9cabfe47d99777

Download Submit
\Users\Admin\AppData\Local\Temp\50600999_420925\019338921.dll
Filesize
1.4MB

MD5
889de0fcbdf800a0732d5909c5b16057

SHA1
925b2fa5fdd084651f84f3b3c4381b0a10ef3ad3

SHA256
f9d073248e84c44c6130c379cf845290b701dd9312e4114caf4b3a99f70e3e8e

SHA512
303911ea66cca532b57b5acd3565f13d3500760eda42bf90653154f482e7d640d0cd318c1f9fd97570dbe7b18cd533deee34b3d2416d4c588a9cabfe47d99777

Download Submit
memory/1000-96-0x0000000000000000-mapping.dmp

Download
memory/1000-102-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1000-100-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1000-98-0x0000000074041000-0x0000000074043000-memory.dmp

Filesize
8KB

Download
memory/1040-101-0x0000000000000000-mapping.dmp

Download
memory/1176-54-0x000007FEFB981000-0x000007FEFB983000-memory.dmp

Filesize
8KB

Download
memory/1708-76-0x0000000000000000-mapping.dmp

Download
memory/1740-90-0x0000000001F80000-0x00000000020E5000-memory.dmp

Filesize
1.4MB

Download
memory/1740-94-0x0000000000220000-0x000000000024D000-memory.dmp

Filesize
180KB

Download
memory/1740-95-0x00000000004A0000-0x00000000004C2000-memory.dmp

Filesize
136KB

Download
memory/1740-92-0x00000000004A0000-0x00000000004C2000-memory.dmp

Filesize
136KB

Download
memory/1740-93-0x00000000004A0000-0x00000000004C2000-memory.dmp

Filesize
136KB

Download
memory/1740-99-0x00000000004A0000-0x00000000004C2000-memory.dmp

Filesize
136KB

Download
memory/1740-91-0x00000000004A0000-0x00000000004C2000-memory.dmp

Filesize
136KB

Download
memory/1740-85-0x00000000759E1000-0x00000000759E3000-memory.dmp

Filesize
8KB

Download
memory/1740-84-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads