qakbot | 0203b8c110a6203e36104c8b5eebed9f901bb132ebe757646ed0dd94c45a7c97

Analysis

max time kernel
1199s
max time network
1197s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
18-11-2022 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

conjunction.dll
Size

374KB
MD5

e46f425cca0ffa4dc397bf4be3cb2c77
SHA1

f7cbd1b6aef9879281417c418720699b3978c51e
SHA256

0203b8c110a6203e36104c8b5eebed9f901bb132ebe757646ed0dd94c45a7c97
SHA512

2f08ae9a1f6a8ac9b8c7f5e1e98bded1c55af268285fec556c82dfbafee14eec3957b22cf903d2a610be889dc216d73776f2d28d2d01a58be06f585a092c8156
SSDEEP

6144:XKR66t98Uah1oq7PbQIIJSLiyCE0taaRIC6w/9IWFK+20m6WdMxgYURpi92H4X:w6E1YF7P01JSdCLjqa/9WNdMxgligH8

Score

10^/10

qakbot obama223 1668757345 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

obama223

Campaign

1668757345

68.47.128.161:443

87.65.160.87:995

172.90.139.138:2222

86.175.128.143:443

12.172.173.82:465

71.247.10.63:2083

47.41.154.250:443

91.254.215.167:443

71.31.101.183:443

81.229.117.95:2222

24.4.239.157:443

41.99.177.175:443

92.149.205.238:2222

73.230.28.7:443

47.229.96.60:443

186.188.2.193:443

174.112.25.29:2078

84.35.26.14:995

86.130.9.167:2222

116.74.163.221:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

3892 net.exe
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

netstat.exeipconfig.exe

pid process

2488 netstat.exe
2808 ipconfig.exe
Runs net.exe

pid	process
3892	net.exe

pid	process
2488	netstat.exe
2808	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exewermgr.exe

pid	process
4776	regsvr32.exe
4776	regsvr32.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe
4896	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

4776 regsvr32.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes:

netstat.exewhoami.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	2488	netstat.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeDebugPrivilege	4812	whoami.exe
Token: SeSecurityPrivilege	2896	msiexec.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

regsvr32.exeregsvr32.exewermgr.exenet.exenet.exe

description	pid	process	target process
PID 1892 wrote to memory of 4776	1892	regsvr32.exe	regsvr32.exe
PID 1892 wrote to memory of 4776	1892	regsvr32.exe	regsvr32.exe
PID 1892 wrote to memory of 4776	1892	regsvr32.exe	regsvr32.exe
PID 4776 wrote to memory of 4896	4776	regsvr32.exe	wermgr.exe
PID 4776 wrote to memory of 4896	4776	regsvr32.exe	wermgr.exe
PID 4776 wrote to memory of 4896	4776	regsvr32.exe	wermgr.exe
PID 4776 wrote to memory of 4896	4776	regsvr32.exe	wermgr.exe
PID 4776 wrote to memory of 4896	4776	regsvr32.exe	wermgr.exe
PID 4896 wrote to memory of 3892	4896	wermgr.exe	net.exe
PID 4896 wrote to memory of 3892	4896	wermgr.exe	net.exe
PID 4896 wrote to memory of 3892	4896	wermgr.exe	net.exe
PID 4896 wrote to memory of 5076	4896	wermgr.exe	cmd.exe
PID 4896 wrote to memory of 5076	4896	wermgr.exe	cmd.exe
PID 4896 wrote to memory of 5076	4896	wermgr.exe	cmd.exe
PID 4896 wrote to memory of 5080	4896	wermgr.exe	arp.exe
PID 4896 wrote to memory of 5080	4896	wermgr.exe	arp.exe
PID 4896 wrote to memory of 5080	4896	wermgr.exe	arp.exe
PID 4896 wrote to memory of 2808	4896	wermgr.exe	ipconfig.exe
PID 4896 wrote to memory of 2808	4896	wermgr.exe	ipconfig.exe
PID 4896 wrote to memory of 2808	4896	wermgr.exe	ipconfig.exe
PID 4896 wrote to memory of 4456	4896	wermgr.exe	nslookup.exe
PID 4896 wrote to memory of 4456	4896	wermgr.exe	nslookup.exe
PID 4896 wrote to memory of 4456	4896	wermgr.exe	nslookup.exe
PID 4896 wrote to memory of 1124	4896	wermgr.exe	net.exe
PID 4896 wrote to memory of 1124	4896	wermgr.exe	net.exe
PID 4896 wrote to memory of 1124	4896	wermgr.exe	net.exe
PID 1124 wrote to memory of 3328	1124	net.exe	net1.exe
PID 1124 wrote to memory of 3328	1124	net.exe	net1.exe
PID 1124 wrote to memory of 3328	1124	net.exe	net1.exe
PID 4896 wrote to memory of 1812	4896	wermgr.exe	route.exe
PID 4896 wrote to memory of 1812	4896	wermgr.exe	route.exe
PID 4896 wrote to memory of 1812	4896	wermgr.exe	route.exe
PID 4896 wrote to memory of 2488	4896	wermgr.exe	netstat.exe
PID 4896 wrote to memory of 2488	4896	wermgr.exe	netstat.exe
PID 4896 wrote to memory of 2488	4896	wermgr.exe	netstat.exe
PID 4896 wrote to memory of 1388	4896	wermgr.exe	net.exe
PID 4896 wrote to memory of 1388	4896	wermgr.exe	net.exe
PID 4896 wrote to memory of 1388	4896	wermgr.exe	net.exe
PID 1388 wrote to memory of 2116	1388	net.exe	net1.exe
PID 1388 wrote to memory of 2116	1388	net.exe	net1.exe
PID 1388 wrote to memory of 2116	1388	net.exe	net1.exe
PID 4896 wrote to memory of 4812	4896	wermgr.exe	whoami.exe
PID 4896 wrote to memory of 4812	4896	wermgr.exe	whoami.exe
PID 4896 wrote to memory of 4812	4896	wermgr.exe	whoami.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\conjunction.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\conjunction.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\Windows\SysWOW64\net.exe
      net view
      4⤵
      Discovers systems in the same network
      PID:3892
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c set
      4⤵
      PID:5076
  - - C:\Windows\SysWOW64\arp.exe
      arp -a
      4⤵
      PID:5080
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:2808
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.WORKGROUP
      4⤵
      PID:4456
  - - C:\Windows\SysWOW64\net.exe
      net share
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1124
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        
        PID:3328
  - - C:\Windows\SysWOW64\route.exe
      route print
      4⤵
      PID:1812
  - - C:\Windows\SysWOW64\netstat.exe
      netstat -nao
      4⤵
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:2488
  - - C:\Windows\SysWOW64\net.exe
      net localgroup
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1388
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:2116
  - - C:\Windows\SysWOW64\whoami.exe
      whoami /all
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4812

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-356-0x0000000000000000-mapping.dmp

Download
memory/1388-432-0x0000000000000000-mapping.dmp

Download
memory/1812-396-0x0000000000000000-mapping.dmp

Download
memory/2116-452-0x0000000000000000-mapping.dmp

Download
memory/2488-412-0x0000000000000000-mapping.dmp

Download
memory/2808-307-0x0000000000000000-mapping.dmp

Download
memory/3328-376-0x0000000000000000-mapping.dmp

Download
memory/3892-260-0x0000000000000000-mapping.dmp

Download
memory/4456-325-0x0000000000000000-mapping.dmp

Download
memory/4776-145-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-153-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-125-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-126-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-128-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-127-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-129-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-130-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-131-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-132-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-133-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-134-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-135-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-136-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-137-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-138-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-140-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-141-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-142-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-144-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-146-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-148-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-150-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-152-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-154-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-156-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-155-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-161-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-151-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-149-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-147-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-123-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-143-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-139-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-157-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-158-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-160-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-124-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-159-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-162-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-163-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-164-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-166-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-167-0x0000000000580000-0x00000000006CA000-memory.dmp

Filesize
1.3MB

Download
memory/4776-165-0x0000000000580000-0x00000000006CA000-memory.dmp

Filesize
1.3MB

Download
memory/4776-168-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-169-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-212-0x0000000000580000-0x0000000000584000-memory.dmp

Filesize
16KB

Download
memory/4776-118-0x0000000000000000-mapping.dmp

Download
memory/4776-119-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-120-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-121-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4776-122-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-473-0x0000000000000000-mapping.dmp

Download
memory/4896-175-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4896-178-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4896-179-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4896-180-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4896-181-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4896-182-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4896-183-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4896-184-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4896-177-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4896-185-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4896-228-0x00000000028A0000-0x00000000028CA000-memory.dmp

Filesize
168KB

Download
memory/4896-174-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4896-173-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4896-172-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4896-171-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4896-170-0x0000000000000000-mapping.dmp

Download
memory/4896-176-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4896-229-0x00000000028A0000-0x00000000028CA000-memory.dmp

Filesize
168KB

Download
memory/5076-283-0x0000000000000000-mapping.dmp

Download
memory/5080-289-0x0000000000000000-mapping.dmp

Download