qakbot | 0203b8c110a6203e36104c8b5eebed9f901bb132ebe757646ed0dd94c45a7c97

General

Target

conjunction.dll
Size

374KB
MD5

e46f425cca0ffa4dc397bf4be3cb2c77
SHA1

f7cbd1b6aef9879281417c418720699b3978c51e
SHA256

0203b8c110a6203e36104c8b5eebed9f901bb132ebe757646ed0dd94c45a7c97
SHA512

2f08ae9a1f6a8ac9b8c7f5e1e98bded1c55af268285fec556c82dfbafee14eec3957b22cf903d2a610be889dc216d73776f2d28d2d01a58be06f585a092c8156
SSDEEP

6144:XKR66t98Uah1oq7PbQIIJSLiyCE0taaRIC6w/9IWFK+20m6WdMxgYURpi92H4X:w6E1YF7P01JSdCLjqa/9WNdMxgligH8

Score

10^/10

qakbot obama223 1668757345 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

obama223

Campaign

1668757345

C2

68.47.128.161:443

87.65.160.87:995

172.90.139.138:2222

86.175.128.143:443

12.172.173.82:465

71.247.10.63:2083

47.41.154.250:443

91.254.215.167:443

71.31.101.183:443

81.229.117.95:2222

24.4.239.157:443

41.99.177.175:443

92.149.205.238:2222

73.230.28.7:443

47.229.96.60:443

186.188.2.193:443

174.112.25.29:2078

84.35.26.14:995

86.130.9.167:2222

116.74.163.221:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

288 net.exe
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exenetstat.exe

pid process

1512 ipconfig.exe
1992 netstat.exe
Runs net.exe

pid	process
288	net.exe

pid	process
1512	ipconfig.exe
1992	netstat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exewermgr.exe

pid	process
636	regsvr32.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe
592	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

636 regsvr32.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

Processes:

netstat.exewhoami.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1992	netstat.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeDebugPrivilege	1936	whoami.exe
Token: SeRestorePrivilege	672	msiexec.exe
Token: SeTakeOwnershipPrivilege	672	msiexec.exe
Token: SeSecurityPrivilege	672	msiexec.exe

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

regsvr32.exeregsvr32.exewermgr.exenet.exenet.exe

description	pid	process	target process
PID 1736 wrote to memory of 636	1736	regsvr32.exe	regsvr32.exe
PID 1736 wrote to memory of 636	1736	regsvr32.exe	regsvr32.exe
PID 1736 wrote to memory of 636	1736	regsvr32.exe	regsvr32.exe
PID 1736 wrote to memory of 636	1736	regsvr32.exe	regsvr32.exe
PID 1736 wrote to memory of 636	1736	regsvr32.exe	regsvr32.exe
PID 1736 wrote to memory of 636	1736	regsvr32.exe	regsvr32.exe
PID 1736 wrote to memory of 636	1736	regsvr32.exe	regsvr32.exe
PID 636 wrote to memory of 592	636	regsvr32.exe	wermgr.exe
PID 636 wrote to memory of 592	636	regsvr32.exe	wermgr.exe
PID 636 wrote to memory of 592	636	regsvr32.exe	wermgr.exe
PID 636 wrote to memory of 592	636	regsvr32.exe	wermgr.exe
PID 636 wrote to memory of 592	636	regsvr32.exe	wermgr.exe
PID 636 wrote to memory of 592	636	regsvr32.exe	wermgr.exe
PID 592 wrote to memory of 288	592	wermgr.exe	net.exe
PID 592 wrote to memory of 288	592	wermgr.exe	net.exe
PID 592 wrote to memory of 288	592	wermgr.exe	net.exe
PID 592 wrote to memory of 288	592	wermgr.exe	net.exe
PID 592 wrote to memory of 1384	592	wermgr.exe	cmd.exe
PID 592 wrote to memory of 1384	592	wermgr.exe	cmd.exe
PID 592 wrote to memory of 1384	592	wermgr.exe	cmd.exe
PID 592 wrote to memory of 1384	592	wermgr.exe	cmd.exe
PID 592 wrote to memory of 872	592	wermgr.exe	arp.exe
PID 592 wrote to memory of 872	592	wermgr.exe	arp.exe
PID 592 wrote to memory of 872	592	wermgr.exe	arp.exe
PID 592 wrote to memory of 872	592	wermgr.exe	arp.exe
PID 592 wrote to memory of 1512	592	wermgr.exe	ipconfig.exe
PID 592 wrote to memory of 1512	592	wermgr.exe	ipconfig.exe
PID 592 wrote to memory of 1512	592	wermgr.exe	ipconfig.exe
PID 592 wrote to memory of 1512	592	wermgr.exe	ipconfig.exe
PID 592 wrote to memory of 1148	592	wermgr.exe	nslookup.exe
PID 592 wrote to memory of 1148	592	wermgr.exe	nslookup.exe
PID 592 wrote to memory of 1148	592	wermgr.exe	nslookup.exe
PID 592 wrote to memory of 1148	592	wermgr.exe	nslookup.exe
PID 592 wrote to memory of 2024	592	wermgr.exe	net.exe
PID 592 wrote to memory of 2024	592	wermgr.exe	net.exe
PID 592 wrote to memory of 2024	592	wermgr.exe	net.exe
PID 592 wrote to memory of 2024	592	wermgr.exe	net.exe
PID 2024 wrote to memory of 956	2024	net.exe	net1.exe
PID 2024 wrote to memory of 956	2024	net.exe	net1.exe
PID 2024 wrote to memory of 956	2024	net.exe	net1.exe
PID 2024 wrote to memory of 956	2024	net.exe	net1.exe
PID 592 wrote to memory of 1944	592	wermgr.exe	route.exe
PID 592 wrote to memory of 1944	592	wermgr.exe	route.exe
PID 592 wrote to memory of 1944	592	wermgr.exe	route.exe
PID 592 wrote to memory of 1944	592	wermgr.exe	route.exe
PID 592 wrote to memory of 1992	592	wermgr.exe	netstat.exe
PID 592 wrote to memory of 1992	592	wermgr.exe	netstat.exe
PID 592 wrote to memory of 1992	592	wermgr.exe	netstat.exe
PID 592 wrote to memory of 1992	592	wermgr.exe	netstat.exe
PID 592 wrote to memory of 432	592	wermgr.exe	net.exe
PID 592 wrote to memory of 432	592	wermgr.exe	net.exe
PID 592 wrote to memory of 432	592	wermgr.exe	net.exe
PID 592 wrote to memory of 432	592	wermgr.exe	net.exe
PID 432 wrote to memory of 1368	432	net.exe	net1.exe
PID 432 wrote to memory of 1368	432	net.exe	net1.exe
PID 432 wrote to memory of 1368	432	net.exe	net1.exe
PID 432 wrote to memory of 1368	432	net.exe	net1.exe
PID 592 wrote to memory of 1936	592	wermgr.exe	whoami.exe
PID 592 wrote to memory of 1936	592	wermgr.exe	whoami.exe
PID 592 wrote to memory of 1936	592	wermgr.exe	whoami.exe
PID 592 wrote to memory of 1936	592	wermgr.exe	whoami.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\conjunction.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\conjunction.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:592
  - - C:\Windows\SysWOW64\net.exe
      net view
      4⤵
      Discovers systems in the same network
      PID:288
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c set
      4⤵
      PID:1384
  - - C:\Windows\SysWOW64\arp.exe
      arp -a
      4⤵
      PID:872
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1512
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.WORKGROUP
      4⤵
      PID:1148
  - - C:\Windows\SysWOW64\net.exe
      net share
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2024
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        
        PID:956
  - - C:\Windows\SysWOW64\route.exe
      route print
      4⤵
      PID:1944
  - - C:\Windows\SysWOW64\netstat.exe
      netstat -nao
      4⤵
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:1992
  - - C:\Windows\SysWOW64\net.exe
      net localgroup
      4⤵
      Suspicious use of WriteProcessMemory
      PID:432
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:1368
  - - C:\Windows\SysWOW64\whoami.exe
      whoami /all
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1936

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\PIPE\samr

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/288-66-0x0000000000000000-mapping.dmp

Download
memory/432-76-0x0000000000000000-mapping.dmp

Download
memory/592-61-0x0000000000000000-mapping.dmp

Download
memory/592-65-0x00000000000E0000-0x000000000010A000-memory.dmp

Filesize
168KB

Download
memory/592-64-0x00000000000E0000-0x000000000010A000-memory.dmp

Filesize
168KB

Download
memory/636-58-0x0000000000180000-0x00000000001AA000-memory.dmp

Filesize
168KB

Download
memory/636-60-0x0000000000180000-0x00000000001AA000-memory.dmp

Filesize
168KB

Download
memory/636-63-0x0000000000180000-0x00000000001AA000-memory.dmp

Filesize
168KB

Download
memory/636-59-0x0000000000150000-0x000000000017E000-memory.dmp

Filesize
184KB

Download
memory/636-57-0x0000000000180000-0x00000000001AA000-memory.dmp

Filesize
168KB

Download
memory/636-56-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/636-55-0x0000000000000000-mapping.dmp

Download
memory/872-68-0x0000000000000000-mapping.dmp

Download
memory/956-73-0x0000000000000000-mapping.dmp

Download
memory/1148-71-0x0000000000000000-mapping.dmp

Download
memory/1368-77-0x0000000000000000-mapping.dmp

Download
memory/1384-67-0x0000000000000000-mapping.dmp

Download
memory/1512-69-0x0000000000000000-mapping.dmp

Download
memory/1736-54-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmp

Filesize
8KB

Download
memory/1936-79-0x0000000000000000-mapping.dmp

Download
memory/1944-74-0x0000000000000000-mapping.dmp

Download
memory/1992-75-0x0000000000000000-mapping.dmp

Download
memory/2024-72-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads