qakbot | a1b66e55154994c6c51ce9d8d258d7226e16446118d4941b8a357bf5039100cb

General

Target

00203 Dec 01.lnk
Size

955B
MD5

0de80f41a5cd33356cd00fb77e131d87
SHA1

69536b00f79c7edbbd093d1efd5ead9751e23991
SHA256

0d7cde36eea88e200ee81a96749d5338054af864851b01627a80bba73efc03ca
SHA512

2e596c3792e9a0f8a524c229bb300d3d66bfd15f75f4b0900019b503051ebd692e33ef68f807ac84daac89f3306e70c6b7d9f0c1fe93cb7a3585bcd019be78f5

Score

10^/10

qakbot obama224 1669794048 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

obama224

Campaign

1669794048

C2

75.161.233.194:995

216.82.134.218:443

174.104.184.149:443

173.18.126.3:443

87.202.101.164:50000

172.90.139.138:2222

184.153.132.82:443

185.135.120.81:443

24.228.132.224:2222

87.223.84.190:443

178.153.195.40:443

24.64.114.59:2222

77.126.81.208:443

75.99.125.235:2222

173.239.94.212:443

98.145.23.67:443

109.177.245.176:2222

72.200.109.104:443

12.172.173.82:993

82.11.242.219:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
1452	rundll32.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1452 rundll32.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

cmd.execmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 1380 wrote to memory of 1272	1380	cmd.exe	cmd.exe
PID 1380 wrote to memory of 1272	1380	cmd.exe	cmd.exe
PID 1380 wrote to memory of 1272	1380	cmd.exe	cmd.exe
PID 1272 wrote to memory of 276	1272	cmd.exe	rundll32.exe
PID 1272 wrote to memory of 276	1272	cmd.exe	rundll32.exe
PID 1272 wrote to memory of 276	1272	cmd.exe	rundll32.exe
PID 276 wrote to memory of 1452	276	rundll32.exe	rundll32.exe
PID 276 wrote to memory of 1452	276	rundll32.exe	rundll32.exe
PID 276 wrote to memory of 1452	276	rundll32.exe	rundll32.exe
PID 276 wrote to memory of 1452	276	rundll32.exe	rundll32.exe
PID 276 wrote to memory of 1452	276	rundll32.exe	rundll32.exe
PID 276 wrote to memory of 1452	276	rundll32.exe	rundll32.exe
PID 276 wrote to memory of 1452	276	rundll32.exe	rundll32.exe
PID 1452 wrote to memory of 984	1452	rundll32.exe	wermgr.exe
PID 1452 wrote to memory of 984	1452	rundll32.exe	wermgr.exe
PID 1452 wrote to memory of 984	1452	rundll32.exe	wermgr.exe
PID 1452 wrote to memory of 984	1452	rundll32.exe	wermgr.exe
PID 1452 wrote to memory of 984	1452	rundll32.exe	wermgr.exe
PID 1452 wrote to memory of 984	1452	rundll32.exe	wermgr.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\00203 Dec 01.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rundll32.exe 1099.dll,DrawThemeIcon
2⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\system32\rundll32.exe
rundll32.exe 1099.dll,DrawThemeIcon
3⤵
- Suspicious use of WriteProcessMemory
PID:276

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe 1099.dll,DrawThemeIcon
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:984

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/276-90-0x0000000000000000-mapping.dmp

Download
memory/984-99-0x0000000000000000-mapping.dmp

Download
memory/984-103-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/984-102-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/1272-88-0x0000000000000000-mapping.dmp

Download
memory/1380-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Filesize
8KB

Download
memory/1452-93-0x0000000000000000-mapping.dmp

Download
memory/1452-97-0x0000000000170000-0x000000000019D000-memory.dmp

Filesize
180KB

Download
memory/1452-98-0x0000000000250000-0x000000000027A000-memory.dmp

Filesize
168KB

Download
memory/1452-96-0x0000000000250000-0x000000000027A000-memory.dmp

Filesize
168KB

Download
memory/1452-101-0x0000000000250000-0x000000000027A000-memory.dmp

Filesize
168KB

Download
memory/1452-95-0x0000000000250000-0x000000000027A000-memory.dmp

Filesize
168KB

Download
memory/1452-94-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing