qakbot | 844f2588bf76fe8d569615b68eb3aaac049d744d476a0f575a2e577bea67c90e

General

Target

06917 Dec 01.lnk
Size

953B
MD5

9ffcb1e433c7e487898866ad9b514dac
SHA1

ecfef94f8895dbf4771a2e812a7b9da4fc4a96c1
SHA256

3dd7a3b704f58ba8f2028e246d48868d9937a8bb550a310dbaa7b3a5d62a1e7b
SHA512

f658eeb0a424dd44b61012050bfc36d9d039a8ef994fa7c0d308ea72bfc27b3f8ef4a4d01c24d415c14360d2f825afd2124dbf7757bec18cdd92c04801985b39

Score

10^/10

qakbot obama224 1669794048 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

obama224

Campaign

1669794048

C2

75.161.233.194:995

216.82.134.218:443

174.104.184.149:443

173.18.126.3:443

87.202.101.164:50000

172.90.139.138:2222

184.153.132.82:443

185.135.120.81:443

24.228.132.224:2222

87.223.84.190:443

178.153.195.40:443

24.64.114.59:2222

77.126.81.208:443

75.99.125.235:2222

173.239.94.212:443

98.145.23.67:443

109.177.245.176:2222

72.200.109.104:443

12.172.173.82:993

82.11.242.219:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
996	rundll32.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe
1504	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

996 rundll32.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

cmd.execmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 1976 wrote to memory of 1872	1976	cmd.exe	cmd.exe
PID 1976 wrote to memory of 1872	1976	cmd.exe	cmd.exe
PID 1976 wrote to memory of 1872	1976	cmd.exe	cmd.exe
PID 1872 wrote to memory of 1740	1872	cmd.exe	rundll32.exe
PID 1872 wrote to memory of 1740	1872	cmd.exe	rundll32.exe
PID 1872 wrote to memory of 1740	1872	cmd.exe	rundll32.exe
PID 1740 wrote to memory of 996	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 996	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 996	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 996	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 996	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 996	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 996	1740	rundll32.exe	rundll32.exe
PID 996 wrote to memory of 1504	996	rundll32.exe	wermgr.exe
PID 996 wrote to memory of 1504	996	rundll32.exe	wermgr.exe
PID 996 wrote to memory of 1504	996	rundll32.exe	wermgr.exe
PID 996 wrote to memory of 1504	996	rundll32.exe	wermgr.exe
PID 996 wrote to memory of 1504	996	rundll32.exe	wermgr.exe
PID 996 wrote to memory of 1504	996	rundll32.exe	wermgr.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\06917 Dec 01.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rundll32.exe 322.dll,DrawThemeIcon
2⤵
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\system32\rundll32.exe
rundll32.exe 322.dll,DrawThemeIcon
3⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe 322.dll,DrawThemeIcon
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1504

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/996-96-0x00000000001F0000-0x000000000021A000-memory.dmp

Filesize
168KB

Download
memory/996-90-0x0000000000000000-mapping.dmp

Download
memory/996-91-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/996-95-0x00000000001F0000-0x000000000021A000-memory.dmp

Filesize
168KB

Download
memory/996-97-0x00000000000B0000-0x00000000000DD000-memory.dmp

Filesize
180KB

Download
memory/996-98-0x00000000001F0000-0x000000000021A000-memory.dmp

Filesize
168KB

Download
memory/996-101-0x00000000001F0000-0x000000000021A000-memory.dmp

Filesize
168KB

Download
memory/1504-99-0x0000000000000000-mapping.dmp

Download
memory/1504-102-0x00000000000C0000-0x00000000000EA000-memory.dmp

Filesize
168KB

Download
memory/1504-103-0x00000000000C0000-0x00000000000EA000-memory.dmp

Filesize
168KB

Download
memory/1740-89-0x0000000000000000-mapping.dmp

Download
memory/1872-88-0x0000000000000000-mapping.dmp

Download
memory/1976-54-0x000007FEFC161000-0x000007FEFC163000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing