qakbot | 18df034ee69d675ce1b04b95569154f0e3fe41c8bd6a00e59e8dae24b41ed7f7

Resubmissions

31-10-2023 16:23

231031-tvvw9sba41 10

25-10-2023 22:14

231025-15mf7sha9z 10

Analysis

max time kernel
42s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
25-10-2023 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

old_unpacked_qbot.dll
Size

120KB
MD5

35927b301d9cd6c33a927b97dccf6266
SHA1

1ccb9ec68f0fd685a58b1b6d2e78ba3b878783da
SHA256

18df034ee69d675ce1b04b95569154f0e3fe41c8bd6a00e59e8dae24b41ed7f7
SHA512

0cbbe3dbc6fea05760801bb812a8eac2b981f55a45aa994112e822e9f8f6741ae5052bab25dd1ab29d65e4b05fe353a0c796b9f8c0ddc4d89a03c13da69e081b
SSDEEP

1536:DCEh82pWrjickOZol59ZJkCZuH6cYTUk8JrNZmwmIOvnToIfwsbuYkR:WH5r+ckl57J4HpYTaJBZfE/TBfwkuYk

Score

10^/10

qakbot obama125 1636625439 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama125

Campaign

1636625439

117.198.155.237:443

190.73.3.148:2222

63.143.92.99:995

216.238.71.31:443

216.238.72.121:995

216.238.71.31:995

216.238.72.121:443

105.198.236.99:995

136.232.34.70:443

41.37.243.129:443

140.82.49.12:443

71.13.93.154:2222

96.246.158.154:995

102.65.38.57:443

71.13.93.154:6881

123.252.190.14:443

45.9.20.200:2211

136.143.11.232:443

103.143.8.71:995

103.142.10.177:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exe

pid	Process
116	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid	Process
2728	regsvr32.exe
2728	regsvr32.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid	Process
2728	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exe

description	pid	Process	procid_target
PID 3740 wrote to memory of 2728	3740	regsvr32.exe	87
PID 3740 wrote to memory of 2728	3740	regsvr32.exe	87
PID 3740 wrote to memory of 2728	3740	regsvr32.exe	87
PID 2728 wrote to memory of 1336	2728	regsvr32.exe	91
PID 2728 wrote to memory of 1336	2728	regsvr32.exe	91
PID 2728 wrote to memory of 1336	2728	regsvr32.exe	91
PID 2728 wrote to memory of 1336	2728	regsvr32.exe	91
PID 2728 wrote to memory of 1336	2728	regsvr32.exe	91
PID 1336 wrote to memory of 116	1336	explorer.exe	93
PID 1336 wrote to memory of 116	1336	explorer.exe	93
PID 1336 wrote to memory of 116	1336	explorer.exe	93

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\old_unpacked_qbot.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\old_unpacked_qbot.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn miyhhsfvd /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\old_unpacked_qbot.dll\"" /SC ONCE /Z /ST 22:16 /ET 22:28
      4⤵
      Creates scheduled task(s)
      PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1336-0-0x0000000000E00000-0x0000000000E21000-memory.dmp

Filesize
132KB

Download
memory/1336-3-0x0000000000E00000-0x0000000000E21000-memory.dmp

Filesize
132KB

Download
memory/1336-4-0x0000000000E00000-0x0000000000E21000-memory.dmp

Filesize
132KB

Download
memory/1336-5-0x0000000000E00000-0x0000000000E21000-memory.dmp

Filesize
132KB

Download
memory/1336-7-0x0000000000E00000-0x0000000000E21000-memory.dmp

Filesize
132KB

Download