qakbot | 1e76b010505c5831c2153bed026f79467984c1c633bb8ef3f3788fc7a26f24e4

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2023, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
62a41c2d1cec79061e66ae0394e82205.dll
Size 825KB
Sample231219-vec7ysbea6
SHA256 1e76b010505c5831c2153bed026f79467984c1c633bb8ef3f3788fc7a26f24e4
MD5 62a41c2d1cec79061e66ae0394e82205
SHA1 20e3187e1e6f57eb9c71ac1ca791cccc83f2b503
SHA512 67ebd32f13a151744f999686ad4b9b0c6b48165ae7b4776a391e26615977092a9024b22795a019dbfaf188d585a1792ee49d242073124e1e51f08e28b1773897
SSDEEP 24576:YsjCOuBER57hemWxOVCy632yHAMnbOMmpK6kMXL9vM+GGVdrhD/lIF:Yyr57hemWxOVCytCrbxmpvXB0+XVd9DO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot obama111 1633590450 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama111

Campaign

1633590450

37.210.152.224:995
201.93.111.2:995
202.134.178.157:443
89.101.97.139:443
73.52.50.32:443
188.55.235.110:995
27.223.92.142:995
181.118.183.94:443
136.232.34.70:443
186.32.163.199:443
72.173.78.211:443
76.25.142.196:443
120.150.218.241:995
185.250.148.74:443
89.137.52.44:443
66.103.170.104:2222
188.50.169.158:443
174.54.193.186:443
103.148.120.144:443
140.82.49.12:443
216.201.162.158:443
73.230.205.91:443
200.232.214.222:995
103.142.10.177:443
45.46.53.140:2222
124.123.42.115:2222
74.72.237.54:443
41.228.22.180:443
209.142.97.161:995
122.11.220.212:2222
78.191.58.219:995
94.200.181.154:443
47.22.148.6:443
96.57.188.174:2078
68.13.157.69:0
209.50.20.255:443
98.157.235.126:443
173.21.10.71:2222
73.151.236.31:443
71.74.12.34:443
199.27.127.129:443
75.75.179.226:443
167.248.117.81:443
67.165.206.193:993
47.40.196.233:2222
72.252.201.69:443
86.8.177.143:443
181.4.53.6:465
109.12.111.14:443
24.171.50.5:443
24.139.72.117:443
24.55.112.61:443
24.229.150.54:995
77.57.204.78:443
81.250.153.227:2222
49.33.237.65:443
66.177.215.152:50010
177.170.201.134:995
75.188.35.168:443
2.222.167.138:443
120.151.47.189:443
81.241.252.59:2078
173.25.162.221:443
201.6.246.227:995
66.177.215.152:443
217.17.56.163:2222
202.165.32.158:2222
39.52.229.8:995
42.60.70.14:443
73.140.38.124:443
167.248.100.227:443
63.70.164.200:443
69.30.186.190:443
189.131.221.201:443
68.204.7.158:443
181.84.114.46:443
167.248.99.149:443
177.94.21.110:995
50.54.32.149:443
189.224.181.39:443
24.119.214.7:443
63.70.164.200:995
177.94.125.59:995
82.18.173.253:2222
73.130.180.25:443
217.17.56.163:2078
162.244.227.34:443
75.66.88.33:443
206.47.134.234:2222
167.248.54.34:2222
73.77.87.137:443
181.4.53.6:443
190.198.206.189:2222
167.248.111.245:443
96.46.103.226:443
73.25.124.140:2222
24.152.219.253:995
68.186.192.69:443
162.210.220.137:443
174.54.58.170:443
103.246.130.114:1194
103.246.130.35:21
103.246.130.2:20
103.246.130.122:20
105.198.236.99:443
103.157.122.198:995
4.34.193.180:995
159.2.51.200:2222
110.174.64.179:995
187.101.25.96:32100
76.84.230.103:443
174.59.35.191:443
173.63.245.129:443
68.117.229.117:443
75.163.81.130:995
76.84.32.159:443
147.92.51.49:443
76.84.226.17:443
68.13.157.69:443
167.248.126.223:443
72.196.22.184:443
98.22.92.139:995
97.98.130.50:443
196.117.224.53:995
191.191.38.8:443
188.210.210.122:443
96.46.103.109:2222
37.117.191.19:2222
197.90.137.161:61201
24.32.174.175:443
76.84.225.21:443
78.145.153.73:995
69.30.190.105:995
167.248.81.60:443
69.80.113.148:443
217.17.56.163:443
62.23.194.38:443
62.23.194.41:995
189.210.115.207:443
174.59.226.6:443
73.130.237.36:443
69.253.197.100:443
174.59.242.9:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Loads dropped DLL 1 IoCs

pid	Process
2908	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1780	rundll32.exe
1780	rundll32.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1780	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 1780	4460	rundll32.exe	89
PID 4460 wrote to memory of 1780	4460	rundll32.exe	89
PID 4460 wrote to memory of 1780	4460	rundll32.exe	89
PID 1780 wrote to memory of 208	1780	rundll32.exe	96
PID 1780 wrote to memory of 208	1780	rundll32.exe	96
PID 1780 wrote to memory of 208	1780	rundll32.exe	96
PID 1780 wrote to memory of 208	1780	rundll32.exe	96
PID 1780 wrote to memory of 208	1780	rundll32.exe	96
PID 208 wrote to memory of 2108	208	explorer.exe	97
PID 208 wrote to memory of 2108	208	explorer.exe	97
PID 208 wrote to memory of 2108	208	explorer.exe	97
PID 1156 wrote to memory of 2908	1156	regsvr32.exe	100
PID 1156 wrote to memory of 2908	1156	regsvr32.exe	100
PID 1156 wrote to memory of 2908	1156	regsvr32.exe	100

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62a41c2d1cec79061e66ae0394e82205.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62a41c2d1cec79061e66ae0394e82205.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ojqlqrsiek /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\62a41c2d1cec79061e66ae0394e82205.dll\"" /SC ONCE /Z /ST 20:45 /ET 20:57
      4⤵
      Creates scheduled task(s)
      PID:2108

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\62a41c2d1cec79061e66ae0394e82205.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\62a41c2d1cec79061e66ae0394e82205.dll"
  2⤵
  - Loads dropped DLL
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

62a41c2d1cec79061e66ae0394e82205.dll

Path C:\Users\Admin\AppData\Local\Temp\62a41c2d1cec79061e66ae0394e82205.dll
Size 825KB
SHA256 1e76b010505c5831c2153bed026f79467984c1c633bb8ef3f3788fc7a26f24e4
MD5 62a41c2d1cec79061e66ae0394e82205
SHA1 20e3187e1e6f57eb9c71ac1ca791cccc83f2b503
SHA512 67ebd32f13a151744f999686ad4b9b0c6b48165ae7b4776a391e26615977092a9024b22795a019dbfaf188d585a1792ee49d242073124e1e51f08e28b1773897
SSDEEP 24576:YsjCOuBER57hemWxOVCy632yHAMnbOMmpK6kMXL9vM+GGVdrhD/lIF:Yyr57hemWxOVCytCrbxmpvXB0+XVd9DO
MD5 SHA1 SHA512 SSDEEP

Submit Download

62a41c2d1cec79061e66ae0394e82205.dll

Path C:\Users\Admin\AppData\Local\Temp\62a41c2d1cec79061e66ae0394e82205.dll
Size 662KB
SHA256 10e78d93280cb03b1e5c50f2e963f9c57758edf2e50708c94c466890ca9b1273
MD5 f72d97f7f97449ef6a87f395f1880e2f
SHA1 c0b8c3efac3882737e4050afc1675eccb8052d94
SHA512 90b3ef168aace95b8021e2e79f6a5dcedfe7206e26b32f5714a85f0438c2f7b7cfc48547f05e1d86ae96444a4a36a7dce2aa8e328d6e4c55db821611356cd200
SSDEEP 12288:Yczf1lCOM80FnER57hemWxOVCy632yx1AMn8i/ZdaCPbQ1PToPepK6ESwzweab9j:YsjCOuBER57hemWxOVCy632yHAMnbOMY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-7-0x0000000001240000-0x0000000001261000-memory.dmp

Download

memory/208-10-0x0000000001240000-0x0000000001261000-memory.dmp

Download

memory/208-11-0x0000000001240000-0x0000000001261000-memory.dmp

Download

memory/208-12-0x0000000001240000-0x0000000001261000-memory.dmp

Download

memory/208-14-0x0000000001240000-0x0000000001261000-memory.dmp

Download

memory/1780-0-0x0000000074F50000-0x00000000750C0000-memory.dmp

Download

memory/1780-1-0x0000000074F50000-0x00000000750C0000-memory.dmp

Download

memory/1780-3-0x0000000074F50000-0x00000000750C0000-memory.dmp

Download

memory/1780-2-0x0000000000900000-0x0000000000901000-memory.dmp

Download

memory/1780-5-0x0000000074F50000-0x00000000750C0000-memory.dmp

Download