qakbot | 90d20295ce4953c7b479857a4d369025fd415dfeb71efecbff931c85764c3fd8

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2023, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e10d90f8e22f29a22f8657ca2064bdc1.dll
Size 573KB
Sample231220-tgps4aefar
SHA256 90d20295ce4953c7b479857a4d369025fd415dfeb71efecbff931c85764c3fd8
MD5 e10d90f8e22f29a22f8657ca2064bdc1
SHA1 aa5310d1e888dc200ea7c2e5feb31f6c572480c7
SHA512 38b04e19b620c7fdcd5d20f6d0583513650fe7f4e5290c04e0a8e322ff30e5aa986404b316fe99ffb5b152b34bf9dc9dcc2541d84c1c01c158f21409927e3d7e
SSDEEP 12288:C87H3sH2k/eG9A9tqKsuud0/l0pT7fEztxG9HBMbVNADirS:CSs7/RYtq4E3MzO9HoH4s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot obama107 1633078880 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama107

Campaign

1633078880

140.82.49.12:443
41.250.143.109:995
216.201.162.158:443
86.8.177.143:443
105.198.236.99:443
124.123.42.115:2222
217.17.56.163:443
37.210.152.224:995
190.198.206.189:2222
75.89.195.186:995
78.191.44.76:995
122.11.220.212:2222
68.186.192.69:443
159.2.51.200:2222
217.17.56.163:2222
217.17.56.163:2078
41.228.22.180:443
120.151.47.189:443
47.22.148.6:443
94.200.181.154:443
81.241.252.59:2078
76.25.142.196:443
89.101.97.139:443
217.17.56.163:0
185.250.148.74:443
174.54.58.170:443
73.130.180.25:443
73.52.50.32:443
174.59.35.191:443
181.118.183.94:443
120.150.218.241:995
73.230.205.91:443
174.54.193.186:443
136.232.34.70:443
71.74.12.34:443
95.77.223.148:443
103.148.120.144:443
75.188.35.168:443
39.52.213.1:995
45.46.53.140:2222
73.151.236.31:443
173.21.10.71:2222
24.34.58.116:443
62.23.194.38:443
62.23.194.41:995
47.40.196.233:2222
67.165.206.193:993
72.252.201.69:443
173.25.166.81:443
199.27.127.129:443
68.204.7.158:443
191.191.38.8:443
109.12.111.14:443
24.139.72.117:443
24.229.150.54:995
189.210.115.207:443
174.59.226.6:443
73.130.237.36:443
81.250.153.227:2222
69.253.197.100:443
174.59.242.9:443
177.130.82.197:2222
67.214.30.12:995
24.55.112.61:443
174.59.120.69:443
47.181.84.61:443
73.130.239.166:443
103.157.122.198:995
217.165.163.21:995
77.57.204.78:443
93.8.66.216:443
73.52.114.202:443
186.18.205.199:995
38.10.202.214:443
78.191.44.76:443
96.83.180.29:443
124.123.42.115:2078
105.159.144.186:995
27.223.92.142:995
109.190.253.11:2222
217.17.56.163:465
38.10.201.211:443
92.148.59.207:2222
92.157.171.41:2222
186.87.135.68:995
80.6.192.58:443
75.66.88.33:443
187.156.138.172:443
82.77.137.101:995
173.234.155.233:443
2.178.116.91:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2180	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2592	rundll32.exe
2592	rundll32.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2592	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 2592	4712	rundll32.exe	26
PID 4712 wrote to memory of 2592	4712	rundll32.exe	26
PID 4712 wrote to memory of 2592	4712	rundll32.exe	26
PID 2592 wrote to memory of 1092	2592	rundll32.exe	95
PID 2592 wrote to memory of 1092	2592	rundll32.exe	95
PID 2592 wrote to memory of 1092	2592	rundll32.exe	95
PID 2592 wrote to memory of 1092	2592	rundll32.exe	95
PID 2592 wrote to memory of 1092	2592	rundll32.exe	95
PID 1092 wrote to memory of 2180	1092	explorer.exe	98
PID 1092 wrote to memory of 2180	1092	explorer.exe	98
PID 1092 wrote to memory of 2180	1092	explorer.exe	98

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e10d90f8e22f29a22f8657ca2064bdc1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e10d90f8e22f29a22f8657ca2064bdc1.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pvsmxmz /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\e10d90f8e22f29a22f8657ca2064bdc1.dll\"" /SC ONCE /Z /ST 00:49 /ET 01:01
      4⤵
      Creates scheduled task(s)
      PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-7-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download

memory/1092-11-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download

memory/1092-12-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download

memory/1092-13-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download

memory/1092-15-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download

memory/2592-0-0x0000000074910000-0x00000000749B0000-memory.dmp

Download

memory/2592-2-0x0000000074910000-0x00000000749B0000-memory.dmp

Download

memory/2592-1-0x0000000074910000-0x00000000749B0000-memory.dmp

Download

memory/2592-4-0x00000000013B0000-0x00000000013B1000-memory.dmp

Download

memory/2592-6-0x0000000074910000-0x00000000749B0000-memory.dmp

Download