qakbot | acaf0b60acb73370b7ebf96ecbfd947da545dda84413333ca918cb46cca87f7e

General

Target

acaf0b60acb73370b7ebf96ecbfd947da545dda84413333ca918cb46cca87f7e.dll
Size

255KB
MD5

056ae65f93e17decca62525ac9067970
SHA1

fbefcf270c61e7108d1e5b6124d299c741ea6acf
SHA256

acaf0b60acb73370b7ebf96ecbfd947da545dda84413333ca918cb46cca87f7e
SHA512

73f58f97d3563bd3775884ae88c00254f469ce49177a32866d3f341ed2857ba55bd2aba4d4f816c7fa5c2000833a1b11340f25cc77a305b9f8cf4257a105f7a1

Score

10^/10

qakbot abc101 1606294013 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

abc101

Campaign

1606294013

C2

98.115.243.237:443

78.101.21.73:443

185.163.221.77:2222

2.51.246.190:995

2.50.2.11:995

175.137.79.81:443

42.201.228.106:995

185.246.9.69:995

81.133.234.36:2222

24.205.42.241:443

73.239.229.107:995

102.185.58.126:443

173.245.152.231:443

105.101.216.210:443

89.137.195.167:995

174.76.21.134:443

41.238.217.126:6881

47.138.204.19:443

79.166.83.103:2222

92.154.83.96:1194

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1520 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3828 1520 WerFault.exe regsvr32.exe

pid	process
1520	regsvr32.exe

pid	pid_target	process	target process
3828	1520	WerFault.exe	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	rundll32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2388 schtasks.exe

pid	process
2388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
1192	rundll32.exe
1192	rundll32.exe
1192	rundll32.exe
1192	rundll32.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1192 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3828 WerFault.exe
Token: SeBackupPrivilege 3828 WerFault.exe
Token: SeDebugPrivilege 3828 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3828	WerFault.exe
Token: SeBackupPrivilege	3828	WerFault.exe
Token: SeDebugPrivilege	3828	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 1080 wrote to memory of 1192	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 1192	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 1192	1080	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 2876	1192	rundll32.exe	explorer.exe
PID 1192 wrote to memory of 2876	1192	rundll32.exe	explorer.exe
PID 1192 wrote to memory of 2876	1192	rundll32.exe	explorer.exe
PID 1192 wrote to memory of 2876	1192	rundll32.exe	explorer.exe
PID 1192 wrote to memory of 2876	1192	rundll32.exe	explorer.exe
PID 2876 wrote to memory of 2388	2876	explorer.exe	schtasks.exe
PID 2876 wrote to memory of 2388	2876	explorer.exe	schtasks.exe
PID 2876 wrote to memory of 2388	2876	explorer.exe	schtasks.exe
PID 3632 wrote to memory of 1520	3632	regsvr32.exe	regsvr32.exe
PID 3632 wrote to memory of 1520	3632	regsvr32.exe	regsvr32.exe
PID 3632 wrote to memory of 1520	3632	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\acaf0b60acb73370b7ebf96ecbfd947da545dda84413333ca918cb46cca87f7e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\acaf0b60acb73370b7ebf96ecbfd947da545dda84413333ca918cb46cca87f7e.dll,#1
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2876

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jnzawmsc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\acaf0b60acb73370b7ebf96ecbfd947da545dda84413333ca918cb46cca87f7e.dll\"" /SC ONCE /Z /ST 19:47 /ET 19:59
4⤵
- Creates scheduled task(s)
PID:2388

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\acaf0b60acb73370b7ebf96ecbfd947da545dda84413333ca918cb46cca87f7e.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3632

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\acaf0b60acb73370b7ebf96ecbfd947da545dda84413333ca918cb46cca87f7e.dll"
2⤵
- Loads dropped DLL
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 596
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3828

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\acaf0b60acb73370b7ebf96ecbfd947da545dda84413333ca918cb46cca87f7e.dll
MD5
7537365ab5b7bb779ab18e3928825231

SHA1
46eea40b113f911f8dbe0ca08c8355dfbad7aacb

SHA256
14fbcfef745fc1766264a80623f22aefa365a292703a96446f72b9602d383a48

SHA512
c4cf872c83e19c470c07b7c9e977ca5242f6f62d1f42fec02a04b06b7189bf1b4796bbc21c20346e06ffa4501247584ada80f172ee5dc5d58f929dc2e8ff089a

Download Submit
\Users\Admin\AppData\Local\Temp\acaf0b60acb73370b7ebf96ecbfd947da545dda84413333ca918cb46cca87f7e.dll
MD5
7537365ab5b7bb779ab18e3928825231

SHA1
46eea40b113f911f8dbe0ca08c8355dfbad7aacb

SHA256
14fbcfef745fc1766264a80623f22aefa365a292703a96446f72b9602d383a48

SHA512
c4cf872c83e19c470c07b7c9e977ca5242f6f62d1f42fec02a04b06b7189bf1b4796bbc21c20346e06ffa4501247584ada80f172ee5dc5d58f929dc2e8ff089a

Download Submit
memory/1192-0-0x0000000000000000-mapping.dmp

Download
memory/1192-1-0x00000000009E0000-0x0000000000A00000-memory.dmp

Filesize
128KB

Download
memory/1520-6-0x0000000000000000-mapping.dmp

Download
memory/1520-9-0x0000000000000000-mapping.dmp

Download
memory/2388-3-0x0000000000000000-mapping.dmp

Download
memory/2876-2-0x0000000000000000-mapping.dmp

Download
memory/2876-4-0x0000000003700000-0x0000000003720000-memory.dmp

Filesize
128KB

Download
memory/3828-8-0x0000000003320000-0x0000000003321000-memory.dmp

Filesize
4KB

Download
memory/3828-10-0x0000000003CA0000-0x0000000003CA1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads