qakbot | f0e89069b78233ed90b2760d5909a7bde373b6787372770a443ba43bcc0b16e4

General

Target

f0e89069b78233ed90b2760d5909a7bde373b6787372770a443ba43bcc0b16e4.dll
Size

251KB
MD5

37aa0bd0b3081168267a1011083df5f8
SHA1

f57bd8ee432f08eec3d0c8cbefbfeb58dd3ac78e
SHA256

f0e89069b78233ed90b2760d5909a7bde373b6787372770a443ba43bcc0b16e4
SHA512

b85ee10f3163ae616a2897198ced6f69b14ddb42d8f95c45a5baa8eac9d9ca00b46104b117a67399c7ac3812463b4fae8f4f566edd0631e515ea7ea0389f7c2b

Score

10^/10

qakbot abc100 1606207839 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

abc100

Campaign

1606207839

C2

37.6.223.237:995

2.51.246.190:995

37.211.86.156:443

42.201.228.106:995

50.29.166.232:995

102.185.58.126:443

81.133.234.36:2222

2.50.89.158:995

79.166.83.103:2222

173.245.152.231:443

2.86.41.23:2222

93.151.180.170:61202

24.179.13.119:443

24.152.219.253:995

105.198.236.99:443

24.205.42.241:443

176.58.132.212:2222

151.73.126.156:443

94.52.68.72:443

47.146.169.85:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1728 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1668 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1908 rundll32.exe
1908 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1908 rundll32.exe

pid	process
1728	regsvr32.exe

pid	process
1668	schtasks.exe

pid	process
1908	rundll32.exe
1908	rundll32.exe

pid	process
1908	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 748 wrote to memory of 1908	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1908	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1908	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1908	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1908	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1908	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1908	748	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 1712	1908	rundll32.exe	explorer.exe
PID 1908 wrote to memory of 1712	1908	rundll32.exe	explorer.exe
PID 1908 wrote to memory of 1712	1908	rundll32.exe	explorer.exe
PID 1908 wrote to memory of 1712	1908	rundll32.exe	explorer.exe
PID 1908 wrote to memory of 1712	1908	rundll32.exe	explorer.exe
PID 1908 wrote to memory of 1712	1908	rundll32.exe	explorer.exe
PID 1712 wrote to memory of 1668	1712	explorer.exe	schtasks.exe
PID 1712 wrote to memory of 1668	1712	explorer.exe	schtasks.exe
PID 1712 wrote to memory of 1668	1712	explorer.exe	schtasks.exe
PID 1712 wrote to memory of 1668	1712	explorer.exe	schtasks.exe
PID 1376 wrote to memory of 1468	1376	taskeng.exe	regsvr32.exe
PID 1376 wrote to memory of 1468	1376	taskeng.exe	regsvr32.exe
PID 1376 wrote to memory of 1468	1376	taskeng.exe	regsvr32.exe
PID 1376 wrote to memory of 1468	1376	taskeng.exe	regsvr32.exe
PID 1376 wrote to memory of 1468	1376	taskeng.exe	regsvr32.exe
PID 1468 wrote to memory of 1728	1468	regsvr32.exe	regsvr32.exe
PID 1468 wrote to memory of 1728	1468	regsvr32.exe	regsvr32.exe
PID 1468 wrote to memory of 1728	1468	regsvr32.exe	regsvr32.exe
PID 1468 wrote to memory of 1728	1468	regsvr32.exe	regsvr32.exe
PID 1468 wrote to memory of 1728	1468	regsvr32.exe	regsvr32.exe
PID 1468 wrote to memory of 1728	1468	regsvr32.exe	regsvr32.exe
PID 1468 wrote to memory of 1728	1468	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0e89069b78233ed90b2760d5909a7bde373b6787372770a443ba43bcc0b16e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0e89069b78233ed90b2760d5909a7bde373b6787372770a443ba43bcc0b16e4.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wpytmqmlsm /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\f0e89069b78233ed90b2760d5909a7bde373b6787372770a443ba43bcc0b16e4.dll\"" /SC ONCE /Z /ST 09:19 /ET 09:31
4⤵
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\taskeng.exe
taskeng.exe {5B886B89-66AA-4A3A-AEAE-6AD077606F83} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\f0e89069b78233ed90b2760d5909a7bde373b6787372770a443ba43bcc0b16e4.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\f0e89069b78233ed90b2760d5909a7bde373b6787372770a443ba43bcc0b16e4.dll"
3⤵
- Loads dropped DLL
PID:1728

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f0e89069b78233ed90b2760d5909a7bde373b6787372770a443ba43bcc0b16e4.dll
MD5
7969131cd209cc219977f4ca3a679b1b

SHA1
ea3354906b9c1892948102aba5716cc3da6fcba9

SHA256
d5224fced16557371cbd580eaf1970fdf69a189503e842ed12d6eaa1064f5899

SHA512
b10f8e8c34b3de972b626a4cda77405851c58096a9684b800e0b1f2a861eb59eb2e31b476ad439181575eb3fbe9f6aac63e174d233467d85f254065c256f8116

Download Submit
\Users\Admin\AppData\Local\Temp\f0e89069b78233ed90b2760d5909a7bde373b6787372770a443ba43bcc0b16e4.dll
MD5
7969131cd209cc219977f4ca3a679b1b

SHA1
ea3354906b9c1892948102aba5716cc3da6fcba9

SHA256
d5224fced16557371cbd580eaf1970fdf69a189503e842ed12d6eaa1064f5899

SHA512
b10f8e8c34b3de972b626a4cda77405851c58096a9684b800e0b1f2a861eb59eb2e31b476ad439181575eb3fbe9f6aac63e174d233467d85f254065c256f8116

Download Submit
memory/1468-6-0x0000000000000000-mapping.dmp

Download
memory/1668-4-0x0000000000000000-mapping.dmp

Download
memory/1712-1-0x00000000000A0000-0x00000000000A2000-memory.dmp

Filesize
8KB

Download
memory/1712-3-0x0000000000000000-mapping.dmp

Download
memory/1712-5-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download
memory/1728-8-0x0000000000000000-mapping.dmp

Download
memory/1908-0-0x0000000000000000-mapping.dmp

Download
memory/1908-2-0x0000000000250000-0x0000000000270000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads