qakbot | f8577b751ea68e1e0b746aaceddcfa6e537f855af60aa9dab9881c8c39a3f662

General

Target

923753.jpg.dll
Size

251KB
MD5

25e1d85d6c738e6a4f4c3326843325a7
SHA1

c701f06b419329991edbab1036df102491127603
SHA256

f8577b751ea68e1e0b746aaceddcfa6e537f855af60aa9dab9881c8c39a3f662
SHA512

47dbdcd1f7dfa8f098e1afe5cffc8654fd13f9722400f6820e61281500cc80e23d2adf09566a67bbf9bd494362afd9d814e04e0a08d7d014b43e024035f1b3f4

Score

10^/10

qakbot abc100 1606207839 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

abc100

Campaign

1606207839

C2

37.6.223.237:995

2.51.246.190:995

37.211.86.156:443

42.201.228.106:995

50.29.166.232:995

102.185.58.126:443

81.133.234.36:2222

2.50.89.158:995

79.166.83.103:2222

173.245.152.231:443

2.86.41.23:2222

93.151.180.170:61202

24.179.13.119:443

24.152.219.253:995

105.198.236.99:443

24.205.42.241:443

176.58.132.212:2222

151.73.126.156:443

94.52.68.72:443

47.146.169.85:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

560 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1284 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1604 rundll32.exe
1604 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1604 rundll32.exe

pid	process
560	regsvr32.exe

pid	process
1284	schtasks.exe

pid	process
1604	rundll32.exe
1604	rundll32.exe

pid	process
1604	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 336 wrote to memory of 1604	336	rundll32.exe	rundll32.exe
PID 336 wrote to memory of 1604	336	rundll32.exe	rundll32.exe
PID 336 wrote to memory of 1604	336	rundll32.exe	rundll32.exe
PID 336 wrote to memory of 1604	336	rundll32.exe	rundll32.exe
PID 336 wrote to memory of 1604	336	rundll32.exe	rundll32.exe
PID 336 wrote to memory of 1604	336	rundll32.exe	rundll32.exe
PID 336 wrote to memory of 1604	336	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 1768	1604	rundll32.exe	explorer.exe
PID 1604 wrote to memory of 1768	1604	rundll32.exe	explorer.exe
PID 1604 wrote to memory of 1768	1604	rundll32.exe	explorer.exe
PID 1604 wrote to memory of 1768	1604	rundll32.exe	explorer.exe
PID 1604 wrote to memory of 1768	1604	rundll32.exe	explorer.exe
PID 1604 wrote to memory of 1768	1604	rundll32.exe	explorer.exe
PID 1768 wrote to memory of 1284	1768	explorer.exe	schtasks.exe
PID 1768 wrote to memory of 1284	1768	explorer.exe	schtasks.exe
PID 1768 wrote to memory of 1284	1768	explorer.exe	schtasks.exe
PID 1768 wrote to memory of 1284	1768	explorer.exe	schtasks.exe
PID 888 wrote to memory of 1092	888	taskeng.exe	regsvr32.exe
PID 888 wrote to memory of 1092	888	taskeng.exe	regsvr32.exe
PID 888 wrote to memory of 1092	888	taskeng.exe	regsvr32.exe
PID 888 wrote to memory of 1092	888	taskeng.exe	regsvr32.exe
PID 888 wrote to memory of 1092	888	taskeng.exe	regsvr32.exe
PID 1092 wrote to memory of 560	1092	regsvr32.exe	regsvr32.exe
PID 1092 wrote to memory of 560	1092	regsvr32.exe	regsvr32.exe
PID 1092 wrote to memory of 560	1092	regsvr32.exe	regsvr32.exe
PID 1092 wrote to memory of 560	1092	regsvr32.exe	regsvr32.exe
PID 1092 wrote to memory of 560	1092	regsvr32.exe	regsvr32.exe
PID 1092 wrote to memory of 560	1092	regsvr32.exe	regsvr32.exe
PID 1092 wrote to memory of 560	1092	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\923753.jpg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\923753.jpg.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pkufzjd /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\923753.jpg.dll\"" /SC ONCE /Z /ST 08:42 /ET 08:54
4⤵
- Creates scheduled task(s)
PID:1284

C:\Windows\system32\taskeng.exe
taskeng.exe {BC20F47F-2E57-44D2-BAB0-470F3FB834C2} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:888

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\923753.jpg.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\923753.jpg.dll"
3⤵
- Loads dropped DLL
PID:560

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\923753.jpg.dll
MD5
22bf17036355cd49885ad7c2a1f57827

SHA1
f88b3c43411c70e75c0382790e0969cafc15f108

SHA256
919d4209180e2e52621b3abcc15d4662d782e8a8ea42a491346614ca8d24d6b2

SHA512
b1742ddfd059fc518f1d94900eafb6294416789c7e67e50641402039d3669831d9db481997b82ae3bc3afd034bd769930558dbf06c63e55f0f6b0e6304c80205

Download Submit
\Users\Admin\AppData\Local\Temp\923753.jpg.dll
MD5
22bf17036355cd49885ad7c2a1f57827

SHA1
f88b3c43411c70e75c0382790e0969cafc15f108

SHA256
919d4209180e2e52621b3abcc15d4662d782e8a8ea42a491346614ca8d24d6b2

SHA512
b1742ddfd059fc518f1d94900eafb6294416789c7e67e50641402039d3669831d9db481997b82ae3bc3afd034bd769930558dbf06c63e55f0f6b0e6304c80205

Download Submit
memory/560-8-0x0000000000000000-mapping.dmp

Download
memory/1092-6-0x0000000000000000-mapping.dmp

Download
memory/1284-4-0x0000000000000000-mapping.dmp

Download
memory/1604-0-0x0000000000000000-mapping.dmp

Download
memory/1604-2-0x0000000000170000-0x0000000000190000-memory.dmp

Filesize
128KB

Download
memory/1768-1-0x00000000000A0000-0x00000000000A2000-memory.dmp

Filesize
8KB

Download
memory/1768-3-0x0000000000000000-mapping.dmp

Download
memory/1768-5-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads