qakbot | 27444feded72224aff37a7fe95cfb7c9f7bde33b14099eabc4a2bf5ebb5b56aa

General

Target

111112.jpg.dll
Size

2.9MB
MD5

008dbbd90f4850bd5100ec7f7a44a718
SHA1

f40f99bab58d681f265cf1b6622cc087264c422c
SHA256

aed677ba2f94ebf7b7b9b5df50f06f91764e0e040a546bc008bc808cd9b7fd81
SHA512

6c02754f06976fda1dd2f24f1cd01e5156a184b1e1f65eef8010ebfade031960ff0ca203bcf7acc2ee45d04490a62366c59385e2c908d5a18204a3c12887d1ca

Score

10^/10

qakbot abc101 1606331967 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

abc101

Campaign

1606331967

C2

76.104.230.174:443

187.227.86.129:995

219.255.28.241:443

78.184.6.94:443

95.159.45.82:443

91.228.36.95:443

79.115.215.125:443

24.244.161.36:443

24.71.28.247:443

73.239.229.107:995

187.153.119.36:443

190.75.167.44:2222

83.110.111.159:443

174.76.21.134:443

75.109.180.221:443

85.122.141.42:995

156.222.6.246:995

188.24.183.193:443

88.106.237.152:2222

79.166.83.103:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1208 regsvr32.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1656 schtasks.exe
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

520 ipconfig.exe

pid	process
1208	regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
1656	schtasks.exe

pid	process
520	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1472 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1148 rundll32.exe
1148 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1148 rundll32.exe

pid	process
1148	rundll32.exe
1148	rundll32.exe

pid	process
1148	rundll32.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

WINWORD.EXE

pid	process
1472	WINWORD.EXE
1472	WINWORD.EXE
1472	WINWORD.EXE
1472	WINWORD.EXE
1472	WINWORD.EXE
1472	WINWORD.EXE
1472	WINWORD.EXE
1472	WINWORD.EXE
1472	WINWORD.EXE
1472	WINWORD.EXE

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

rundll32.exerundll32.exeexplorer.execmd.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 2012 wrote to memory of 1148	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1148	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1148	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1148	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1148	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1148	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1148	2012	rundll32.exe	rundll32.exe
PID 1148 wrote to memory of 544	1148	rundll32.exe	explorer.exe
PID 1148 wrote to memory of 544	1148	rundll32.exe	explorer.exe
PID 1148 wrote to memory of 544	1148	rundll32.exe	explorer.exe
PID 1148 wrote to memory of 544	1148	rundll32.exe	explorer.exe
PID 1148 wrote to memory of 544	1148	rundll32.exe	explorer.exe
PID 1148 wrote to memory of 544	1148	rundll32.exe	explorer.exe
PID 544 wrote to memory of 1656	544	explorer.exe	schtasks.exe
PID 544 wrote to memory of 1656	544	explorer.exe	schtasks.exe
PID 544 wrote to memory of 1656	544	explorer.exe	schtasks.exe
PID 544 wrote to memory of 1656	544	explorer.exe	schtasks.exe
PID 1908 wrote to memory of 520	1908	cmd.exe	ipconfig.exe
PID 1908 wrote to memory of 520	1908	cmd.exe	ipconfig.exe
PID 1908 wrote to memory of 520	1908	cmd.exe	ipconfig.exe
PID 556 wrote to memory of 1340	556	taskeng.exe	regsvr32.exe
PID 556 wrote to memory of 1340	556	taskeng.exe	regsvr32.exe
PID 556 wrote to memory of 1340	556	taskeng.exe	regsvr32.exe
PID 556 wrote to memory of 1340	556	taskeng.exe	regsvr32.exe
PID 556 wrote to memory of 1340	556	taskeng.exe	regsvr32.exe
PID 1340 wrote to memory of 1208	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1208	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1208	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1208	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1208	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1208	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1208	1340	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\111112.jpg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\111112.jpg.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn didpkedfnu /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\111112.jpg.dll\"" /SC ONCE /Z /ST 20:08 /ET 20:20
4⤵
- Creates scheduled task(s)
PID:1656

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\system32\ipconfig.exe
ipconfig
2⤵
- Gathers network information
PID:520

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\CheckpointConvertTo.rtf"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1472

C:\Windows\system32\taskeng.exe
taskeng.exe {5D016701-EA4D-4F10-BFBB-984D7CBF983C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:556

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\111112.jpg.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\111112.jpg.dll"
3⤵
- Loads dropped DLL
PID:1208

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Command-Line Interface

1

T1059

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\111112.jpg.dll
MD5
3f17f0cc71bc1a13bf9201e737c8c9fd

SHA1
99a0b39f073dff885730e056753a099f7c5a5d86

SHA256
b57f2b6969a6a5f93dfdee27369b4925af085a7a8b7ab4e5531097af90b95009

SHA512
b134357278bcb3e6864dabd3f2a267bf41bc392e10ef7c0898f52251a232880809aebe5f5ac55eb64dd9a4c541b8d40a0e4edf2e31f397dde359699b442b0b21

Download Submit
\Users\Admin\AppData\Local\Temp\111112.jpg.dll
MD5
3f17f0cc71bc1a13bf9201e737c8c9fd

SHA1
99a0b39f073dff885730e056753a099f7c5a5d86

SHA256
b57f2b6969a6a5f93dfdee27369b4925af085a7a8b7ab4e5531097af90b95009

SHA512
b134357278bcb3e6864dabd3f2a267bf41bc392e10ef7c0898f52251a232880809aebe5f5ac55eb64dd9a4c541b8d40a0e4edf2e31f397dde359699b442b0b21

Download Submit
memory/520-9-0x0000000000000000-mapping.dmp

Download
memory/544-8-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download
memory/544-5-0x0000000000000000-mapping.dmp

Download
memory/544-3-0x00000000000A0000-0x00000000000A2000-memory.dmp

Filesize
8KB

Download
memory/1148-6-0x00000000001B0000-0x00000000001D0000-memory.dmp

Filesize
128KB

Download
memory/1148-2-0x0000000000000000-mapping.dmp

Download
memory/1148-4-0x00000000001E0000-0x0000000000200000-memory.dmp

Filesize
128KB

Download
memory/1208-14-0x0000000000000000-mapping.dmp

Download
memory/1340-12-0x0000000000000000-mapping.dmp

Download
memory/1472-11-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/1656-7-0x0000000000000000-mapping.dmp

Download
memory/1808-10-0x000007FEF7B20000-0x000007FEF7D9A000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads