qakbot | ebecd734ac446f3ce524dd1d81cb828ff5c96493e56b424dabf8fd82ad23f62d

General

Target

923753.dll
Size

2.9MB
MD5

96333f633950c04e725ff992a41123fc
SHA1

3c5d0a2c7cde8b74cfd28bd8011a18b334131536
SHA256

ebecd734ac446f3ce524dd1d81cb828ff5c96493e56b424dabf8fd82ad23f62d
SHA512

07a445329c63f4a429dfcd354eada1030726d2ac27d610329e8fb561ac70068a3b39b0a08363244baab1ed6726e867d063cf0da9d3c8b795c8fa66d993fb1320

Score

10^/10

qakbot abc101 1606331967 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

abc101

Campaign

1606331967

C2

76.104.230.174:443

187.227.86.129:995

219.255.28.241:443

78.184.6.94:443

95.159.45.82:443

91.228.36.95:443

79.115.215.125:443

24.244.161.36:443

24.71.28.247:443

73.239.229.107:995

187.153.119.36:443

190.75.167.44:2222

83.110.111.159:443

174.76.21.134:443

75.109.180.221:443

85.122.141.42:995

156.222.6.246:995

188.24.183.193:443

88.106.237.152:2222

79.166.83.103:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

368 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1672 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2024 rundll32.exe
2024 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2024 rundll32.exe

pid	process
368	regsvr32.exe

pid	process
1672	schtasks.exe

pid	process
2024	rundll32.exe
2024	rundll32.exe

pid	process
2024	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1632 wrote to memory of 2024	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2024	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2024	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2024	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2024	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2024	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2024	1632	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 316	2024	rundll32.exe	explorer.exe
PID 2024 wrote to memory of 316	2024	rundll32.exe	explorer.exe
PID 2024 wrote to memory of 316	2024	rundll32.exe	explorer.exe
PID 2024 wrote to memory of 316	2024	rundll32.exe	explorer.exe
PID 2024 wrote to memory of 316	2024	rundll32.exe	explorer.exe
PID 2024 wrote to memory of 316	2024	rundll32.exe	explorer.exe
PID 316 wrote to memory of 1672	316	explorer.exe	schtasks.exe
PID 316 wrote to memory of 1672	316	explorer.exe	schtasks.exe
PID 316 wrote to memory of 1672	316	explorer.exe	schtasks.exe
PID 316 wrote to memory of 1672	316	explorer.exe	schtasks.exe
PID 556 wrote to memory of 1340	556	taskeng.exe	regsvr32.exe
PID 556 wrote to memory of 1340	556	taskeng.exe	regsvr32.exe
PID 556 wrote to memory of 1340	556	taskeng.exe	regsvr32.exe
PID 556 wrote to memory of 1340	556	taskeng.exe	regsvr32.exe
PID 556 wrote to memory of 1340	556	taskeng.exe	regsvr32.exe
PID 1340 wrote to memory of 368	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 368	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 368	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 368	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 368	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 368	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 368	1340	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\923753.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\923753.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn minsvhjoyq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\923753.dll\"" /SC ONCE /Z /ST 07:02 /ET 07:14
4⤵
- Creates scheduled task(s)
PID:1672

C:\Windows\system32\taskeng.exe
taskeng.exe {07702D4A-B26B-429A-9207-452E16B9A8ED} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:556

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\923753.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\923753.dll"
3⤵
- Loads dropped DLL
PID:368

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\923753.dll
MD5
d2749b8ad4a1f0c1c3e923cf51887a9b

SHA1
4693593e12199804b5ba361b3baf65f9dcbaf148

SHA256
f2b106c84d0d499466feddabb80472dbcf9ae3a82717ebfeb36781b0e168c442

SHA512
e72de2f1c75ae5a6c03b492d80d9c342cfdbb53927f44a16c95139763fe2146630df9abdfb51091b254332606b9f20578221f21cd940d39a072eddc9550a45c9

Download Submit
\Users\Admin\AppData\Local\Temp\923753.dll
MD5
d2749b8ad4a1f0c1c3e923cf51887a9b

SHA1
4693593e12199804b5ba361b3baf65f9dcbaf148

SHA256
f2b106c84d0d499466feddabb80472dbcf9ae3a82717ebfeb36781b0e168c442

SHA512
e72de2f1c75ae5a6c03b492d80d9c342cfdbb53927f44a16c95139763fe2146630df9abdfb51091b254332606b9f20578221f21cd940d39a072eddc9550a45c9

Download Submit
memory/316-3-0x00000000000E0000-0x00000000000E2000-memory.dmp

Filesize
8KB

Download
memory/316-5-0x0000000000000000-mapping.dmp

Download
memory/316-8-0x00000000000C0000-0x00000000000E0000-memory.dmp

Filesize
128KB

Download
memory/368-11-0x0000000000000000-mapping.dmp

Download
memory/1340-9-0x0000000000000000-mapping.dmp

Download
memory/1672-7-0x0000000000000000-mapping.dmp

Download
memory/2024-2-0x0000000000000000-mapping.dmp

Download
memory/2024-4-0x00000000001E0000-0x0000000000200000-memory.dmp

Filesize
128KB

Download
memory/2024-6-0x00000000001B0000-0x00000000001D0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads