qakbot | eba9c787915db694ba3d567dce84b5b76b639e0ba4c0bbe10113dd21e3299feb

General

Target

9237537.dll
Size

2.9MB
MD5

2449a2a1a20c37b570a8f3ad3174ab64
SHA1

d5769dabf6f4814c0b6a707d4d18db2af57355e9
SHA256

eba9c787915db694ba3d567dce84b5b76b639e0ba4c0bbe10113dd21e3299feb
SHA512

6a92722e9a2f3996fe6c8dc9489f5311844e4a45e941170793c4d6f7ea5bab5c4ee21346e2d87a004532d7e8e65e4836fb487f7626093dcf016524b5012bc2ec

Score

10^/10

qakbot abc101 1606331967 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

abc101

Campaign

1606331967

C2

76.104.230.174:443

187.227.86.129:995

219.255.28.241:443

78.184.6.94:443

95.159.45.82:443

91.228.36.95:443

79.115.215.125:443

24.244.161.36:443

24.71.28.247:443

73.239.229.107:995

187.153.119.36:443

190.75.167.44:2222

83.110.111.159:443

174.76.21.134:443

75.109.180.221:443

85.122.141.42:995

156.222.6.246:995

188.24.183.193:443

88.106.237.152:2222

79.166.83.103:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1992 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1320 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1636 rundll32.exe
1636 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1636 rundll32.exe

pid	process
1992	regsvr32.exe

pid	process
1320	schtasks.exe

pid	process
1636	rundll32.exe
1636	rundll32.exe

pid	process
1636	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1580 wrote to memory of 1636	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1636	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1636	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1636	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1636	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1636	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 1636	1580	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 2012	1636	rundll32.exe	explorer.exe
PID 1636 wrote to memory of 2012	1636	rundll32.exe	explorer.exe
PID 1636 wrote to memory of 2012	1636	rundll32.exe	explorer.exe
PID 1636 wrote to memory of 2012	1636	rundll32.exe	explorer.exe
PID 1636 wrote to memory of 2012	1636	rundll32.exe	explorer.exe
PID 1636 wrote to memory of 2012	1636	rundll32.exe	explorer.exe
PID 2012 wrote to memory of 1320	2012	explorer.exe	schtasks.exe
PID 2012 wrote to memory of 1320	2012	explorer.exe	schtasks.exe
PID 2012 wrote to memory of 1320	2012	explorer.exe	schtasks.exe
PID 2012 wrote to memory of 1320	2012	explorer.exe	schtasks.exe
PID 1168 wrote to memory of 952	1168	taskeng.exe	regsvr32.exe
PID 1168 wrote to memory of 952	1168	taskeng.exe	regsvr32.exe
PID 1168 wrote to memory of 952	1168	taskeng.exe	regsvr32.exe
PID 1168 wrote to memory of 952	1168	taskeng.exe	regsvr32.exe
PID 1168 wrote to memory of 952	1168	taskeng.exe	regsvr32.exe
PID 952 wrote to memory of 1992	952	regsvr32.exe	regsvr32.exe
PID 952 wrote to memory of 1992	952	regsvr32.exe	regsvr32.exe
PID 952 wrote to memory of 1992	952	regsvr32.exe	regsvr32.exe
PID 952 wrote to memory of 1992	952	regsvr32.exe	regsvr32.exe
PID 952 wrote to memory of 1992	952	regsvr32.exe	regsvr32.exe
PID 952 wrote to memory of 1992	952	regsvr32.exe	regsvr32.exe
PID 952 wrote to memory of 1992	952	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9237537.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9237537.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vbnsqejakn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9237537.dll\"" /SC ONCE /Z /ST 07:18 /ET 07:30
4⤵
- Creates scheduled task(s)
PID:1320

C:\Windows\system32\taskeng.exe
taskeng.exe {00D5A175-DA2D-4BF5-B021-1E44CB1A67AD} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9237537.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\9237537.dll"
3⤵
- Loads dropped DLL
PID:1992

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9237537.dll
MD5
c0c1f1d2a488e0b0cf0dcaad7edb59ab

SHA1
4f41f41e9016a89bad80e71f9c6eee916bb7f618

SHA256
82cfcfd282f0f7e3eaa919de1d13c4b118a5474523561ea8645760f52d889689

SHA512
10bf45bf06f80a5aed4fcd8b1b8476337e887d4c7601c3b95357292cd8e22e39b4440f080634a5b483ade0e99353119142862dc7875912bac5b1558ad6a0ec27

Download Submit
\Users\Admin\AppData\Local\Temp\9237537.dll
MD5
c0c1f1d2a488e0b0cf0dcaad7edb59ab

SHA1
4f41f41e9016a89bad80e71f9c6eee916bb7f618

SHA256
82cfcfd282f0f7e3eaa919de1d13c4b118a5474523561ea8645760f52d889689

SHA512
10bf45bf06f80a5aed4fcd8b1b8476337e887d4c7601c3b95357292cd8e22e39b4440f080634a5b483ade0e99353119142862dc7875912bac5b1558ad6a0ec27

Download Submit
memory/952-9-0x0000000000000000-mapping.dmp

Download
memory/1320-7-0x0000000000000000-mapping.dmp

Download
memory/1636-2-0x0000000000000000-mapping.dmp

Download
memory/1636-4-0x00000000001D0000-0x00000000001F0000-memory.dmp

Filesize
128KB

Download
memory/1636-6-0x0000000000150000-0x0000000000170000-memory.dmp

Filesize
128KB

Download
memory/1992-11-0x0000000000000000-mapping.dmp

Download
memory/2012-3-0x00000000000A0000-0x00000000000A2000-memory.dmp

Filesize
8KB

Download
memory/2012-5-0x0000000000000000-mapping.dmp

Download
memory/2012-8-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads