qakbot | dda3c171bf742d72ba4a3fd7ee3a8262f908318b9707795d49e64aa7bd75aa81

General

Target

b7f44dad109dd2f29f33323922ee37f8_dump2.bin.dll
Size

128KB
MD5

6b1771b883c0b3ffdc3f5923f45c1f93
SHA1

41401ec184e04b2d5d94487415819ad69764ab21
SHA256

dda3c171bf742d72ba4a3fd7ee3a8262f908318b9707795d49e64aa7bd75aa81
SHA512

fad4dba82c97fa5f9bcd793e71c73064210fb573d92e5341679ff6914fff71c797b4f94afeb027632b34f51ae73f4d674e9a93759ee7998588749b1fa56ac4fc

Score

10^/10

qakbot abc100 1606207839 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

abc100

Campaign

1606207839

C2

37.6.223.237:995

2.51.246.190:995

37.211.86.156:443

42.201.228.106:995

50.29.166.232:995

102.185.58.126:443

81.133.234.36:2222

2.50.89.158:995

79.166.83.103:2222

173.245.152.231:443

2.86.41.23:2222

93.151.180.170:61202

24.179.13.119:443

24.152.219.253:995

105.198.236.99:443

24.205.42.241:443

176.58.132.212:2222

151.73.126.156:443

94.52.68.72:443

47.146.169.85:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

980 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1120 980 WerFault.exe regsvr32.exe

pid	process
980	regsvr32.exe

pid	pid_target	process	target process
1120	980	WerFault.exe	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4304 schtasks.exe

pid	process
4304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

regsvr32.exeWerFault.exe

pid	process
4872	regsvr32.exe
4872	regsvr32.exe
4872	regsvr32.exe
4872	regsvr32.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

4872 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1120 WerFault.exe
Token: SeBackupPrivilege 1120 WerFault.exe
Token: SeDebugPrivilege 1120 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	1120	WerFault.exe
Token: SeBackupPrivilege	1120	WerFault.exe
Token: SeDebugPrivilege	1120	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 4772 wrote to memory of 4872	4772	regsvr32.exe	regsvr32.exe
PID 4772 wrote to memory of 4872	4772	regsvr32.exe	regsvr32.exe
PID 4772 wrote to memory of 4872	4772	regsvr32.exe	regsvr32.exe
PID 4872 wrote to memory of 4232	4872	regsvr32.exe	explorer.exe
PID 4872 wrote to memory of 4232	4872	regsvr32.exe	explorer.exe
PID 4872 wrote to memory of 4232	4872	regsvr32.exe	explorer.exe
PID 4872 wrote to memory of 4232	4872	regsvr32.exe	explorer.exe
PID 4872 wrote to memory of 4232	4872	regsvr32.exe	explorer.exe
PID 4232 wrote to memory of 4304	4232	explorer.exe	schtasks.exe
PID 4232 wrote to memory of 4304	4232	explorer.exe	schtasks.exe
PID 4232 wrote to memory of 4304	4232	explorer.exe	schtasks.exe
PID 856 wrote to memory of 980	856	regsvr32.exe	regsvr32.exe
PID 856 wrote to memory of 980	856	regsvr32.exe	regsvr32.exe
PID 856 wrote to memory of 980	856	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b7f44dad109dd2f29f33323922ee37f8_dump2.bin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4772

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\b7f44dad109dd2f29f33323922ee37f8_dump2.bin.dll
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4872

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4232

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn purefnita /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\b7f44dad109dd2f29f33323922ee37f8_dump2.bin.dll\"" /SC ONCE /Z /ST 04:00 /ET 04:12
4⤵
- Creates scheduled task(s)
PID:4304

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\b7f44dad109dd2f29f33323922ee37f8_dump2.bin.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\b7f44dad109dd2f29f33323922ee37f8_dump2.bin.dll"
2⤵
- Loads dropped DLL
PID:980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 596
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1120

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b7f44dad109dd2f29f33323922ee37f8_dump2.bin.dll
MD5
85c38c62b66567398429965ebd69d411

SHA1
9f5df9a7837d439ca4cdab82315d2c8aa7fccebf

SHA256
b7291a8df98c2bc494e251814854aa5dcad470f21d45ccbac341d6d9877d52b0

SHA512
5e6356fd186fadd5b87fd9741a6206de4fb682c612dbd448279739a6f35c5345ec4aa5d1b9e2afc5eec297231df0fbd61ab26e4872a24aa69075d599122df9dd

Download Submit
\Users\Admin\AppData\Local\Temp\b7f44dad109dd2f29f33323922ee37f8_dump2.bin.dll
MD5
85c38c62b66567398429965ebd69d411

SHA1
9f5df9a7837d439ca4cdab82315d2c8aa7fccebf

SHA256
b7291a8df98c2bc494e251814854aa5dcad470f21d45ccbac341d6d9877d52b0

SHA512
5e6356fd186fadd5b87fd9741a6206de4fb682c612dbd448279739a6f35c5345ec4aa5d1b9e2afc5eec297231df0fbd61ab26e4872a24aa69075d599122df9dd

Download Submit
memory/980-8-0x0000000000000000-mapping.dmp

Download
memory/980-11-0x0000000000000000-mapping.dmp

Download
memory/1120-10-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/1120-12-0x0000000003990000-0x0000000003991000-memory.dmp

Filesize
4KB

Download
memory/4232-4-0x0000000000000000-mapping.dmp

Download
memory/4232-6-0x0000000002A70000-0x0000000002A90000-memory.dmp

Filesize
128KB

Download
memory/4304-5-0x0000000000000000-mapping.dmp

Download
memory/4872-2-0x0000000000000000-mapping.dmp

Download
memory/4872-3-0x0000000002E40000-0x0000000002E60000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads