qakbot | 8c4b601938850ae85f6faea32989b6d4cb28cbc9b7711ef0a32a05442003b023

General

Target

8c4b601938850ae85f6faea32989b6d4cb28cbc9b7711ef0a32a05442003b023.dll
Size

249KB
MD5

bf8e148474128895d41dfd384578c648
SHA1

dd87608e706f9d99fe75937723ecea5460fb1afb
SHA256

8c4b601938850ae85f6faea32989b6d4cb28cbc9b7711ef0a32a05442003b023
SHA512

cd6f8831622faec9720b7588d6827ac33e2914210396138e23bf4e8ce5ff93b100a7fd29e7118abe45dee5583840fbc408f1c80a350b9e3803f164195c20438e

Score

10^/10

qakbot tr02 1606748059 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

tr02

Campaign

1606748059

C2

197.45.110.165:995

86.99.134.235:2222

174.76.21.134:443

208.99.100.129:443

86.126.198.195:443

185.105.131.233:443

85.132.36.111:2222

105.198.236.101:443

2.49.219.254:22

217.165.2.92:995

67.6.54.180:443

5.193.115.251:2222

83.196.50.197:2222

89.3.198.238:443

94.141.3.242:443

73.239.229.107:995

217.165.15.245:2222

68.225.60.77:995

85.121.42.12:443

99.240.226.2:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

576 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1504 2012 WerFault.exe regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1576 schtasks.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

regsvr32.exeWerFault.exe

pid process

2012 regsvr32.exe
2012 regsvr32.exe
1504 WerFault.exe
1504 WerFault.exe
1504 WerFault.exe
1504 WerFault.exe
1504 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1504 WerFault.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

2012 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1504 WerFault.exe

pid	process
576	regsvr32.exe

pid	pid_target	process	target process
1504	2012	WerFault.exe	regsvr32.exe

pid	process
1576	schtasks.exe

pid	process
1504	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1504	WerFault.exe

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

regsvr32.exe

pid	process
2012	regsvr32.exe
2012	regsvr32.exe
2012	regsvr32.exe
2012	regsvr32.exe
2012	regsvr32.exe
2012	regsvr32.exe
2012	regsvr32.exe
2012	regsvr32.exe
2012	regsvr32.exe
2012	regsvr32.exe

Suspicious use of SendNotifyMessage 10 IoCs

Processes:

regsvr32.exe

pid	process
2012	regsvr32.exe
2012	regsvr32.exe
2012	regsvr32.exe
2012	regsvr32.exe
2012	regsvr32.exe
2012	regsvr32.exe
2012	regsvr32.exe
2012	regsvr32.exe
2012	regsvr32.exe
2012	regsvr32.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 748 wrote to memory of 2012	748	regsvr32.exe	regsvr32.exe
PID 748 wrote to memory of 2012	748	regsvr32.exe	regsvr32.exe
PID 748 wrote to memory of 2012	748	regsvr32.exe	regsvr32.exe
PID 748 wrote to memory of 2012	748	regsvr32.exe	regsvr32.exe
PID 748 wrote to memory of 2012	748	regsvr32.exe	regsvr32.exe
PID 748 wrote to memory of 2012	748	regsvr32.exe	regsvr32.exe
PID 748 wrote to memory of 2012	748	regsvr32.exe	regsvr32.exe
PID 2012 wrote to memory of 1340	2012	regsvr32.exe	explorer.exe
PID 2012 wrote to memory of 1340	2012	regsvr32.exe	explorer.exe
PID 2012 wrote to memory of 1340	2012	regsvr32.exe	explorer.exe
PID 2012 wrote to memory of 1340	2012	regsvr32.exe	explorer.exe
PID 2012 wrote to memory of 1340	2012	regsvr32.exe	explorer.exe
PID 2012 wrote to memory of 1340	2012	regsvr32.exe	explorer.exe
PID 2012 wrote to memory of 1504	2012	regsvr32.exe	WerFault.exe
PID 2012 wrote to memory of 1504	2012	regsvr32.exe	WerFault.exe
PID 2012 wrote to memory of 1504	2012	regsvr32.exe	WerFault.exe
PID 2012 wrote to memory of 1504	2012	regsvr32.exe	WerFault.exe
PID 1340 wrote to memory of 1576	1340	explorer.exe	schtasks.exe
PID 1340 wrote to memory of 1576	1340	explorer.exe	schtasks.exe
PID 1340 wrote to memory of 1576	1340	explorer.exe	schtasks.exe
PID 1340 wrote to memory of 1576	1340	explorer.exe	schtasks.exe
PID 1148 wrote to memory of 848	1148	taskeng.exe	regsvr32.exe
PID 1148 wrote to memory of 848	1148	taskeng.exe	regsvr32.exe
PID 1148 wrote to memory of 848	1148	taskeng.exe	regsvr32.exe
PID 1148 wrote to memory of 848	1148	taskeng.exe	regsvr32.exe
PID 1148 wrote to memory of 848	1148	taskeng.exe	regsvr32.exe
PID 848 wrote to memory of 576	848	regsvr32.exe	regsvr32.exe
PID 848 wrote to memory of 576	848	regsvr32.exe	regsvr32.exe
PID 848 wrote to memory of 576	848	regsvr32.exe	regsvr32.exe
PID 848 wrote to memory of 576	848	regsvr32.exe	regsvr32.exe
PID 848 wrote to memory of 576	848	regsvr32.exe	regsvr32.exe
PID 848 wrote to memory of 576	848	regsvr32.exe	regsvr32.exe
PID 848 wrote to memory of 576	848	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8c4b601938850ae85f6faea32989b6d4cb28cbc9b7711ef0a32a05442003b023.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\8c4b601938850ae85f6faea32989b6d4cb28cbc9b7711ef0a32a05442003b023.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fyowmrkv /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\8c4b601938850ae85f6faea32989b6d4cb28cbc9b7711ef0a32a05442003b023.dll\"" /SC ONCE /Z /ST 18:43 /ET 18:55
4⤵
- Creates scheduled task(s)
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 436
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1504

C:\Windows\system32\taskeng.exe
taskeng.exe {B20F844D-E078-462D-9AE7-DAF46E4027A9} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\8c4b601938850ae85f6faea32989b6d4cb28cbc9b7711ef0a32a05442003b023.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\8c4b601938850ae85f6faea32989b6d4cb28cbc9b7711ef0a32a05442003b023.dll"
3⤵
- Loads dropped DLL
PID:576

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8c4b601938850ae85f6faea32989b6d4cb28cbc9b7711ef0a32a05442003b023.dll
MD5
e22997f0b8b9b7716c04d5d7eeec3489

SHA1
7855c8375bf78ea1f46e0d482d27e823df5b7332

SHA256
82248e3adf66f205b5c02ad12adcb4ad85d85499e0e8685ddbc40e79c538ab16

SHA512
ed1f305878ef0fb3e17118d9660e893716213adac94e9db83f00c2b73a0bd1259fb21cb425fcf1ce3b5e62c2eb85244444c65139ea313e5ffd9130416c98dace

Download Submit
\Users\Admin\AppData\Local\Temp\8c4b601938850ae85f6faea32989b6d4cb28cbc9b7711ef0a32a05442003b023.dll
MD5
e22997f0b8b9b7716c04d5d7eeec3489

SHA1
7855c8375bf78ea1f46e0d482d27e823df5b7332

SHA256
82248e3adf66f205b5c02ad12adcb4ad85d85499e0e8685ddbc40e79c538ab16

SHA512
ed1f305878ef0fb3e17118d9660e893716213adac94e9db83f00c2b73a0bd1259fb21cb425fcf1ce3b5e62c2eb85244444c65139ea313e5ffd9130416c98dace

Download Submit
memory/576-16-0x0000000000000000-mapping.dmp

Download
memory/848-14-0x0000000000000000-mapping.dmp

Download
memory/1340-13-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download
memory/1340-3-0x00000000000A0000-0x00000000000A2000-memory.dmp

Filesize
8KB

Download
memory/1340-5-0x0000000000000000-mapping.dmp

Download
memory/1504-6-0x0000000000000000-mapping.dmp

Download
memory/1504-11-0x0000000002730000-0x0000000002741000-memory.dmp

Filesize
68KB

Download
memory/1504-7-0x0000000001FD0000-0x0000000001FE1000-memory.dmp

Filesize
68KB

Download
memory/1576-12-0x0000000000000000-mapping.dmp

Download
memory/2012-10-0x0000000000000000-mapping.dmp

Download
memory/2012-9-0x0000000000000000-mapping.dmp

Download
memory/2012-8-0x0000000000000000-mapping.dmp

Download
memory/2012-2-0x0000000000000000-mapping.dmp

Download
memory/2012-4-0x00000000005C0000-0x00000000005E0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads