qakbot | f3e517484dca4172c76d42fbb0ebb74289ee2625de794222c51f217dc735adea

General

Target

679f9013eedb140beadc91e4983d4cef7adbc6b5fdfdb77ad74ad82dd67d2e4e.dll
Size

2.1MB
MD5

50d1d18aab6c9b4c65cafc01be708e32
SHA1

8655a78d8e4d13bdd1ecb650771156e4211a0538
SHA256

679f9013eedb140beadc91e4983d4cef7adbc6b5fdfdb77ad74ad82dd67d2e4e
SHA512

ddf6e815b51c6d756d8b3e9c06f779332942d03f436740bfc1288834eecff600e67003361b33bde514ea3ff640bcea7e4a15a1278d5df5163d3ad4e750c8f038

Score

10^/10

qakbot abc107 1607078484 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

abc107

Campaign

1607078484

C2

32.212.117.188:443

109.205.204.229:2222

72.36.59.46:2222

173.18.126.193:2222

96.225.88.23:443

89.137.211.239:443

110.142.205.182:443

82.76.47.211:443

193.83.25.177:995

67.40.253.209:995

73.244.83.199:443

2.90.186.243:995

189.252.62.238:995

141.237.135.194:443

82.78.70.128:443

185.125.151.172:443

79.117.239.22:2222

86.189.252.131:2222

83.114.243.80:2222

2.50.56.81:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1508 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2064 1508 WerFault.exe regsvr32.exe

pid	process
1508	regsvr32.exe

pid	pid_target	process	target process
2064	1508	WerFault.exe	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	rundll32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1996 schtasks.exe

pid	process
1996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
1340	rundll32.exe
1340	rundll32.exe
1340	rundll32.exe
1340	rundll32.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1340 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2064 WerFault.exe
Token: SeBackupPrivilege 2064 WerFault.exe
Token: SeDebugPrivilege 2064 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	2064	WerFault.exe
Token: SeBackupPrivilege	2064	WerFault.exe
Token: SeDebugPrivilege	2064	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 8 wrote to memory of 1340	8	rundll32.exe	rundll32.exe
PID 8 wrote to memory of 1340	8	rundll32.exe	rundll32.exe
PID 8 wrote to memory of 1340	8	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 188	1340	rundll32.exe	explorer.exe
PID 1340 wrote to memory of 188	1340	rundll32.exe	explorer.exe
PID 1340 wrote to memory of 188	1340	rundll32.exe	explorer.exe
PID 1340 wrote to memory of 188	1340	rundll32.exe	explorer.exe
PID 1340 wrote to memory of 188	1340	rundll32.exe	explorer.exe
PID 188 wrote to memory of 1996	188	explorer.exe	schtasks.exe
PID 188 wrote to memory of 1996	188	explorer.exe	schtasks.exe
PID 188 wrote to memory of 1996	188	explorer.exe	schtasks.exe
PID 3564 wrote to memory of 1508	3564	regsvr32.exe	regsvr32.exe
PID 3564 wrote to memory of 1508	3564	regsvr32.exe	regsvr32.exe
PID 3564 wrote to memory of 1508	3564	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\679f9013eedb140beadc91e4983d4cef7adbc6b5fdfdb77ad74ad82dd67d2e4e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:8

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\679f9013eedb140beadc91e4983d4cef7adbc6b5fdfdb77ad74ad82dd67d2e4e.dll,#1
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:188

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qzprftzeei /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\679f9013eedb140beadc91e4983d4cef7adbc6b5fdfdb77ad74ad82dd67d2e4e.dll\"" /SC ONCE /Z /ST 20:16 /ET 20:28
4⤵
- Creates scheduled task(s)
PID:1996

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\679f9013eedb140beadc91e4983d4cef7adbc6b5fdfdb77ad74ad82dd67d2e4e.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3564

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\679f9013eedb140beadc91e4983d4cef7adbc6b5fdfdb77ad74ad82dd67d2e4e.dll"
2⤵
- Loads dropped DLL
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 596
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2064

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\679f9013eedb140beadc91e4983d4cef7adbc6b5fdfdb77ad74ad82dd67d2e4e.dll
MD5
e590a76a6991651c990f88deea9bfb6d

SHA1
f2a943575e1b84f1da7dbca0f890aa7d7a3c7cc2

SHA256
1efa1841a266effd9f2884b389ae78185f81195934617b6bfce0ffd520676fd9

SHA512
3b790c6feb716910ffe3ce440c6e1a7d8f737f7c64d49b6d9f6d7fa91d381bc0822e2bf888a38c028e009c94a69bbc67f4c4200092b8ad6f0b135279c9655777

Download Submit
\Users\Admin\AppData\Local\Temp\679f9013eedb140beadc91e4983d4cef7adbc6b5fdfdb77ad74ad82dd67d2e4e.dll
MD5
e590a76a6991651c990f88deea9bfb6d

SHA1
f2a943575e1b84f1da7dbca0f890aa7d7a3c7cc2

SHA256
1efa1841a266effd9f2884b389ae78185f81195934617b6bfce0ffd520676fd9

SHA512
3b790c6feb716910ffe3ce440c6e1a7d8f737f7c64d49b6d9f6d7fa91d381bc0822e2bf888a38c028e009c94a69bbc67f4c4200092b8ad6f0b135279c9655777

Download Submit
memory/188-4-0x0000000000000000-mapping.dmp

Download
memory/188-7-0x0000000003470000-0x0000000003491000-memory.dmp

Filesize
132KB

Download
memory/1340-2-0x0000000000000000-mapping.dmp

Download
memory/1340-3-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Filesize
132KB

Download
memory/1340-5-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1508-9-0x0000000000000000-mapping.dmp

Download
memory/1508-12-0x0000000000000000-mapping.dmp

Download
memory/1996-6-0x0000000000000000-mapping.dmp

Download
memory/2064-11-0x0000000003300000-0x0000000003301000-memory.dmp

Filesize
4KB

Download
memory/2064-13-0x0000000003CF0000-0x0000000003CF1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads