qakbot | 4f1fa4e10f6e48c0a9a818f06f09955f2aeec7fe8b25708d5f5b0d1b8e8ec63c

General

Target

1412.exe.dll
Size

2.2MB
MD5

137a73c7616a191b8941c8d96108879a
SHA1

79c2a58eeab8aeeb53e9d4f37b78826b4fb62383
SHA256

4f1fa4e10f6e48c0a9a818f06f09955f2aeec7fe8b25708d5f5b0d1b8e8ec63c
SHA512

bb813772643c89007185dffde5a19c1c6c5ffc660633a74279fb2d7e27813e60da28a35eb4b28411ac1aea3a014a399c12da81191e93d7d0aaece0bbca10e0b7

Score

10^/10

qakbot tr02 1608026105 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

tr02

Campaign

1608026105

C2

111.95.212.237:2222

190.220.8.10:995

109.154.79.222:2222

83.110.250.71:995

149.28.99.97:2222

45.63.107.192:443

149.28.101.90:2222

149.28.101.90:995

149.28.99.97:443

149.28.98.196:443

144.202.38.185:2222

45.77.115.208:995

149.28.98.196:2222

149.28.98.196:995

149.28.99.97:995

45.63.107.192:2222

144.202.38.185:995

144.202.38.185:443

45.63.107.192:995

5.13.84.186:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

776 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1484 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1652 rundll32.exe
1652 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1652 rundll32.exe

pid	process
776	regsvr32.exe

pid	process
1484	schtasks.exe

pid	process
1652	rundll32.exe
1652	rundll32.exe

pid	process
1652	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 932 wrote to memory of 1652	932	rundll32.exe	rundll32.exe
PID 932 wrote to memory of 1652	932	rundll32.exe	rundll32.exe
PID 932 wrote to memory of 1652	932	rundll32.exe	rundll32.exe
PID 932 wrote to memory of 1652	932	rundll32.exe	rundll32.exe
PID 932 wrote to memory of 1652	932	rundll32.exe	rundll32.exe
PID 932 wrote to memory of 1652	932	rundll32.exe	rundll32.exe
PID 932 wrote to memory of 1652	932	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1228	1652	rundll32.exe	explorer.exe
PID 1652 wrote to memory of 1228	1652	rundll32.exe	explorer.exe
PID 1652 wrote to memory of 1228	1652	rundll32.exe	explorer.exe
PID 1652 wrote to memory of 1228	1652	rundll32.exe	explorer.exe
PID 1652 wrote to memory of 1228	1652	rundll32.exe	explorer.exe
PID 1652 wrote to memory of 1228	1652	rundll32.exe	explorer.exe
PID 1228 wrote to memory of 1484	1228	explorer.exe	schtasks.exe
PID 1228 wrote to memory of 1484	1228	explorer.exe	schtasks.exe
PID 1228 wrote to memory of 1484	1228	explorer.exe	schtasks.exe
PID 1228 wrote to memory of 1484	1228	explorer.exe	schtasks.exe
PID 332 wrote to memory of 584	332	taskeng.exe	regsvr32.exe
PID 332 wrote to memory of 584	332	taskeng.exe	regsvr32.exe
PID 332 wrote to memory of 584	332	taskeng.exe	regsvr32.exe
PID 332 wrote to memory of 584	332	taskeng.exe	regsvr32.exe
PID 332 wrote to memory of 584	332	taskeng.exe	regsvr32.exe
PID 584 wrote to memory of 776	584	regsvr32.exe	regsvr32.exe
PID 584 wrote to memory of 776	584	regsvr32.exe	regsvr32.exe
PID 584 wrote to memory of 776	584	regsvr32.exe	regsvr32.exe
PID 584 wrote to memory of 776	584	regsvr32.exe	regsvr32.exe
PID 584 wrote to memory of 776	584	regsvr32.exe	regsvr32.exe
PID 584 wrote to memory of 776	584	regsvr32.exe	regsvr32.exe
PID 584 wrote to memory of 776	584	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1412.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:932

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1412.exe.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dzqtfwtg /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\1412.exe.dll\"" /SC ONCE /Z /ST 15:32 /ET 15:44
4⤵
- Creates scheduled task(s)
PID:1484

C:\Windows\system32\taskeng.exe
taskeng.exe {C14523DB-2321-4A9D-9F58-1D91582710A5} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\1412.exe.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:584

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\1412.exe.dll"
3⤵
- Loads dropped DLL
PID:776

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1412.exe.dll
MD5
c4ca3b0c24456e0be9aab78ac633ba5e

SHA1
d43fe2a992ddc048fac7ef74c6769391a097ded7

SHA256
80afe8f069284d69c3a88ac92e167f29ba6a192a71339596f6d05f3a6a6bbfda

SHA512
d908b6e172f5357d91b06e32f0773e7fbd233322607fee0bd7e89e0cfab0820afcab1e9aafcc8916ab36e8c6cb1e61d23d9ba95419f4f217620b3b4c16d08afa

Download Submit
\Users\Admin\AppData\Local\Temp\1412.exe.dll
MD5
c4ca3b0c24456e0be9aab78ac633ba5e

SHA1
d43fe2a992ddc048fac7ef74c6769391a097ded7

SHA256
80afe8f069284d69c3a88ac92e167f29ba6a192a71339596f6d05f3a6a6bbfda

SHA512
d908b6e172f5357d91b06e32f0773e7fbd233322607fee0bd7e89e0cfab0820afcab1e9aafcc8916ab36e8c6cb1e61d23d9ba95419f4f217620b3b4c16d08afa

Download Submit
memory/584-9-0x0000000000000000-mapping.dmp

Download
memory/776-11-0x0000000000000000-mapping.dmp

Download
memory/1228-3-0x00000000000C0000-0x00000000000C2000-memory.dmp

Filesize
8KB

Download
memory/1228-5-0x0000000000000000-mapping.dmp

Download
memory/1228-8-0x0000000000080000-0x00000000000B5000-memory.dmp

Filesize
212KB

Download
memory/1484-7-0x0000000000000000-mapping.dmp

Download
memory/1652-2-0x0000000000000000-mapping.dmp

Download
memory/1652-4-0x0000000000210000-0x0000000000245000-memory.dmp

Filesize
212KB

Download
memory/1652-6-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads