qakbot | 4f1fa4e10f6e48c0a9a818f06f09955f2aeec7fe8b25708d5f5b0d1b8e8ec63c

General

Target

1412.exe.dll
Size

2.2MB
MD5

137a73c7616a191b8941c8d96108879a
SHA1

79c2a58eeab8aeeb53e9d4f37b78826b4fb62383
SHA256

4f1fa4e10f6e48c0a9a818f06f09955f2aeec7fe8b25708d5f5b0d1b8e8ec63c
SHA512

bb813772643c89007185dffde5a19c1c6c5ffc660633a74279fb2d7e27813e60da28a35eb4b28411ac1aea3a014a399c12da81191e93d7d0aaece0bbca10e0b7

Score

10^/10

qakbot tr02 1608026105 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

tr02

Campaign

1608026105

C2

111.95.212.237:2222

190.220.8.10:995

109.154.79.222:2222

83.110.250.71:995

149.28.99.97:2222

45.63.107.192:443

149.28.101.90:2222

149.28.101.90:995

149.28.99.97:443

149.28.98.196:443

144.202.38.185:2222

45.77.115.208:995

149.28.98.196:2222

149.28.98.196:995

149.28.99.97:995

45.63.107.192:2222

144.202.38.185:995

144.202.38.185:443

45.63.107.192:995

5.13.84.186:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2392 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3200 2392 WerFault.exe regsvr32.exe

pid	process
2392	regsvr32.exe

pid	pid_target	process	target process
3200	2392	WerFault.exe	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	rundll32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2760 schtasks.exe

pid	process
2760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
1148	rundll32.exe
1148	rundll32.exe
1148	rundll32.exe
1148	rundll32.exe
3200	WerFault.exe
3200	WerFault.exe
3200	WerFault.exe
3200	WerFault.exe
3200	WerFault.exe
3200	WerFault.exe
3200	WerFault.exe
3200	WerFault.exe
3200	WerFault.exe
3200	WerFault.exe
3200	WerFault.exe
3200	WerFault.exe
3200	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1148 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3200 WerFault.exe
Token: SeBackupPrivilege 3200 WerFault.exe
Token: SeDebugPrivilege 3200 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3200	WerFault.exe
Token: SeBackupPrivilege	3200	WerFault.exe
Token: SeDebugPrivilege	3200	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 504 wrote to memory of 1148	504	rundll32.exe	rundll32.exe
PID 504 wrote to memory of 1148	504	rundll32.exe	rundll32.exe
PID 504 wrote to memory of 1148	504	rundll32.exe	rundll32.exe
PID 1148 wrote to memory of 2992	1148	rundll32.exe	explorer.exe
PID 1148 wrote to memory of 2992	1148	rundll32.exe	explorer.exe
PID 1148 wrote to memory of 2992	1148	rundll32.exe	explorer.exe
PID 1148 wrote to memory of 2992	1148	rundll32.exe	explorer.exe
PID 1148 wrote to memory of 2992	1148	rundll32.exe	explorer.exe
PID 2992 wrote to memory of 2760	2992	explorer.exe	schtasks.exe
PID 2992 wrote to memory of 2760	2992	explorer.exe	schtasks.exe
PID 2992 wrote to memory of 2760	2992	explorer.exe	schtasks.exe
PID 3244 wrote to memory of 2392	3244	regsvr32.exe	regsvr32.exe
PID 3244 wrote to memory of 2392	3244	regsvr32.exe	regsvr32.exe
PID 3244 wrote to memory of 2392	3244	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1412.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:504

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1412.exe.dll,#1
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn paeyysyj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\1412.exe.dll\"" /SC ONCE /Z /ST 16:40 /ET 16:52
4⤵
- Creates scheduled task(s)
PID:2760

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\1412.exe.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3244

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\1412.exe.dll"
2⤵
- Loads dropped DLL
PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 596
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3200

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1412.exe.dll
MD5
c4ca3b0c24456e0be9aab78ac633ba5e

SHA1
d43fe2a992ddc048fac7ef74c6769391a097ded7

SHA256
80afe8f069284d69c3a88ac92e167f29ba6a192a71339596f6d05f3a6a6bbfda

SHA512
d908b6e172f5357d91b06e32f0773e7fbd233322607fee0bd7e89e0cfab0820afcab1e9aafcc8916ab36e8c6cb1e61d23d9ba95419f4f217620b3b4c16d08afa

Download Submit
\Users\Admin\AppData\Local\Temp\1412.exe.dll
MD5
c4ca3b0c24456e0be9aab78ac633ba5e

SHA1
d43fe2a992ddc048fac7ef74c6769391a097ded7

SHA256
80afe8f069284d69c3a88ac92e167f29ba6a192a71339596f6d05f3a6a6bbfda

SHA512
d908b6e172f5357d91b06e32f0773e7fbd233322607fee0bd7e89e0cfab0820afcab1e9aafcc8916ab36e8c6cb1e61d23d9ba95419f4f217620b3b4c16d08afa

Download Submit
memory/1148-2-0x0000000000000000-mapping.dmp

Download
memory/1148-3-0x0000000001010000-0x0000000001045000-memory.dmp

Filesize
212KB

Download
memory/1148-5-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/2392-9-0x0000000000000000-mapping.dmp

Download
memory/2392-12-0x0000000000000000-mapping.dmp

Download
memory/2760-6-0x0000000000000000-mapping.dmp

Download
memory/2992-4-0x0000000000000000-mapping.dmp

Download
memory/2992-7-0x0000000000C80000-0x0000000000CB5000-memory.dmp

Filesize
212KB

Download
memory/3200-11-0x0000000003B60000-0x0000000003B61000-memory.dmp

Filesize
4KB

Download
memory/3200-13-0x0000000004290000-0x0000000004291000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads