qakbot | 772f8d1f0fa5a639f57dd886343e1567aa64e9ead5589508154a525a97e79f38

General

Target

gaefvup.dll
Size

255KB
MD5

d3651962f3f65ae2d14b1b3fb8da6602
SHA1

af56654a48d3d23176a7ac42a4b8b83bd3222baa
SHA256

772f8d1f0fa5a639f57dd886343e1567aa64e9ead5589508154a525a97e79f38
SHA512

5c123d79b423b19d8249af74ac542260c491ec6dea3ed8d85af795dadb3d4910ae5412da17188d4f8c02f37201c9afbe935631d752ddffe4eb9b14df7356da4b

Score

10^/10

qakbot abc101 1606294013 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

abc101

Campaign

1606294013

C2

98.115.243.237:443

78.101.21.73:443

185.163.221.77:2222

2.51.246.190:995

2.50.2.11:995

175.137.79.81:443

42.201.228.106:995

185.246.9.69:995

81.133.234.36:2222

24.205.42.241:443

73.239.229.107:995

102.185.58.126:443

173.245.152.231:443

105.101.216.210:443

89.137.195.167:995

174.76.21.134:443

41.238.217.126:6881

47.138.204.19:443

79.166.83.103:2222

92.154.83.96:1194

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3256 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2180 3256 WerFault.exe regsvr32.exe

pid	process
3256	regsvr32.exe

pid	pid_target	process	target process
2180	3256	WerFault.exe	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	rundll32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1276 schtasks.exe

pid	process
1276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
3220	rundll32.exe
3220	rundll32.exe
3220	rundll32.exe
3220	rundll32.exe
2180	WerFault.exe
2180	WerFault.exe
2180	WerFault.exe
2180	WerFault.exe
2180	WerFault.exe
2180	WerFault.exe
2180	WerFault.exe
2180	WerFault.exe
2180	WerFault.exe
2180	WerFault.exe
2180	WerFault.exe
2180	WerFault.exe
2180	WerFault.exe
2180	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

3220 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2180 WerFault.exe
Token: SeBackupPrivilege 2180 WerFault.exe
Token: SeDebugPrivilege 2180 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	2180	WerFault.exe
Token: SeBackupPrivilege	2180	WerFault.exe
Token: SeDebugPrivilege	2180	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 2604 wrote to memory of 3220	2604	rundll32.exe	rundll32.exe
PID 2604 wrote to memory of 3220	2604	rundll32.exe	rundll32.exe
PID 2604 wrote to memory of 3220	2604	rundll32.exe	rundll32.exe
PID 3220 wrote to memory of 3552	3220	rundll32.exe	explorer.exe
PID 3220 wrote to memory of 3552	3220	rundll32.exe	explorer.exe
PID 3220 wrote to memory of 3552	3220	rundll32.exe	explorer.exe
PID 3220 wrote to memory of 3552	3220	rundll32.exe	explorer.exe
PID 3220 wrote to memory of 3552	3220	rundll32.exe	explorer.exe
PID 3552 wrote to memory of 1276	3552	explorer.exe	schtasks.exe
PID 3552 wrote to memory of 1276	3552	explorer.exe	schtasks.exe
PID 3552 wrote to memory of 1276	3552	explorer.exe	schtasks.exe
PID 2356 wrote to memory of 3256	2356	regsvr32.exe	regsvr32.exe
PID 2356 wrote to memory of 3256	2356	regsvr32.exe	regsvr32.exe
PID 2356 wrote to memory of 3256	2356	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gaefvup.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2604

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gaefvup.dll,#1
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3220

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3552

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hqiuzecb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\gaefvup.dll\"" /SC ONCE /Z /ST 17:56 /ET 18:08
4⤵
- Creates scheduled task(s)
PID:1276

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\gaefvup.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\gaefvup.dll"
2⤵
- Loads dropped DLL
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 596
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gaefvup.dll
MD5
a011073b567e88385f9d2ce1b701c2f3

SHA1
a8acfc01b5abfbc41f2d83cfc5f033db47e07266

SHA256
cb88327ba2f0055799fffeb3b1be3c436951a206b1a85f3e39ba875e7a2b27c1

SHA512
537fdfb95129c79d29c61d2d3970533f355740600b63569b34cbf032a96af84db741b6362e8fc266539cf39b723532bf33d6b4cb31392d48270f9981d6ac8e1e

Download Submit
\Users\Admin\AppData\Local\Temp\gaefvup.dll
MD5
a011073b567e88385f9d2ce1b701c2f3

SHA1
a8acfc01b5abfbc41f2d83cfc5f033db47e07266

SHA256
cb88327ba2f0055799fffeb3b1be3c436951a206b1a85f3e39ba875e7a2b27c1

SHA512
537fdfb95129c79d29c61d2d3970533f355740600b63569b34cbf032a96af84db741b6362e8fc266539cf39b723532bf33d6b4cb31392d48270f9981d6ac8e1e

Download Submit
memory/1276-5-0x0000000000000000-mapping.dmp

Download
memory/2180-10-0x0000000003750000-0x0000000003751000-memory.dmp

Filesize
4KB

Download
memory/2180-12-0x00000000040D0000-0x00000000040D1000-memory.dmp

Filesize
4KB

Download
memory/3220-2-0x0000000000000000-mapping.dmp

Download
memory/3220-3-0x0000000004950000-0x0000000004970000-memory.dmp

Filesize
128KB

Download
memory/3256-8-0x0000000000000000-mapping.dmp

Download
memory/3256-11-0x0000000000000000-mapping.dmp

Download
memory/3552-4-0x0000000000000000-mapping.dmp

Download
memory/3552-6-0x0000000002720000-0x0000000002740000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads