qakbot | 44e91f129e24afb6fe38bfa1436bf92f63d97c0b9f411854dde1bfbf498ea3e3

General

Target

qbot.dll
Size

255KB
MD5

df1bfe7672d36827a458fa7dbf3bc2bb
SHA1

98fd75c1624b525b4fb527d193a0adaba6d6b9e4
SHA256

44e91f129e24afb6fe38bfa1436bf92f63d97c0b9f411854dde1bfbf498ea3e3
SHA512

410ab89da086ccd9367b2c6d3b95b9f1dd42ffe456d8b4d9ad79ac7a0632709a558388361502fb3b1d763d66901d5247e8894e2801d5fa411763f834305b6bf8

Score

10^/10

qakbot abc101 1606294013 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

abc101

Campaign

1606294013

C2

98.115.243.237:443

78.101.21.73:443

185.163.221.77:2222

2.51.246.190:995

2.50.2.11:995

175.137.79.81:443

42.201.228.106:995

185.246.9.69:995

81.133.234.36:2222

24.205.42.241:443

73.239.229.107:995

102.185.58.126:443

173.245.152.231:443

105.101.216.210:443

89.137.195.167:995

174.76.21.134:443

41.238.217.126:6881

47.138.204.19:443

79.166.83.103:2222

92.154.83.96:1194

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

764 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1564 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1300 rundll32.exe
1300 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1300 rundll32.exe

pid	process
764	regsvr32.exe

pid	process
1564	schtasks.exe

pid	process
1300	rundll32.exe
1300	rundll32.exe

pid	process
1300	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1944 wrote to memory of 1300	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1300	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1300	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1300	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1300	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1300	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1300	1944	rundll32.exe	rundll32.exe
PID 1300 wrote to memory of 908	1300	rundll32.exe	explorer.exe
PID 1300 wrote to memory of 908	1300	rundll32.exe	explorer.exe
PID 1300 wrote to memory of 908	1300	rundll32.exe	explorer.exe
PID 1300 wrote to memory of 908	1300	rundll32.exe	explorer.exe
PID 1300 wrote to memory of 908	1300	rundll32.exe	explorer.exe
PID 1300 wrote to memory of 908	1300	rundll32.exe	explorer.exe
PID 908 wrote to memory of 1564	908	explorer.exe	schtasks.exe
PID 908 wrote to memory of 1564	908	explorer.exe	schtasks.exe
PID 908 wrote to memory of 1564	908	explorer.exe	schtasks.exe
PID 908 wrote to memory of 1564	908	explorer.exe	schtasks.exe
PID 1068 wrote to memory of 940	1068	taskeng.exe	regsvr32.exe
PID 1068 wrote to memory of 940	1068	taskeng.exe	regsvr32.exe
PID 1068 wrote to memory of 940	1068	taskeng.exe	regsvr32.exe
PID 1068 wrote to memory of 940	1068	taskeng.exe	regsvr32.exe
PID 1068 wrote to memory of 940	1068	taskeng.exe	regsvr32.exe
PID 940 wrote to memory of 764	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 764	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 764	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 764	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 764	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 764	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 764	940	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qbot.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qbot.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn inasbxqcf /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\qbot.dll\"" /SC ONCE /Z /ST 01:11 /ET 01:23
4⤵
- Creates scheduled task(s)
PID:1564

C:\Windows\system32\taskeng.exe
taskeng.exe {03F0ED98-485C-4A22-9712-29E510DDD625} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\qbot.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\qbot.dll"
3⤵
- Loads dropped DLL
PID:764

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\qbot.dll
MD5
3b5538f5b78c658a3864aed263a1c9c1

SHA1
226e6e06f7309ebff1bc0a80022895342a14e346

SHA256
5a5e41b93ad4e7dfd936271f92245dda13417841a7ca86cc42b3009d786b0af0

SHA512
a3fca9f31fd46c6b0455b3d392edc5b550596f6fa6b14eb47118d0f56a2f50b372c94b372d83775f0e2f5e86463b11906613274b3e70d5ac4dbc11c900898260

Download Submit
\Users\Admin\AppData\Local\Temp\qbot.dll
MD5
3b5538f5b78c658a3864aed263a1c9c1

SHA1
226e6e06f7309ebff1bc0a80022895342a14e346

SHA256
5a5e41b93ad4e7dfd936271f92245dda13417841a7ca86cc42b3009d786b0af0

SHA512
a3fca9f31fd46c6b0455b3d392edc5b550596f6fa6b14eb47118d0f56a2f50b372c94b372d83775f0e2f5e86463b11906613274b3e70d5ac4dbc11c900898260

Download Submit
memory/764-10-0x0000000000000000-mapping.dmp

Download
memory/908-3-0x00000000000A0000-0x00000000000A2000-memory.dmp

Filesize
8KB

Download
memory/908-5-0x0000000000000000-mapping.dmp

Download
memory/908-7-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download
memory/940-8-0x0000000000000000-mapping.dmp

Download
memory/1300-2-0x0000000000000000-mapping.dmp

Download
memory/1300-4-0x0000000000230000-0x0000000000250000-memory.dmp

Filesize
128KB

Download
memory/1564-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads