qakbot | 44e91f129e24afb6fe38bfa1436bf92f63d97c0b9f411854dde1bfbf498ea3e3

General

Target

qbot.dll
Size

255KB
MD5

df1bfe7672d36827a458fa7dbf3bc2bb
SHA1

98fd75c1624b525b4fb527d193a0adaba6d6b9e4
SHA256

44e91f129e24afb6fe38bfa1436bf92f63d97c0b9f411854dde1bfbf498ea3e3
SHA512

410ab89da086ccd9367b2c6d3b95b9f1dd42ffe456d8b4d9ad79ac7a0632709a558388361502fb3b1d763d66901d5247e8894e2801d5fa411763f834305b6bf8

Score

10^/10

qakbot abc101 1606294013 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

abc101

Campaign

1606294013

C2

98.115.243.237:443

78.101.21.73:443

185.163.221.77:2222

2.51.246.190:995

2.50.2.11:995

175.137.79.81:443

42.201.228.106:995

185.246.9.69:995

81.133.234.36:2222

24.205.42.241:443

73.239.229.107:995

102.185.58.126:443

173.245.152.231:443

105.101.216.210:443

89.137.195.167:995

174.76.21.134:443

41.238.217.126:6881

47.138.204.19:443

79.166.83.103:2222

92.154.83.96:1194

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2004 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3944 2004 WerFault.exe regsvr32.exe

pid	process
2004	regsvr32.exe

pid	pid_target	process	target process
3944	2004	WerFault.exe	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	rundll32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3988 schtasks.exe

pid	process
3988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
3772	rundll32.exe
3772	rundll32.exe
3772	rundll32.exe
3772	rundll32.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

3772 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3944 WerFault.exe
Token: SeBackupPrivilege 3944 WerFault.exe
Token: SeDebugPrivilege 3944 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3944	WerFault.exe
Token: SeBackupPrivilege	3944	WerFault.exe
Token: SeDebugPrivilege	3944	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 744 wrote to memory of 3772	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 3772	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 3772	744	rundll32.exe	rundll32.exe
PID 3772 wrote to memory of 196	3772	rundll32.exe	explorer.exe
PID 3772 wrote to memory of 196	3772	rundll32.exe	explorer.exe
PID 3772 wrote to memory of 196	3772	rundll32.exe	explorer.exe
PID 3772 wrote to memory of 196	3772	rundll32.exe	explorer.exe
PID 3772 wrote to memory of 196	3772	rundll32.exe	explorer.exe
PID 196 wrote to memory of 3988	196	explorer.exe	schtasks.exe
PID 196 wrote to memory of 3988	196	explorer.exe	schtasks.exe
PID 196 wrote to memory of 3988	196	explorer.exe	schtasks.exe
PID 4084 wrote to memory of 2004	4084	regsvr32.exe	regsvr32.exe
PID 4084 wrote to memory of 2004	4084	regsvr32.exe	regsvr32.exe
PID 4084 wrote to memory of 2004	4084	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qbot.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qbot.dll,#1
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3772

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:196

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn puenejzvfn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\qbot.dll\"" /SC ONCE /Z /ST 01:10 /ET 01:22
4⤵
- Creates scheduled task(s)
PID:3988

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\qbot.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4084

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\qbot.dll"
2⤵
- Loads dropped DLL
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 596
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\qbot.dll
MD5
3b5538f5b78c658a3864aed263a1c9c1

SHA1
226e6e06f7309ebff1bc0a80022895342a14e346

SHA256
5a5e41b93ad4e7dfd936271f92245dda13417841a7ca86cc42b3009d786b0af0

SHA512
a3fca9f31fd46c6b0455b3d392edc5b550596f6fa6b14eb47118d0f56a2f50b372c94b372d83775f0e2f5e86463b11906613274b3e70d5ac4dbc11c900898260

Download Submit
\Users\Admin\AppData\Local\Temp\qbot.dll
MD5
3b5538f5b78c658a3864aed263a1c9c1

SHA1
226e6e06f7309ebff1bc0a80022895342a14e346

SHA256
5a5e41b93ad4e7dfd936271f92245dda13417841a7ca86cc42b3009d786b0af0

SHA512
a3fca9f31fd46c6b0455b3d392edc5b550596f6fa6b14eb47118d0f56a2f50b372c94b372d83775f0e2f5e86463b11906613274b3e70d5ac4dbc11c900898260

Download Submit
memory/196-4-0x0000000000000000-mapping.dmp

Download
memory/196-6-0x0000000000350000-0x0000000000370000-memory.dmp

Filesize
128KB

Download
memory/2004-8-0x0000000000000000-mapping.dmp

Download
memory/2004-11-0x0000000000000000-mapping.dmp

Download
memory/3772-2-0x0000000000000000-mapping.dmp

Download
memory/3772-3-0x0000000004F20000-0x0000000004F40000-memory.dmp

Filesize
128KB

Download
memory/3944-10-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/3988-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads