qakbot | 9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b

General

Target

9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b.dll
Size

805KB
MD5

2aadd286af6533008b1b3859b7ea0036
SHA1

d59b43c2b7c6c4ff56a50ae1545a045408531710
SHA256

9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b
SHA512

e887b4399af0c08ade01085e4f4b6d7db58e47a1b63ba7ee2fb92f787b86658a13cb2428d63ad2c686b1435d3794b2620bd878ac5f440d4598ff3bd591728891

Score

10^/10

qakbot tr 1612776124 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

tr

Campaign

1612776124

C2

176.205.222.30:2078

174.76.188.217:22

105.226.10.142:443

87.202.87.210:2222

203.194.110.74:443

95.77.223.148:443

45.77.115.208:2222

47.146.169.85:443

76.94.200.148:995

23.240.70.80:443

193.252.48.200:443

154.124.130.140:995

45.32.211.207:2222

149.28.98.196:2222

149.28.98.196:995

149.28.101.90:995

207.246.77.75:2222

45.63.107.192:995

173.70.165.101:995

207.246.116.237:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

540 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

384 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2004 rundll32.exe
2004 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2004 rundll32.exe

pid	process
540	regsvr32.exe

pid	process
384	schtasks.exe

pid	process
2004	rundll32.exe
2004	rundll32.exe

pid	process
2004	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1656 wrote to memory of 2004	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 2004	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 2004	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 2004	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 2004	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 2004	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 2004	1656	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1652	2004	rundll32.exe	explorer.exe
PID 2004 wrote to memory of 1652	2004	rundll32.exe	explorer.exe
PID 2004 wrote to memory of 1652	2004	rundll32.exe	explorer.exe
PID 2004 wrote to memory of 1652	2004	rundll32.exe	explorer.exe
PID 2004 wrote to memory of 1652	2004	rundll32.exe	explorer.exe
PID 2004 wrote to memory of 1652	2004	rundll32.exe	explorer.exe
PID 1652 wrote to memory of 384	1652	explorer.exe	schtasks.exe
PID 1652 wrote to memory of 384	1652	explorer.exe	schtasks.exe
PID 1652 wrote to memory of 384	1652	explorer.exe	schtasks.exe
PID 1652 wrote to memory of 384	1652	explorer.exe	schtasks.exe
PID 1096 wrote to memory of 556	1096	taskeng.exe	regsvr32.exe
PID 1096 wrote to memory of 556	1096	taskeng.exe	regsvr32.exe
PID 1096 wrote to memory of 556	1096	taskeng.exe	regsvr32.exe
PID 1096 wrote to memory of 556	1096	taskeng.exe	regsvr32.exe
PID 1096 wrote to memory of 556	1096	taskeng.exe	regsvr32.exe
PID 556 wrote to memory of 540	556	regsvr32.exe	regsvr32.exe
PID 556 wrote to memory of 540	556	regsvr32.exe	regsvr32.exe
PID 556 wrote to memory of 540	556	regsvr32.exe	regsvr32.exe
PID 556 wrote to memory of 540	556	regsvr32.exe	regsvr32.exe
PID 556 wrote to memory of 540	556	regsvr32.exe	regsvr32.exe
PID 556 wrote to memory of 540	556	regsvr32.exe	regsvr32.exe
PID 556 wrote to memory of 540	556	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn oztcdndbe /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b.dll\"" /SC ONCE /Z /ST 18:22 /ET 18:34
4⤵
- Creates scheduled task(s)
PID:384

C:\Windows\system32\taskeng.exe
taskeng.exe {BBF6A8BA-9DE4-4DFD-8E83-092A676E9679} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:556

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b.dll"
3⤵
- Loads dropped DLL
PID:540

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b.dll
MD5
32435695c79bbed4385a0bf18f314f35

SHA1
54fee549af9ce5cad37fec8c8170805b7518c06e

SHA256
fa310cb818555b4d5311807a76ce4c0a2af228447e07a6fb33d7cbae606315ea

SHA512
e7fa3d6b62b796c7e2f3dcc9f7da08d012f6be8bc8f13b2cd9eac3021646806d0f03faad62dfb8c85b4121cbc00eb77c76cafe586d5b902a70a2b87d61615178

Download Submit
\Users\Admin\AppData\Local\Temp\9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b.dll
MD5
32435695c79bbed4385a0bf18f314f35

SHA1
54fee549af9ce5cad37fec8c8170805b7518c06e

SHA256
fa310cb818555b4d5311807a76ce4c0a2af228447e07a6fb33d7cbae606315ea

SHA512
e7fa3d6b62b796c7e2f3dcc9f7da08d012f6be8bc8f13b2cd9eac3021646806d0f03faad62dfb8c85b4121cbc00eb77c76cafe586d5b902a70a2b87d61615178

Download Submit
memory/384-11-0x0000000000000000-mapping.dmp

Download
memory/540-17-0x0000000000000000-mapping.dmp

Download
memory/556-15-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Filesize
8KB

Download
memory/556-14-0x0000000000000000-mapping.dmp

Download
memory/1652-7-0x0000000000000000-mapping.dmp

Download
memory/1652-9-0x0000000074161000-0x0000000074163000-memory.dmp

Filesize
8KB

Download
memory/1652-12-0x0000000000080000-0x00000000000B5000-memory.dmp

Filesize
212KB

Download
memory/1652-13-0x0000000000080000-0x00000000000B5000-memory.dmp

Filesize
212KB

Download
memory/2004-10-0x0000000001FD0000-0x0000000002005000-memory.dmp

Filesize
212KB

Download
memory/2004-6-0x0000000001FD0000-0x0000000002005000-memory.dmp

Filesize
212KB

Download
memory/2004-2-0x0000000000000000-mapping.dmp

Download
memory/2004-5-0x0000000000820000-0x0000000000853000-memory.dmp

Filesize
204KB

Download
memory/2004-4-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2004-3-0x0000000074D11000-0x0000000074D13000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads