qakbot | 7c16cd83d2c94fd23635df1e30d20f88a9a0359870a7d8e7cae03269f980f023

General

Target

7c16cd83d2c94fd23635df1e30d20f88a9a0359870a7d8e7cae03269f980f023.dll
Size

1016KB
MD5

873e74b88e18c15365f236ac1f98e2e0
SHA1

aa43ad94aeb7800931206e733494148abfe39d3f
SHA256

7c16cd83d2c94fd23635df1e30d20f88a9a0359870a7d8e7cae03269f980f023
SHA512

0bd59ab2bd699f7120ca32faacd72119f956ccb31f65b36a564b64d3503f1f983c5b1c08e8f6dc09e203e2b14e53685cb28b053b374b0b90019b3d4e396fc120

Score

10^/10

qakbot tr 1612175155 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

tr

Campaign

1612175155

C2

89.3.198.238:443

172.78.30.215:443

85.52.72.32:2222

76.110.113.71:995

106.51.52.111:443

75.67.192.125:443

172.115.177.204:2222

197.45.110.165:995

82.76.47.211:443

45.77.115.208:443

45.32.211.207:443

144.202.38.185:443

207.246.116.237:995

149.28.101.90:995

149.28.101.90:8443

207.246.116.237:8443

144.202.38.185:2222

45.32.211.207:8443

149.28.101.90:443

149.28.101.90:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1460 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1568 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1312 rundll32.exe
1312 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1312 rundll32.exe

pid	process
1460	regsvr32.exe

pid	process
1568	schtasks.exe

pid	process
1312	rundll32.exe
1312	rundll32.exe

pid	process
1312	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1640 wrote to memory of 1312	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1312	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1312	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1312	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1312	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1312	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1312	1640	rundll32.exe	rundll32.exe
PID 1312 wrote to memory of 1016	1312	rundll32.exe	explorer.exe
PID 1312 wrote to memory of 1016	1312	rundll32.exe	explorer.exe
PID 1312 wrote to memory of 1016	1312	rundll32.exe	explorer.exe
PID 1312 wrote to memory of 1016	1312	rundll32.exe	explorer.exe
PID 1312 wrote to memory of 1016	1312	rundll32.exe	explorer.exe
PID 1312 wrote to memory of 1016	1312	rundll32.exe	explorer.exe
PID 1016 wrote to memory of 1568	1016	explorer.exe	schtasks.exe
PID 1016 wrote to memory of 1568	1016	explorer.exe	schtasks.exe
PID 1016 wrote to memory of 1568	1016	explorer.exe	schtasks.exe
PID 1016 wrote to memory of 1568	1016	explorer.exe	schtasks.exe
PID 636 wrote to memory of 912	636	taskeng.exe	regsvr32.exe
PID 636 wrote to memory of 912	636	taskeng.exe	regsvr32.exe
PID 636 wrote to memory of 912	636	taskeng.exe	regsvr32.exe
PID 636 wrote to memory of 912	636	taskeng.exe	regsvr32.exe
PID 636 wrote to memory of 912	636	taskeng.exe	regsvr32.exe
PID 912 wrote to memory of 1460	912	regsvr32.exe	regsvr32.exe
PID 912 wrote to memory of 1460	912	regsvr32.exe	regsvr32.exe
PID 912 wrote to memory of 1460	912	regsvr32.exe	regsvr32.exe
PID 912 wrote to memory of 1460	912	regsvr32.exe	regsvr32.exe
PID 912 wrote to memory of 1460	912	regsvr32.exe	regsvr32.exe
PID 912 wrote to memory of 1460	912	regsvr32.exe	regsvr32.exe
PID 912 wrote to memory of 1460	912	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c16cd83d2c94fd23635df1e30d20f88a9a0359870a7d8e7cae03269f980f023.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c16cd83d2c94fd23635df1e30d20f88a9a0359870a7d8e7cae03269f980f023.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1016

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zbwdfgdh /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\7c16cd83d2c94fd23635df1e30d20f88a9a0359870a7d8e7cae03269f980f023.dll\"" /SC ONCE /Z /ST 14:00 /ET 14:12
4⤵
- Creates scheduled task(s)
PID:1568

C:\Windows\system32\taskeng.exe
taskeng.exe {C4E4A3F8-5A44-476F-B590-00F295858A78} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:636

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\7c16cd83d2c94fd23635df1e30d20f88a9a0359870a7d8e7cae03269f980f023.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\7c16cd83d2c94fd23635df1e30d20f88a9a0359870a7d8e7cae03269f980f023.dll"
3⤵
- Loads dropped DLL
PID:1460

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7c16cd83d2c94fd23635df1e30d20f88a9a0359870a7d8e7cae03269f980f023.dll
MD5
babc9d51adcda32c57159338f33cc7e9

SHA1
ac444a80ca47a8770cc399e871df9143e91c08e7

SHA256
fc6756f3da18f111fb26f9e1a67a8beb7636088e471e7a2e137349dbb53c14e3

SHA512
a47eb52f91d4ad12228ccd0df486bdd654df68770c5b93336f2c6d6cb27ec2f678162d34dd71ccd4fea356de7814b7a1fccd0a4db70887838839631d6257b20b

Download Submit
\Users\Admin\AppData\Local\Temp\7c16cd83d2c94fd23635df1e30d20f88a9a0359870a7d8e7cae03269f980f023.dll
MD5
babc9d51adcda32c57159338f33cc7e9

SHA1
ac444a80ca47a8770cc399e871df9143e91c08e7

SHA256
fc6756f3da18f111fb26f9e1a67a8beb7636088e471e7a2e137349dbb53c14e3

SHA512
a47eb52f91d4ad12228ccd0df486bdd654df68770c5b93336f2c6d6cb27ec2f678162d34dd71ccd4fea356de7814b7a1fccd0a4db70887838839631d6257b20b

Download Submit
memory/912-15-0x000007FEFBEC1000-0x000007FEFBEC3000-memory.dmp

Filesize
8KB

Download
memory/912-14-0x0000000000000000-mapping.dmp

Download
memory/1016-12-0x00000000000D0000-0x0000000000105000-memory.dmp

Filesize
212KB

Download
memory/1016-7-0x0000000000000000-mapping.dmp

Download
memory/1016-9-0x00000000747B1000-0x00000000747B3000-memory.dmp

Filesize
8KB

Download
memory/1016-13-0x00000000000D0000-0x0000000000105000-memory.dmp

Filesize
212KB

Download
memory/1312-4-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/1312-10-0x00000000003C0000-0x00000000003F5000-memory.dmp

Filesize
212KB

Download
memory/1312-2-0x0000000000000000-mapping.dmp

Download
memory/1312-6-0x00000000003C0000-0x00000000003F5000-memory.dmp

Filesize
212KB

Download
memory/1312-5-0x0000000000370000-0x00000000003B7000-memory.dmp

Filesize
284KB

Download
memory/1312-3-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/1460-17-0x0000000000000000-mapping.dmp

Download
memory/1568-11-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads