qakbot | d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf

General

Target

d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf.dll
Size

565KB
MD5

d095925bb57851b311351b95e8d95457
SHA1

a2816ed524260b45c62d9c1efe938af952d966ab
SHA256

d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf
SHA512

ce9cc91ab9c5a1ee97d17a323536b5a93ef323274084e4f2c0d371ac89b12c27256faa03c46254cae96088b7b96b78dd10a242f9ed561ee9993a274992efd38e

Score

10^/10

qakbot krk01 1611569149 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

krk01

Campaign

1611569149

C2

31.5.21.66:995

89.3.198.238:443

202.188.138.162:443

188.24.128.253:443

175.141.219.71:443

151.60.15.183:443

184.189.122.72:443

80.227.5.70:443

140.82.49.12:443

89.211.241.100:995

81.97.154.100:443

77.27.174.49:995

92.154.83.96:2078

42.3.8.54:443

71.187.170.235:443

46.153.36.53:995

71.182.142.63:443

105.186.102.16:443

50.244.112.106:443

78.63.226.32:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1080 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1688 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2000 rundll32.exe
2000 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2000 rundll32.exe

pid	process
1080	regsvr32.exe

pid	process
1688	schtasks.exe

pid	process
2000	rundll32.exe
2000	rundll32.exe

pid	process
2000	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 776 wrote to memory of 2000	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 2000	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 2000	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 2000	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 2000	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 2000	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 2000	776	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1420	2000	rundll32.exe	explorer.exe
PID 2000 wrote to memory of 1420	2000	rundll32.exe	explorer.exe
PID 2000 wrote to memory of 1420	2000	rundll32.exe	explorer.exe
PID 2000 wrote to memory of 1420	2000	rundll32.exe	explorer.exe
PID 2000 wrote to memory of 1420	2000	rundll32.exe	explorer.exe
PID 2000 wrote to memory of 1420	2000	rundll32.exe	explorer.exe
PID 1420 wrote to memory of 1688	1420	explorer.exe	schtasks.exe
PID 1420 wrote to memory of 1688	1420	explorer.exe	schtasks.exe
PID 1420 wrote to memory of 1688	1420	explorer.exe	schtasks.exe
PID 1420 wrote to memory of 1688	1420	explorer.exe	schtasks.exe
PID 540 wrote to memory of 960	540	taskeng.exe	regsvr32.exe
PID 540 wrote to memory of 960	540	taskeng.exe	regsvr32.exe
PID 540 wrote to memory of 960	540	taskeng.exe	regsvr32.exe
PID 540 wrote to memory of 960	540	taskeng.exe	regsvr32.exe
PID 540 wrote to memory of 960	540	taskeng.exe	regsvr32.exe
PID 960 wrote to memory of 1080	960	regsvr32.exe	regsvr32.exe
PID 960 wrote to memory of 1080	960	regsvr32.exe	regsvr32.exe
PID 960 wrote to memory of 1080	960	regsvr32.exe	regsvr32.exe
PID 960 wrote to memory of 1080	960	regsvr32.exe	regsvr32.exe
PID 960 wrote to memory of 1080	960	regsvr32.exe	regsvr32.exe
PID 960 wrote to memory of 1080	960	regsvr32.exe	regsvr32.exe
PID 960 wrote to memory of 1080	960	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kbajiecfpc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf.dll\"" /SC ONCE /Z /ST 22:55 /ET 23:07
4⤵
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\taskeng.exe
taskeng.exe {6B5D8777-CD61-4BB2-883A-655D639E98D8} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf.dll"
3⤵
- Loads dropped DLL
PID:1080

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf.dll
MD5
8bac227baa397ac730b4c65c19a79fe5

SHA1
f8735861ae35590e841daf67b43787a054339435

SHA256
bf3872c7e85d2f9d330aa6dc52f54e4003fadbed386c75fe3f22713269302e1b

SHA512
72b7f7c54436f38e6baa71f329e4b79b63e3987f6f61322a0128356afd23ffe64d126cea43385cfeba02d6971ce293ad35c8236236c3073495372ac2ca56de80

Download Submit
\Users\Admin\AppData\Local\Temp\d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf.dll
MD5
8bac227baa397ac730b4c65c19a79fe5

SHA1
f8735861ae35590e841daf67b43787a054339435

SHA256
bf3872c7e85d2f9d330aa6dc52f54e4003fadbed386c75fe3f22713269302e1b

SHA512
72b7f7c54436f38e6baa71f329e4b79b63e3987f6f61322a0128356afd23ffe64d126cea43385cfeba02d6971ce293ad35c8236236c3073495372ac2ca56de80

Download Submit
memory/960-12-0x0000000000000000-mapping.dmp

Download
memory/960-13-0x000007FEFBB61000-0x000007FEFBB63000-memory.dmp

Filesize
8KB

Download
memory/1080-15-0x0000000000000000-mapping.dmp

Download
memory/1420-6-0x0000000000000000-mapping.dmp

Download
memory/1420-8-0x0000000074901000-0x0000000074903000-memory.dmp

Filesize
8KB

Download
memory/1420-10-0x00000000000D0000-0x0000000000105000-memory.dmp

Filesize
212KB

Download
memory/1420-11-0x00000000000D0000-0x0000000000105000-memory.dmp

Filesize
212KB

Download
memory/1688-9-0x0000000000000000-mapping.dmp

Download
memory/2000-2-0x0000000000000000-mapping.dmp

Download
memory/2000-5-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2000-4-0x0000000074B20000-0x0000000074B55000-memory.dmp

Filesize
212KB

Download
memory/2000-3-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads