qakbot | d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf

General

Target

d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf.dll
Size

565KB
MD5

d095925bb57851b311351b95e8d95457
SHA1

a2816ed524260b45c62d9c1efe938af952d966ab
SHA256

d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf
SHA512

ce9cc91ab9c5a1ee97d17a323536b5a93ef323274084e4f2c0d371ac89b12c27256faa03c46254cae96088b7b96b78dd10a242f9ed561ee9993a274992efd38e

Score

10^/10

qakbot krk01 1611569149 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

krk01

Campaign

1611569149

C2

31.5.21.66:995

89.3.198.238:443

202.188.138.162:443

188.24.128.253:443

175.141.219.71:443

151.60.15.183:443

184.189.122.72:443

80.227.5.70:443

140.82.49.12:443

89.211.241.100:995

81.97.154.100:443

77.27.174.49:995

92.154.83.96:2078

42.3.8.54:443

71.187.170.235:443

46.153.36.53:995

71.182.142.63:443

105.186.102.16:443

50.244.112.106:443

78.63.226.32:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2844 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2748 2844 WerFault.exe regsvr32.exe

pid	process
2844	regsvr32.exe

pid	pid_target	process	target process
2748	2844	WerFault.exe	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	rundll32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3600 schtasks.exe

pid	process
3600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
4088	rundll32.exe
4088	rundll32.exe
4088	rundll32.exe
4088	rundll32.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

4088 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2748 WerFault.exe
Token: SeBackupPrivilege 2748 WerFault.exe
Token: SeDebugPrivilege 2748 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	2748	WerFault.exe
Token: SeBackupPrivilege	2748	WerFault.exe
Token: SeDebugPrivilege	2748	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 4020 wrote to memory of 4088	4020	rundll32.exe	rundll32.exe
PID 4020 wrote to memory of 4088	4020	rundll32.exe	rundll32.exe
PID 4020 wrote to memory of 4088	4020	rundll32.exe	rundll32.exe
PID 4088 wrote to memory of 3164	4088	rundll32.exe	explorer.exe
PID 4088 wrote to memory of 3164	4088	rundll32.exe	explorer.exe
PID 4088 wrote to memory of 3164	4088	rundll32.exe	explorer.exe
PID 4088 wrote to memory of 3164	4088	rundll32.exe	explorer.exe
PID 4088 wrote to memory of 3164	4088	rundll32.exe	explorer.exe
PID 3164 wrote to memory of 3600	3164	explorer.exe	schtasks.exe
PID 3164 wrote to memory of 3600	3164	explorer.exe	schtasks.exe
PID 3164 wrote to memory of 3600	3164	explorer.exe	schtasks.exe
PID 948 wrote to memory of 2844	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 2844	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 2844	948	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf.dll,#1
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4088

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3164

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn asqychqjs /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf.dll\"" /SC ONCE /Z /ST 22:55 /ET 23:07
4⤵
- Creates scheduled task(s)
PID:3600

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf.dll"
2⤵
- Loads dropped DLL
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 604
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf.dll
MD5
8bac227baa397ac730b4c65c19a79fe5

SHA1
f8735861ae35590e841daf67b43787a054339435

SHA256
bf3872c7e85d2f9d330aa6dc52f54e4003fadbed386c75fe3f22713269302e1b

SHA512
72b7f7c54436f38e6baa71f329e4b79b63e3987f6f61322a0128356afd23ffe64d126cea43385cfeba02d6971ce293ad35c8236236c3073495372ac2ca56de80

Download Submit
\Users\Admin\AppData\Local\Temp\d4c575a5d522c8e2cc79685a526ce185d021aef9299c019b0ac52c4e10769ccf.dll
MD5
8bac227baa397ac730b4c65c19a79fe5

SHA1
f8735861ae35590e841daf67b43787a054339435

SHA256
bf3872c7e85d2f9d330aa6dc52f54e4003fadbed386c75fe3f22713269302e1b

SHA512
72b7f7c54436f38e6baa71f329e4b79b63e3987f6f61322a0128356afd23ffe64d126cea43385cfeba02d6971ce293ad35c8236236c3073495372ac2ca56de80

Download Submit
memory/2748-12-0x00000000030C0000-0x00000000030C1000-memory.dmp

Filesize
4KB

Download
memory/2844-10-0x0000000000000000-mapping.dmp

Download
memory/3164-5-0x0000000000000000-mapping.dmp

Download
memory/3164-7-0x0000000000E20000-0x0000000000E55000-memory.dmp

Filesize
212KB

Download
memory/3164-8-0x0000000000E20000-0x0000000000E55000-memory.dmp

Filesize
212KB

Download
memory/3600-6-0x0000000000000000-mapping.dmp

Download
memory/4088-2-0x0000000000000000-mapping.dmp

Download
memory/4088-3-0x00000000740A0000-0x00000000740D5000-memory.dmp

Filesize
212KB

Download
memory/4088-4-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads