qakbot | bf4a01bdb10b150c7db52a797ed62cd672186bdecd5b3a80b058dd35dbd3893a

General

Target

bf4a01bdb10b150c7db52a797ed62cd672186bdecd5b3a80b058dd35dbd3893a.dll
Size

412KB
MD5

89cad94816346d793c113ce5387d5b72
SHA1

de7b6c243ae71b8f744ca88af5aa1154d46790fc
SHA256

bf4a01bdb10b150c7db52a797ed62cd672186bdecd5b3a80b058dd35dbd3893a
SHA512

c4633b6980c6629ce46776ddf4b532a2f40f4d28760db36123a4367afb2004c3ca310cfe1fa1c45f64762af69b02cc7cc26bf8010b738475c7fe1e168f1e89c0

Score

10^/10

qakbot biden10 1615296616 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

biden10

Campaign

1615296616

C2

79.115.174.55:443

196.151.252.84:443

24.229.150.54:995

24.117.107.120:443

106.51.85.162:443

90.65.236.181:2222

184.189.122.72:443

47.196.192.184:443

136.232.34.70:443

80.227.5.69:443

195.12.154.8:443

105.198.236.101:443

190.85.91.154:443

83.110.103.152:443

83.196.56.65:2222

24.139.72.117:443

24.55.112.61:443

47.22.148.6:443

86.220.62.251:2222

83.110.9.71:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1688 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1604 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1408 regsvr32.exe
1408 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1408 regsvr32.exe

pid	process
1688	regsvr32.exe

pid	process
1604	schtasks.exe

pid	process
1408	regsvr32.exe
1408	regsvr32.exe

pid	process
1408	regsvr32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1088 wrote to memory of 1408	1088	regsvr32.exe	regsvr32.exe
PID 1088 wrote to memory of 1408	1088	regsvr32.exe	regsvr32.exe
PID 1088 wrote to memory of 1408	1088	regsvr32.exe	regsvr32.exe
PID 1088 wrote to memory of 1408	1088	regsvr32.exe	regsvr32.exe
PID 1088 wrote to memory of 1408	1088	regsvr32.exe	regsvr32.exe
PID 1088 wrote to memory of 1408	1088	regsvr32.exe	regsvr32.exe
PID 1088 wrote to memory of 1408	1088	regsvr32.exe	regsvr32.exe
PID 1408 wrote to memory of 1224	1408	regsvr32.exe	explorer.exe
PID 1408 wrote to memory of 1224	1408	regsvr32.exe	explorer.exe
PID 1408 wrote to memory of 1224	1408	regsvr32.exe	explorer.exe
PID 1408 wrote to memory of 1224	1408	regsvr32.exe	explorer.exe
PID 1408 wrote to memory of 1224	1408	regsvr32.exe	explorer.exe
PID 1408 wrote to memory of 1224	1408	regsvr32.exe	explorer.exe
PID 1224 wrote to memory of 1604	1224	explorer.exe	schtasks.exe
PID 1224 wrote to memory of 1604	1224	explorer.exe	schtasks.exe
PID 1224 wrote to memory of 1604	1224	explorer.exe	schtasks.exe
PID 1224 wrote to memory of 1604	1224	explorer.exe	schtasks.exe
PID 868 wrote to memory of 980	868	taskeng.exe	regsvr32.exe
PID 868 wrote to memory of 980	868	taskeng.exe	regsvr32.exe
PID 868 wrote to memory of 980	868	taskeng.exe	regsvr32.exe
PID 868 wrote to memory of 980	868	taskeng.exe	regsvr32.exe
PID 868 wrote to memory of 980	868	taskeng.exe	regsvr32.exe
PID 980 wrote to memory of 1688	980	regsvr32.exe	regsvr32.exe
PID 980 wrote to memory of 1688	980	regsvr32.exe	regsvr32.exe
PID 980 wrote to memory of 1688	980	regsvr32.exe	regsvr32.exe
PID 980 wrote to memory of 1688	980	regsvr32.exe	regsvr32.exe
PID 980 wrote to memory of 1688	980	regsvr32.exe	regsvr32.exe
PID 980 wrote to memory of 1688	980	regsvr32.exe	regsvr32.exe
PID 980 wrote to memory of 1688	980	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bf4a01bdb10b150c7db52a797ed62cd672186bdecd5b3a80b058dd35dbd3893a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\bf4a01bdb10b150c7db52a797ed62cd672186bdecd5b3a80b058dd35dbd3893a.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1224

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn tndeulpvj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\bf4a01bdb10b150c7db52a797ed62cd672186bdecd5b3a80b058dd35dbd3893a.dll\"" /SC ONCE /Z /ST 07:48 /ET 08:00
4⤵
- Creates scheduled task(s)
PID:1604

C:\Windows\system32\taskeng.exe
taskeng.exe {D551AD48-8798-4F49-BDC5-52C357624F15} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\bf4a01bdb10b150c7db52a797ed62cd672186bdecd5b3a80b058dd35dbd3893a.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\bf4a01bdb10b150c7db52a797ed62cd672186bdecd5b3a80b058dd35dbd3893a.dll"
3⤵
- Loads dropped DLL
PID:1688

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bf4a01bdb10b150c7db52a797ed62cd672186bdecd5b3a80b058dd35dbd3893a.dll
MD5
0facf15ef8687487b3dd5c65c516f37e

SHA1
838ff073da257f7fc3447f1e3c7f9b043027dcd7

SHA256
c4ea0cf5278b115b9810caa706f73ae46200a301e3ccb3b77f029849f23360ef

SHA512
af4d1508b7ccc44201c06334c7e9278b5de40637ee767b0d896c7092ea827f0caa2622042d6238887f58718f0e0515c854fe097f3fc79c67d3ef648e717cd8b0

Download Submit
\Users\Admin\AppData\Local\Temp\bf4a01bdb10b150c7db52a797ed62cd672186bdecd5b3a80b058dd35dbd3893a.dll
MD5
0facf15ef8687487b3dd5c65c516f37e

SHA1
838ff073da257f7fc3447f1e3c7f9b043027dcd7

SHA256
c4ea0cf5278b115b9810caa706f73ae46200a301e3ccb3b77f029849f23360ef

SHA512
af4d1508b7ccc44201c06334c7e9278b5de40637ee767b0d896c7092ea827f0caa2622042d6238887f58718f0e0515c854fe097f3fc79c67d3ef648e717cd8b0

Download Submit
memory/980-13-0x0000000000000000-mapping.dmp

Download
memory/1088-2-0x000007FEFBDA1000-0x000007FEFBDA3000-memory.dmp

Filesize
8KB

Download
memory/1224-12-0x00000000000D0000-0x0000000000105000-memory.dmp

Filesize
212KB

Download
memory/1224-7-0x0000000000000000-mapping.dmp

Download
memory/1224-9-0x0000000074621000-0x0000000074623000-memory.dmp

Filesize
8KB

Download
memory/1224-10-0x00000000000D0000-0x0000000000105000-memory.dmp

Filesize
212KB

Download
memory/1408-6-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1408-5-0x0000000074820000-0x0000000074855000-memory.dmp

Filesize
212KB

Download
memory/1408-4-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1408-3-0x0000000000000000-mapping.dmp

Download
memory/1604-11-0x0000000000000000-mapping.dmp

Download
memory/1688-16-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads