qakbot | 618b1b6ffd257862409ffb1509cfe44f8659a79f93942bdb93386df734eadb64

General

Target

618b1b6ffd257862409ffb1509cfe44f8659a79f93942bdb93386df734eadb64.dll
Size

1.2MB
MD5

4778e9fec902a4b85e2007b58d0f4c1c
SHA1

cc404d3d7a59d76d18d1def2fa5a7e4b92cbcb0a
SHA256

618b1b6ffd257862409ffb1509cfe44f8659a79f93942bdb93386df734eadb64
SHA512

bd10850afa0684d9f11a07f2fa588428b872713aa3f15fc40160e58e2eff3eb6596de5222713ea353bbb61e353ad503e1135bc9d7699ee23f4c589aaf70e11d0

Score

10^/10

qakbot biden12 1615580905 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

biden12

Campaign

1615580905

C2

24.229.150.54:995

109.12.111.14:443

173.21.10.71:2222

81.214.126.173:2222

75.118.1.141:443

98.252.118.134:443

71.74.12.34:443

186.31.77.42:443

81.97.154.100:443

71.117.132.169:443

24.139.72.117:443

67.165.206.193:993

106.51.52.111:443

47.196.192.184:443

71.197.126.250:443

24.95.61.62:443

47.22.148.6:443

195.12.154.8:443

71.163.223.159:443

197.45.110.165:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1584 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1352 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1980 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1980 rundll32.exe

pid	process
1584	regsvr32.exe

pid	process
1352	schtasks.exe

pid	process
1980	rundll32.exe

pid	process
1980	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1656 wrote to memory of 1980	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1980	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1980	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1980	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1980	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1980	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1980	1656	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1528	1980	rundll32.exe	explorer.exe
PID 1980 wrote to memory of 1528	1980	rundll32.exe	explorer.exe
PID 1980 wrote to memory of 1528	1980	rundll32.exe	explorer.exe
PID 1980 wrote to memory of 1528	1980	rundll32.exe	explorer.exe
PID 1980 wrote to memory of 1528	1980	rundll32.exe	explorer.exe
PID 1980 wrote to memory of 1528	1980	rundll32.exe	explorer.exe
PID 1528 wrote to memory of 1352	1528	explorer.exe	schtasks.exe
PID 1528 wrote to memory of 1352	1528	explorer.exe	schtasks.exe
PID 1528 wrote to memory of 1352	1528	explorer.exe	schtasks.exe
PID 1528 wrote to memory of 1352	1528	explorer.exe	schtasks.exe
PID 1792 wrote to memory of 1232	1792	taskeng.exe	regsvr32.exe
PID 1792 wrote to memory of 1232	1792	taskeng.exe	regsvr32.exe
PID 1792 wrote to memory of 1232	1792	taskeng.exe	regsvr32.exe
PID 1792 wrote to memory of 1232	1792	taskeng.exe	regsvr32.exe
PID 1792 wrote to memory of 1232	1792	taskeng.exe	regsvr32.exe
PID 1232 wrote to memory of 1584	1232	regsvr32.exe	regsvr32.exe
PID 1232 wrote to memory of 1584	1232	regsvr32.exe	regsvr32.exe
PID 1232 wrote to memory of 1584	1232	regsvr32.exe	regsvr32.exe
PID 1232 wrote to memory of 1584	1232	regsvr32.exe	regsvr32.exe
PID 1232 wrote to memory of 1584	1232	regsvr32.exe	regsvr32.exe
PID 1232 wrote to memory of 1584	1232	regsvr32.exe	regsvr32.exe
PID 1232 wrote to memory of 1584	1232	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\618b1b6ffd257862409ffb1509cfe44f8659a79f93942bdb93386df734eadb64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\618b1b6ffd257862409ffb1509cfe44f8659a79f93942bdb93386df734eadb64.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qlpgbnkoi /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\618b1b6ffd257862409ffb1509cfe44f8659a79f93942bdb93386df734eadb64.dll\"" /SC ONCE /Z /ST 22:28 /ET 22:40
4⤵
- Creates scheduled task(s)
PID:1352

C:\Windows\system32\taskeng.exe
taskeng.exe {C7E3AC36-9012-4C15-966F-740D7C4E789C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\618b1b6ffd257862409ffb1509cfe44f8659a79f93942bdb93386df734eadb64.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\618b1b6ffd257862409ffb1509cfe44f8659a79f93942bdb93386df734eadb64.dll"
3⤵
- Loads dropped DLL
PID:1584

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\618b1b6ffd257862409ffb1509cfe44f8659a79f93942bdb93386df734eadb64.dll
MD5
c8737b1006b5ab02f73da7f2bf7a885a

SHA1
b9eb8c97ee320c83544e91ce7e0fa9877c4931a9

SHA256
12c51f9f55c02c61ce3999386af2a1a525cf38b45f1bfb25d2acaeb0795f72bb

SHA512
0f9b6d2a61d0a40b3e33dda31cdeba976afa93b5734213656260e123fd0ec6d5e2c039d76f8ab1a3e778d53c0780e9eb00068a52fa4201285dd23dbcba5efd07

Download Submit
\Users\Admin\AppData\Local\Temp\618b1b6ffd257862409ffb1509cfe44f8659a79f93942bdb93386df734eadb64.dll
MD5
c8737b1006b5ab02f73da7f2bf7a885a

SHA1
b9eb8c97ee320c83544e91ce7e0fa9877c4931a9

SHA256
12c51f9f55c02c61ce3999386af2a1a525cf38b45f1bfb25d2acaeb0795f72bb

SHA512
0f9b6d2a61d0a40b3e33dda31cdeba976afa93b5734213656260e123fd0ec6d5e2c039d76f8ab1a3e778d53c0780e9eb00068a52fa4201285dd23dbcba5efd07

Download Submit
memory/1232-14-0x0000000000000000-mapping.dmp

Download
memory/1232-15-0x000007FEFC251000-0x000007FEFC253000-memory.dmp

Filesize
8KB

Download
memory/1352-11-0x0000000000000000-mapping.dmp

Download
memory/1528-7-0x0000000000000000-mapping.dmp

Download
memory/1528-9-0x0000000074BC1000-0x0000000074BC3000-memory.dmp

Filesize
8KB

Download
memory/1528-12-0x00000000000E0000-0x000000000011B000-memory.dmp

Filesize
236KB

Download
memory/1528-13-0x00000000000E0000-0x000000000011B000-memory.dmp

Filesize
236KB

Download
memory/1584-17-0x0000000000000000-mapping.dmp

Download
memory/1980-10-0x0000000000970000-0x00000000009AB000-memory.dmp

Filesize
236KB

Download
memory/1980-2-0x0000000000000000-mapping.dmp

Download
memory/1980-6-0x0000000000970000-0x00000000009AB000-memory.dmp

Filesize
236KB

Download
memory/1980-5-0x0000000000210000-0x0000000000249000-memory.dmp

Filesize
228KB

Download
memory/1980-4-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1980-3-0x00000000765A1000-0x00000000765A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads