qakbot | faf66a75d07b9cc732f7c2196f288fd28ecece0ea039510d5701bff66ac82071

General

Target

faf66a75d07b9cc732f7c2196f288fd28ecece0ea039510d5701bff66ac82071.dll
Size

1.2MB
MD5

87ee40ef4914ba972e09f2ae11cd9ed6
SHA1

6a561f95015bab4705af35af2a3fdfb81793f88e
SHA256

faf66a75d07b9cc732f7c2196f288fd28ecece0ea039510d5701bff66ac82071
SHA512

541c00a25a877b6d661a7b9c482fa56f635e13e9fbc24bf77d299f31c167238140009783ccdae73dc1396d272df59bf5c543526a2aa8a0ff64af5fe0d7960449

Score

10^/10

qakbot biden12 1615580905 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

biden12

Campaign

1615580905

C2

24.229.150.54:995

109.12.111.14:443

173.21.10.71:2222

81.214.126.173:2222

75.118.1.141:443

98.252.118.134:443

71.74.12.34:443

186.31.77.42:443

81.97.154.100:443

71.117.132.169:443

24.139.72.117:443

67.165.206.193:993

106.51.52.111:443

47.196.192.184:443

71.197.126.250:443

24.95.61.62:443

47.22.148.6:443

195.12.154.8:443

71.163.223.159:443

197.45.110.165:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

748 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

280 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1996 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1996 rundll32.exe

pid	process
748	regsvr32.exe

pid	process
280	schtasks.exe

pid	process
1996	rundll32.exe

pid	process
1996	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1832 wrote to memory of 1996	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1996	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1996	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1996	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1996	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1996	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1996	1832	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1536	1996	rundll32.exe	explorer.exe
PID 1996 wrote to memory of 1536	1996	rundll32.exe	explorer.exe
PID 1996 wrote to memory of 1536	1996	rundll32.exe	explorer.exe
PID 1996 wrote to memory of 1536	1996	rundll32.exe	explorer.exe
PID 1996 wrote to memory of 1536	1996	rundll32.exe	explorer.exe
PID 1996 wrote to memory of 1536	1996	rundll32.exe	explorer.exe
PID 1536 wrote to memory of 280	1536	explorer.exe	schtasks.exe
PID 1536 wrote to memory of 280	1536	explorer.exe	schtasks.exe
PID 1536 wrote to memory of 280	1536	explorer.exe	schtasks.exe
PID 1536 wrote to memory of 280	1536	explorer.exe	schtasks.exe
PID 700 wrote to memory of 336	700	taskeng.exe	regsvr32.exe
PID 700 wrote to memory of 336	700	taskeng.exe	regsvr32.exe
PID 700 wrote to memory of 336	700	taskeng.exe	regsvr32.exe
PID 700 wrote to memory of 336	700	taskeng.exe	regsvr32.exe
PID 700 wrote to memory of 336	700	taskeng.exe	regsvr32.exe
PID 336 wrote to memory of 748	336	regsvr32.exe	regsvr32.exe
PID 336 wrote to memory of 748	336	regsvr32.exe	regsvr32.exe
PID 336 wrote to memory of 748	336	regsvr32.exe	regsvr32.exe
PID 336 wrote to memory of 748	336	regsvr32.exe	regsvr32.exe
PID 336 wrote to memory of 748	336	regsvr32.exe	regsvr32.exe
PID 336 wrote to memory of 748	336	regsvr32.exe	regsvr32.exe
PID 336 wrote to memory of 748	336	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\faf66a75d07b9cc732f7c2196f288fd28ecece0ea039510d5701bff66ac82071.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\faf66a75d07b9cc732f7c2196f288fd28ecece0ea039510d5701bff66ac82071.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bflucdep /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\faf66a75d07b9cc732f7c2196f288fd28ecece0ea039510d5701bff66ac82071.dll\"" /SC ONCE /Z /ST 21:10 /ET 21:22
4⤵
- Creates scheduled task(s)
PID:280

C:\Windows\system32\taskeng.exe
taskeng.exe {3D149E63-FD40-42E6-9928-1FA48B83794B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:700

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\faf66a75d07b9cc732f7c2196f288fd28ecece0ea039510d5701bff66ac82071.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\faf66a75d07b9cc732f7c2196f288fd28ecece0ea039510d5701bff66ac82071.dll"
3⤵
- Loads dropped DLL
PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\faf66a75d07b9cc732f7c2196f288fd28ecece0ea039510d5701bff66ac82071.dll

MD5
9009a044a7309da172d9e874db09f257

SHA1
f36ca683cfdd45e5eeed225db697933c845df5db

SHA256
87ea6d75a064399c48d6f42b562cbdbc4185eb74fccbd1f6c89be1d54fcfe97c

SHA512
daaae6aefea7ffffee9f8f98f896ccddd15a36af338285a8bb709e2105b0f04201188eb09d81f4543fa21ae7946b2edf89fcc6ea73cf9537b366483a6e6759bd

Download Submit
\Users\Admin\AppData\Local\Temp\faf66a75d07b9cc732f7c2196f288fd28ecece0ea039510d5701bff66ac82071.dll

MD5
9009a044a7309da172d9e874db09f257

SHA1
f36ca683cfdd45e5eeed225db697933c845df5db

SHA256
87ea6d75a064399c48d6f42b562cbdbc4185eb74fccbd1f6c89be1d54fcfe97c

SHA512
daaae6aefea7ffffee9f8f98f896ccddd15a36af338285a8bb709e2105b0f04201188eb09d81f4543fa21ae7946b2edf89fcc6ea73cf9537b366483a6e6759bd

Download Submit
memory/280-11-0x0000000000000000-mapping.dmp

Download
memory/336-15-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Filesize
8KB

Download
memory/336-14-0x0000000000000000-mapping.dmp

Download
memory/748-17-0x0000000000000000-mapping.dmp

Download
memory/1536-7-0x0000000000000000-mapping.dmp

Download
memory/1536-9-0x0000000073F01000-0x0000000073F03000-memory.dmp

Filesize
8KB

Download
memory/1536-12-0x0000000000360000-0x000000000039B000-memory.dmp

Filesize
236KB

Download
memory/1536-13-0x0000000000360000-0x000000000039B000-memory.dmp

Filesize
236KB

Download
memory/1996-6-0x00000000007A0000-0x00000000007DB000-memory.dmp

Filesize
236KB

Download
memory/1996-10-0x00000000007A0000-0x00000000007DB000-memory.dmp

Filesize
236KB

Download
memory/1996-5-0x00000000006C0000-0x00000000006F9000-memory.dmp

Filesize
228KB

Download
memory/1996-2-0x0000000000000000-mapping.dmp

Download
memory/1996-4-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1996-3-0x0000000075DE1000-0x0000000075DE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads