qakbot | a72532e18a09f2bd12f6b7106b583a47c5316064999906c0cfda35c7a37340e3

General

Target

a72532e18a09f2bd12f6b7106b583a47c5316064999906c0cfda35c7a37340e3.dll
Size

1.2MB
MD5

cebb6e75e1cd27573f2773e045e45706
SHA1

ce3a12d56de38a65eca0c972a36783a0a383dedd
SHA256

a72532e18a09f2bd12f6b7106b583a47c5316064999906c0cfda35c7a37340e3
SHA512

129a51a90f8fac72d4c5809d81ae951689b50aa5c5732640d903779d9dbe8524cc8939e5f2b4497cb93f070b93f997e72813b92f5bd7429b3509d32680514869

Score

10^/10

qakbot biden12 1615580905 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

biden12

Campaign

1615580905

C2

24.229.150.54:995

109.12.111.14:443

173.21.10.71:2222

81.214.126.173:2222

75.118.1.141:443

98.252.118.134:443

71.74.12.34:443

186.31.77.42:443

81.97.154.100:443

71.117.132.169:443

24.139.72.117:443

67.165.206.193:993

106.51.52.111:443

47.196.192.184:443

71.197.126.250:443

24.95.61.62:443

47.22.148.6:443

195.12.154.8:443

71.163.223.159:443

197.45.110.165:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

748 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1516 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1168 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1168 rundll32.exe

pid	process
748	regsvr32.exe

pid	process
1516	schtasks.exe

pid	process
1168	rundll32.exe

pid	process
1168	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1596 wrote to memory of 1168	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1168	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1168	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1168	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1168	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1168	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1168	1596	rundll32.exe	rundll32.exe
PID 1168 wrote to memory of 1692	1168	rundll32.exe	explorer.exe
PID 1168 wrote to memory of 1692	1168	rundll32.exe	explorer.exe
PID 1168 wrote to memory of 1692	1168	rundll32.exe	explorer.exe
PID 1168 wrote to memory of 1692	1168	rundll32.exe	explorer.exe
PID 1168 wrote to memory of 1692	1168	rundll32.exe	explorer.exe
PID 1168 wrote to memory of 1692	1168	rundll32.exe	explorer.exe
PID 1692 wrote to memory of 1516	1692	explorer.exe	schtasks.exe
PID 1692 wrote to memory of 1516	1692	explorer.exe	schtasks.exe
PID 1692 wrote to memory of 1516	1692	explorer.exe	schtasks.exe
PID 1692 wrote to memory of 1516	1692	explorer.exe	schtasks.exe
PID 580 wrote to memory of 1084	580	taskeng.exe	regsvr32.exe
PID 580 wrote to memory of 1084	580	taskeng.exe	regsvr32.exe
PID 580 wrote to memory of 1084	580	taskeng.exe	regsvr32.exe
PID 580 wrote to memory of 1084	580	taskeng.exe	regsvr32.exe
PID 580 wrote to memory of 1084	580	taskeng.exe	regsvr32.exe
PID 1084 wrote to memory of 748	1084	regsvr32.exe	regsvr32.exe
PID 1084 wrote to memory of 748	1084	regsvr32.exe	regsvr32.exe
PID 1084 wrote to memory of 748	1084	regsvr32.exe	regsvr32.exe
PID 1084 wrote to memory of 748	1084	regsvr32.exe	regsvr32.exe
PID 1084 wrote to memory of 748	1084	regsvr32.exe	regsvr32.exe
PID 1084 wrote to memory of 748	1084	regsvr32.exe	regsvr32.exe
PID 1084 wrote to memory of 748	1084	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a72532e18a09f2bd12f6b7106b583a47c5316064999906c0cfda35c7a37340e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a72532e18a09f2bd12f6b7106b583a47c5316064999906c0cfda35c7a37340e3.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vhuivwss /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a72532e18a09f2bd12f6b7106b583a47c5316064999906c0cfda35c7a37340e3.dll\"" /SC ONCE /Z /ST 22:19 /ET 22:31
4⤵
- Creates scheduled task(s)
PID:1516

C:\Windows\system32\taskeng.exe
taskeng.exe {00727168-A724-4494-8884-669FA25954FC} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a72532e18a09f2bd12f6b7106b583a47c5316064999906c0cfda35c7a37340e3.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\a72532e18a09f2bd12f6b7106b583a47c5316064999906c0cfda35c7a37340e3.dll"
3⤵
- Loads dropped DLL
PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a72532e18a09f2bd12f6b7106b583a47c5316064999906c0cfda35c7a37340e3.dll

MD5
01ce38dcb53c0827fd13dc706b8840f7

SHA1
7205948c21b263bf45cb92a9d8cdbf5d9a1cbfe4

SHA256
e078dda3eabc90aed07b270e49e88914df423a0c387ef6c4304d2b102182aba3

SHA512
e0b87d8159dc5548c8494ad596e2119a54818834942f317139c0d07a434afd274e065648708ede3c24e4707d14161fe7474f013c88030286445cc508bc182970

Download Submit
\Users\Admin\AppData\Local\Temp\a72532e18a09f2bd12f6b7106b583a47c5316064999906c0cfda35c7a37340e3.dll

MD5
01ce38dcb53c0827fd13dc706b8840f7

SHA1
7205948c21b263bf45cb92a9d8cdbf5d9a1cbfe4

SHA256
e078dda3eabc90aed07b270e49e88914df423a0c387ef6c4304d2b102182aba3

SHA512
e0b87d8159dc5548c8494ad596e2119a54818834942f317139c0d07a434afd274e065648708ede3c24e4707d14161fe7474f013c88030286445cc508bc182970

Download Submit
memory/748-17-0x0000000000000000-mapping.dmp

Download
memory/1084-14-0x0000000000000000-mapping.dmp

Download
memory/1084-15-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download
memory/1168-6-0x0000000000770000-0x00000000007AB000-memory.dmp

Filesize
236KB

Download
memory/1168-10-0x0000000000770000-0x00000000007AB000-memory.dmp

Filesize
236KB

Download
memory/1168-2-0x0000000000000000-mapping.dmp

Download
memory/1168-5-0x00000000006E0000-0x0000000000719000-memory.dmp

Filesize
228KB

Download
memory/1168-4-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/1168-3-0x0000000075781000-0x0000000075783000-memory.dmp

Filesize
8KB

Download
memory/1516-12-0x0000000000000000-mapping.dmp

Download
memory/1692-9-0x0000000074521000-0x0000000074523000-memory.dmp

Filesize
8KB

Download
memory/1692-11-0x0000000000080000-0x00000000000BB000-memory.dmp

Filesize
236KB

Download
memory/1692-13-0x0000000000080000-0x00000000000BB000-memory.dmp

Filesize
236KB

Download
memory/1692-7-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads