qakbot | 57e4e9ee0ef7d9eb20ce9f1aa46bc1a5f780ab454620c97114213b4d34de330b

General

Target

57e4e9ee0ef7d9eb20ce9f1aa46bc1a5f780ab454620c97114213b4d34de330b.dll
Size

1.2MB
MD5

afd117a7bf8f7938f0bd8f0a205e0dda
SHA1

84f190f212277f0b2a4161df71cd16c32879fcc7
SHA256

57e4e9ee0ef7d9eb20ce9f1aa46bc1a5f780ab454620c97114213b4d34de330b
SHA512

38121179b75b2d294d6ffbaa53accc43842193b83fe596a6ba59f0b8bcc7337f5d27d699b64dd73a67712023b79af49b51cb35a866fb5c4c1928e3ca99a3f72d

Score

10^/10

qakbot biden12 1615580905 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

biden12

Campaign

1615580905

C2

24.229.150.54:995

109.12.111.14:443

173.21.10.71:2222

81.214.126.173:2222

75.118.1.141:443

98.252.118.134:443

71.74.12.34:443

186.31.77.42:443

81.97.154.100:443

71.117.132.169:443

24.139.72.117:443

67.165.206.193:993

106.51.52.111:443

47.196.192.184:443

71.197.126.250:443

24.95.61.62:443

47.22.148.6:443

195.12.154.8:443

71.163.223.159:443

197.45.110.165:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

400 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

108 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2024 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2024 rundll32.exe

pid	process
400	regsvr32.exe

pid	process
108	schtasks.exe

pid	process
2024	rundll32.exe

pid	process
2024	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1856 wrote to memory of 2024	1856	rundll32.exe	rundll32.exe
PID 1856 wrote to memory of 2024	1856	rundll32.exe	rundll32.exe
PID 1856 wrote to memory of 2024	1856	rundll32.exe	rundll32.exe
PID 1856 wrote to memory of 2024	1856	rundll32.exe	rundll32.exe
PID 1856 wrote to memory of 2024	1856	rundll32.exe	rundll32.exe
PID 1856 wrote to memory of 2024	1856	rundll32.exe	rundll32.exe
PID 1856 wrote to memory of 2024	1856	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 992	2024	rundll32.exe	explorer.exe
PID 2024 wrote to memory of 992	2024	rundll32.exe	explorer.exe
PID 2024 wrote to memory of 992	2024	rundll32.exe	explorer.exe
PID 2024 wrote to memory of 992	2024	rundll32.exe	explorer.exe
PID 2024 wrote to memory of 992	2024	rundll32.exe	explorer.exe
PID 2024 wrote to memory of 992	2024	rundll32.exe	explorer.exe
PID 992 wrote to memory of 108	992	explorer.exe	schtasks.exe
PID 992 wrote to memory of 108	992	explorer.exe	schtasks.exe
PID 992 wrote to memory of 108	992	explorer.exe	schtasks.exe
PID 992 wrote to memory of 108	992	explorer.exe	schtasks.exe
PID 240 wrote to memory of 1632	240	taskeng.exe	regsvr32.exe
PID 240 wrote to memory of 1632	240	taskeng.exe	regsvr32.exe
PID 240 wrote to memory of 1632	240	taskeng.exe	regsvr32.exe
PID 240 wrote to memory of 1632	240	taskeng.exe	regsvr32.exe
PID 240 wrote to memory of 1632	240	taskeng.exe	regsvr32.exe
PID 1632 wrote to memory of 400	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 400	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 400	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 400	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 400	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 400	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 400	1632	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57e4e9ee0ef7d9eb20ce9f1aa46bc1a5f780ab454620c97114213b4d34de330b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1856

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57e4e9ee0ef7d9eb20ce9f1aa46bc1a5f780ab454620c97114213b4d34de330b.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dwlottgze /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\57e4e9ee0ef7d9eb20ce9f1aa46bc1a5f780ab454620c97114213b4d34de330b.dll\"" /SC ONCE /Z /ST 22:23 /ET 22:35
4⤵
- Creates scheduled task(s)
PID:108

C:\Windows\system32\taskeng.exe
taskeng.exe {C6FB568D-47DA-45CD-9A05-CEDA4D8A1F84} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:240

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\57e4e9ee0ef7d9eb20ce9f1aa46bc1a5f780ab454620c97114213b4d34de330b.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\57e4e9ee0ef7d9eb20ce9f1aa46bc1a5f780ab454620c97114213b4d34de330b.dll"
3⤵
- Loads dropped DLL
PID:400

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\57e4e9ee0ef7d9eb20ce9f1aa46bc1a5f780ab454620c97114213b4d34de330b.dll
MD5
be68b6e135c31d78ad250a7faf249092

SHA1
aa4cc171ec850eaa7563469b2f7d5f17583075d7

SHA256
b5664aebe656deaeef0b1436ae6cf53c72de1d853714a7a959c80389311c3ca9

SHA512
e04a47911ad9a4f6d8fd402ab65b450517c8c4bc081f68f91238b59d1b418d6090418cdac3e414f8bcf2181b8e56f7be5cd72084b56f417dc2937f1f32e97c2d

Download Submit
\Users\Admin\AppData\Local\Temp\57e4e9ee0ef7d9eb20ce9f1aa46bc1a5f780ab454620c97114213b4d34de330b.dll
MD5
be68b6e135c31d78ad250a7faf249092

SHA1
aa4cc171ec850eaa7563469b2f7d5f17583075d7

SHA256
b5664aebe656deaeef0b1436ae6cf53c72de1d853714a7a959c80389311c3ca9

SHA512
e04a47911ad9a4f6d8fd402ab65b450517c8c4bc081f68f91238b59d1b418d6090418cdac3e414f8bcf2181b8e56f7be5cd72084b56f417dc2937f1f32e97c2d

Download Submit
memory/108-12-0x0000000000000000-mapping.dmp

Download
memory/400-17-0x0000000000000000-mapping.dmp

Download
memory/992-11-0x0000000000080000-0x00000000000BB000-memory.dmp

Filesize
236KB

Download
memory/992-13-0x0000000000080000-0x00000000000BB000-memory.dmp

Filesize
236KB

Download
memory/992-7-0x0000000000000000-mapping.dmp

Download
memory/992-9-0x0000000074B11000-0x0000000074B13000-memory.dmp

Filesize
8KB

Download
memory/1632-15-0x000007FEFC1D1000-0x000007FEFC1D3000-memory.dmp

Filesize
8KB

Download
memory/1632-14-0x0000000000000000-mapping.dmp

Download
memory/2024-10-0x0000000001F30000-0x0000000001F6B000-memory.dmp

Filesize
236KB

Download
memory/2024-5-0x0000000001E80000-0x0000000001EB9000-memory.dmp

Filesize
228KB

Download
memory/2024-2-0x0000000000000000-mapping.dmp

Download
memory/2024-6-0x0000000001F30000-0x0000000001F6B000-memory.dmp

Filesize
236KB

Download
memory/2024-4-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2024-3-0x00000000767E1000-0x00000000767E3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads