qakbot | 5ba695894baddae9c1a15ec6ae72ab338809a50c74c62d95c8b13764fd2f4f6b

General

Target

5ba695894baddae9c1a15ec6ae72ab338809a50c74c62d95c8b13764fd2f4f6b.dll
Size

1.2MB
MD5

84af9eac7a5cc03c348597bdb652ee14
SHA1

88cde8c80b69381eb30796ddbfcf70f9a4c62850
SHA256

5ba695894baddae9c1a15ec6ae72ab338809a50c74c62d95c8b13764fd2f4f6b
SHA512

569a9be36c723ac3926a0928470961160df9cfdf0b3b67cd1bdc6ea97a6f9b9765aa7fa38e9890509b4af65daf4d1d5daa0491e8e8f49d97a425db723b59e4c9

Score

10^/10

qakbot biden12 1615580905 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

biden12

Campaign

1615580905

C2

24.229.150.54:995

109.12.111.14:443

173.21.10.71:2222

81.214.126.173:2222

75.118.1.141:443

98.252.118.134:443

71.74.12.34:443

186.31.77.42:443

81.97.154.100:443

71.117.132.169:443

24.139.72.117:443

67.165.206.193:993

106.51.52.111:443

47.196.192.184:443

71.197.126.250:443

24.95.61.62:443

47.22.148.6:443

195.12.154.8:443

71.163.223.159:443

197.45.110.165:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

916 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

316 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1516 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1516 rundll32.exe

pid	process
916	regsvr32.exe

pid	process
316	schtasks.exe

pid	process
1516	rundll32.exe

pid	process
1516	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1152 wrote to memory of 1516	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1516	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1516	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1516	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1516	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1516	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1516	1152	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 1192	1516	rundll32.exe	explorer.exe
PID 1516 wrote to memory of 1192	1516	rundll32.exe	explorer.exe
PID 1516 wrote to memory of 1192	1516	rundll32.exe	explorer.exe
PID 1516 wrote to memory of 1192	1516	rundll32.exe	explorer.exe
PID 1516 wrote to memory of 1192	1516	rundll32.exe	explorer.exe
PID 1516 wrote to memory of 1192	1516	rundll32.exe	explorer.exe
PID 1192 wrote to memory of 316	1192	explorer.exe	schtasks.exe
PID 1192 wrote to memory of 316	1192	explorer.exe	schtasks.exe
PID 1192 wrote to memory of 316	1192	explorer.exe	schtasks.exe
PID 1192 wrote to memory of 316	1192	explorer.exe	schtasks.exe
PID 1456 wrote to memory of 900	1456	taskeng.exe	regsvr32.exe
PID 1456 wrote to memory of 900	1456	taskeng.exe	regsvr32.exe
PID 1456 wrote to memory of 900	1456	taskeng.exe	regsvr32.exe
PID 1456 wrote to memory of 900	1456	taskeng.exe	regsvr32.exe
PID 1456 wrote to memory of 900	1456	taskeng.exe	regsvr32.exe
PID 900 wrote to memory of 916	900	regsvr32.exe	regsvr32.exe
PID 900 wrote to memory of 916	900	regsvr32.exe	regsvr32.exe
PID 900 wrote to memory of 916	900	regsvr32.exe	regsvr32.exe
PID 900 wrote to memory of 916	900	regsvr32.exe	regsvr32.exe
PID 900 wrote to memory of 916	900	regsvr32.exe	regsvr32.exe
PID 900 wrote to memory of 916	900	regsvr32.exe	regsvr32.exe
PID 900 wrote to memory of 916	900	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ba695894baddae9c1a15ec6ae72ab338809a50c74c62d95c8b13764fd2f4f6b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ba695894baddae9c1a15ec6ae72ab338809a50c74c62d95c8b13764fd2f4f6b.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lnasgvfk /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\5ba695894baddae9c1a15ec6ae72ab338809a50c74c62d95c8b13764fd2f4f6b.dll\"" /SC ONCE /Z /ST 14:58 /ET 15:10
4⤵
- Creates scheduled task(s)
PID:316

C:\Windows\system32\taskeng.exe
taskeng.exe {77D82511-B386-4CA5-862D-73FD4ADF6BB5} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\5ba695894baddae9c1a15ec6ae72ab338809a50c74c62d95c8b13764fd2f4f6b.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\5ba695894baddae9c1a15ec6ae72ab338809a50c74c62d95c8b13764fd2f4f6b.dll"
3⤵
- Loads dropped DLL
PID:916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5ba695894baddae9c1a15ec6ae72ab338809a50c74c62d95c8b13764fd2f4f6b.dll

MD5
3782069de47387256ca3be95078bc89a

SHA1
dc80d3de1caf63c75825bd5044f767b312d86408

SHA256
7d4fced50fe236eb25cc8812d20dde4c406b292ea79137557a4b075f1932160b

SHA512
978ac0932adefe31c0d8740df43b715a1f4ca977fd567862e6e92f82833961625fadab98ba0ebcea991451e0eb088b41fbd25d2d285f2e33e57f0c87560208ca

Download Submit
\Users\Admin\AppData\Local\Temp\5ba695894baddae9c1a15ec6ae72ab338809a50c74c62d95c8b13764fd2f4f6b.dll

MD5
3782069de47387256ca3be95078bc89a

SHA1
dc80d3de1caf63c75825bd5044f767b312d86408

SHA256
7d4fced50fe236eb25cc8812d20dde4c406b292ea79137557a4b075f1932160b

SHA512
978ac0932adefe31c0d8740df43b715a1f4ca977fd567862e6e92f82833961625fadab98ba0ebcea991451e0eb088b41fbd25d2d285f2e33e57f0c87560208ca

Download Submit
memory/316-11-0x0000000000000000-mapping.dmp

Download
memory/900-15-0x000007FEFB991000-0x000007FEFB993000-memory.dmp

Filesize
8KB

Download
memory/900-14-0x0000000000000000-mapping.dmp

Download
memory/916-17-0x0000000000000000-mapping.dmp

Download
memory/1192-7-0x0000000000000000-mapping.dmp

Download
memory/1192-9-0x0000000074431000-0x0000000074433000-memory.dmp

Filesize
8KB

Download
memory/1192-12-0x0000000000080000-0x00000000000BB000-memory.dmp

Filesize
236KB

Download
memory/1192-13-0x0000000000080000-0x00000000000BB000-memory.dmp

Filesize
236KB

Download
memory/1516-5-0x00000000002A0000-0x00000000002D9000-memory.dmp

Filesize
228KB

Download
memory/1516-10-0x0000000002070000-0x0000000002071000-memory.dmp

Filesize
4KB

Download
memory/1516-6-0x0000000002070000-0x00000000020AB000-memory.dmp

Filesize
236KB

Download
memory/1516-2-0x0000000000000000-mapping.dmp

Download
memory/1516-4-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1516-3-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads