qakbot | 80cfabe6a394c7737a22d5ea72c604fb65fb6b66e979e848d07507343fbdb705

General

Target

442855327891204.dat.dll
Size

1.4MB
MD5

6bddbc2adb3ba1c00f82a27bf6a1a984
SHA1

06a5ac5269665d1a9faa1f1ef726a1a3a5d1529f
SHA256

80cfabe6a394c7737a22d5ea72c604fb65fb6b66e979e848d07507343fbdb705
SHA512

9173bdba5169c80ba24bac4190295412fb38ad65f483a44b85168bc0b9f8918280bdde62293a55602befc729ea3fa0758a48b4fcd2433389700a4e9b99b61e79

Score

10^/10

qakbot clinton01 1618240616 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

clinton01

Campaign

1618240616

C2

193.248.221.184:2222

96.61.23.88:995

75.67.192.125:443

78.63.226.32:443

186.28.181.226:443

45.46.53.140:2222

190.85.91.154:443

105.198.236.101:443

136.232.34.70:443

140.82.49.12:443

197.45.110.165:995

216.201.162.158:443

189.210.115.207:443

149.28.101.90:2222

45.63.107.192:2222

45.32.211.207:443

45.32.211.207:995

45.32.211.207:8443

45.32.211.207:2222

149.28.98.196:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

864 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1068 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1232 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1232 rundll32.exe

pid	process
864	regsvr32.exe

pid	process
1068	schtasks.exe

pid	process
1232	rundll32.exe

pid	process
1232	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 2020 wrote to memory of 1232	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1232	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1232	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1232	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1232	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1232	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1232	2020	rundll32.exe	rundll32.exe
PID 1232 wrote to memory of 1092	1232	rundll32.exe	explorer.exe
PID 1232 wrote to memory of 1092	1232	rundll32.exe	explorer.exe
PID 1232 wrote to memory of 1092	1232	rundll32.exe	explorer.exe
PID 1232 wrote to memory of 1092	1232	rundll32.exe	explorer.exe
PID 1232 wrote to memory of 1092	1232	rundll32.exe	explorer.exe
PID 1232 wrote to memory of 1092	1232	rundll32.exe	explorer.exe
PID 1092 wrote to memory of 1068	1092	explorer.exe	schtasks.exe
PID 1092 wrote to memory of 1068	1092	explorer.exe	schtasks.exe
PID 1092 wrote to memory of 1068	1092	explorer.exe	schtasks.exe
PID 1092 wrote to memory of 1068	1092	explorer.exe	schtasks.exe
PID 968 wrote to memory of 1684	968	taskeng.exe	regsvr32.exe
PID 968 wrote to memory of 1684	968	taskeng.exe	regsvr32.exe
PID 968 wrote to memory of 1684	968	taskeng.exe	regsvr32.exe
PID 968 wrote to memory of 1684	968	taskeng.exe	regsvr32.exe
PID 968 wrote to memory of 1684	968	taskeng.exe	regsvr32.exe
PID 1684 wrote to memory of 864	1684	regsvr32.exe	regsvr32.exe
PID 1684 wrote to memory of 864	1684	regsvr32.exe	regsvr32.exe
PID 1684 wrote to memory of 864	1684	regsvr32.exe	regsvr32.exe
PID 1684 wrote to memory of 864	1684	regsvr32.exe	regsvr32.exe
PID 1684 wrote to memory of 864	1684	regsvr32.exe	regsvr32.exe
PID 1684 wrote to memory of 864	1684	regsvr32.exe	regsvr32.exe
PID 1684 wrote to memory of 864	1684	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\442855327891204.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\442855327891204.dat.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn takhyznsbl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\442855327891204.dat.dll\"" /SC ONCE /Z /ST 20:34 /ET 20:46
4⤵
- Creates scheduled task(s)
PID:1068

C:\Windows\system32\taskeng.exe
taskeng.exe {2E4B6A07-F12A-4C39-885C-39A5A4472EDE} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\442855327891204.dat.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\442855327891204.dat.dll"
3⤵
- Loads dropped DLL
PID:864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\442855327891204.dat.dll

MD5
eb81470d1a9d4659e875503273c0cd62

SHA1
bc8bc7d06b32f95321814e0d991b9836be4b83e3

SHA256
d1548a8bef0444c7ebd1b8c152a89ad2d62c5406e9d93e77e6250d74f4ac6e4f

SHA512
06dd3b23bd344224b140cb4ee2ba178660ffe27c2c875fb6859b3752053d7bbc0ff467ead509b44d8414e5f8c8c966353069fd225eb4d5c7d5e04a70614e9018

Download Submit
\Users\Admin\AppData\Local\Temp\442855327891204.dat.dll

MD5
eb81470d1a9d4659e875503273c0cd62

SHA1
bc8bc7d06b32f95321814e0d991b9836be4b83e3

SHA256
d1548a8bef0444c7ebd1b8c152a89ad2d62c5406e9d93e77e6250d74f4ac6e4f

SHA512
06dd3b23bd344224b140cb4ee2ba178660ffe27c2c875fb6859b3752053d7bbc0ff467ead509b44d8414e5f8c8c966353069fd225eb4d5c7d5e04a70614e9018

Download Submit
memory/864-74-0x0000000000000000-mapping.dmp

Download
memory/1068-70-0x0000000000000000-mapping.dmp

Download
memory/1092-66-0x0000000000000000-mapping.dmp

Download
memory/1092-68-0x0000000074C51000-0x0000000074C53000-memory.dmp

Filesize
8KB

Download
memory/1092-69-0x0000000000080000-0x0000000000099000-memory.dmp

Filesize
100KB

Download
memory/1232-65-0x0000000000320000-0x0000000000339000-memory.dmp

Filesize
100KB

Download
memory/1232-60-0x0000000000000000-mapping.dmp

Download
memory/1232-64-0x0000000000270000-0x000000000029D000-memory.dmp

Filesize
180KB

Download
memory/1232-63-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/1232-62-0x00000000008F0000-0x0000000000A5C000-memory.dmp

Filesize
1.4MB

Download
memory/1232-61-0x0000000076281000-0x0000000076283000-memory.dmp

Filesize
8KB

Download
memory/1684-71-0x0000000000000000-mapping.dmp

Download
memory/1684-72-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads