qakbot | 4d0bcd02aa9858d6cfafff3ad1686e2a49e785da11233803879e88e3408849e7

General

Target

final.bin.dll
Size

217KB
MD5

862828ee08c665ff1e9985ff59387645
SHA1

e8e701ca05d8dd7951bdc152088cdca5f6ef6892
SHA256

4d0bcd02aa9858d6cfafff3ad1686e2a49e785da11233803879e88e3408849e7
SHA512

2aea3f55c1ffaa6de87516afbe41efc515b190417ff76947551263fb92e0dc2e78d1e59a4ddfa65c095ff0c168e2d19b44f804c6713c69cdff79ba50056bfc23

Score

10^/10

qakbot tr 1618398298 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

tr

Campaign

1618398298

C2

47.196.192.184:443

216.201.162.158:443

136.232.34.70:443

71.41.184.10:3389

140.82.49.12:443

45.63.107.192:2222

45.63.107.192:443

149.28.98.196:443

45.32.211.207:443

144.202.38.185:443

45.77.115.208:2222

45.77.115.208:8443

207.246.116.237:995

45.77.117.108:443

149.28.99.97:443

149.28.99.97:995

149.28.98.196:995

45.32.211.207:995

45.32.211.207:2222

149.28.98.196:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1008 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1436 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

1980 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1980 regsvr32.exe

pid	process
1008	regsvr32.exe

pid	process
1436	schtasks.exe

pid	process
1980	regsvr32.exe

pid	process
1980	regsvr32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 940 wrote to memory of 1980	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1980	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1980	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1980	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1980	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1980	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1980	940	regsvr32.exe	regsvr32.exe
PID 1980 wrote to memory of 840	1980	regsvr32.exe	explorer.exe
PID 1980 wrote to memory of 840	1980	regsvr32.exe	explorer.exe
PID 1980 wrote to memory of 840	1980	regsvr32.exe	explorer.exe
PID 1980 wrote to memory of 840	1980	regsvr32.exe	explorer.exe
PID 1980 wrote to memory of 840	1980	regsvr32.exe	explorer.exe
PID 1980 wrote to memory of 840	1980	regsvr32.exe	explorer.exe
PID 840 wrote to memory of 1436	840	explorer.exe	schtasks.exe
PID 840 wrote to memory of 1436	840	explorer.exe	schtasks.exe
PID 840 wrote to memory of 1436	840	explorer.exe	schtasks.exe
PID 840 wrote to memory of 1436	840	explorer.exe	schtasks.exe
PID 484 wrote to memory of 1076	484	taskeng.exe	regsvr32.exe
PID 484 wrote to memory of 1076	484	taskeng.exe	regsvr32.exe
PID 484 wrote to memory of 1076	484	taskeng.exe	regsvr32.exe
PID 484 wrote to memory of 1076	484	taskeng.exe	regsvr32.exe
PID 484 wrote to memory of 1076	484	taskeng.exe	regsvr32.exe
PID 1076 wrote to memory of 1008	1076	regsvr32.exe	regsvr32.exe
PID 1076 wrote to memory of 1008	1076	regsvr32.exe	regsvr32.exe
PID 1076 wrote to memory of 1008	1076	regsvr32.exe	regsvr32.exe
PID 1076 wrote to memory of 1008	1076	regsvr32.exe	regsvr32.exe
PID 1076 wrote to memory of 1008	1076	regsvr32.exe	regsvr32.exe
PID 1076 wrote to memory of 1008	1076	regsvr32.exe	regsvr32.exe
PID 1076 wrote to memory of 1008	1076	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\final.bin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\final.bin.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:840

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qusgoxclg /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\final.bin.dll\"" /SC ONCE /Z /ST 12:27 /ET 12:39
4⤵
- Creates scheduled task(s)
PID:1436

C:\Windows\system32\taskeng.exe
taskeng.exe {E760A96A-EB4E-4819-8EDF-3F9867B86814} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:484

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\final.bin.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\final.bin.dll"
3⤵
- Loads dropped DLL
PID:1008

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\final.bin.dll
MD5
4e9b76618bf9f0d8421a9cbdba35616b

SHA1
887c3de0f7b042c2863cc7e374c70d118c8a9d9b

SHA256
d9e243d00dd1bb0ff3a2578f9a8bbcf945c0c75cb5ddefa19bff85ffae8f4318

SHA512
6880fe5a50798a207608b76e775b71988b5db5d63b2d3643f9eca001beb6c6a56544ea8bfc2fb13a9393aaac9016b800cce4c6cd00802d513ec84afc5b17062e

Download Submit
\Users\Admin\AppData\Local\Temp\final.bin.dll
MD5
4e9b76618bf9f0d8421a9cbdba35616b

SHA1
887c3de0f7b042c2863cc7e374c70d118c8a9d9b

SHA256
d9e243d00dd1bb0ff3a2578f9a8bbcf945c0c75cb5ddefa19bff85ffae8f4318

SHA512
6880fe5a50798a207608b76e775b71988b5db5d63b2d3643f9eca001beb6c6a56544ea8bfc2fb13a9393aaac9016b800cce4c6cd00802d513ec84afc5b17062e

Download Submit
memory/840-63-0x0000000000000000-mapping.dmp

Download
memory/840-65-0x0000000073F41000-0x0000000073F43000-memory.dmp

Filesize
8KB

Download
memory/840-66-0x0000000000080000-0x00000000000B9000-memory.dmp

Filesize
228KB

Download
memory/940-60-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

Filesize
8KB

Download
memory/1008-71-0x0000000000000000-mapping.dmp

Download
memory/1076-68-0x0000000000000000-mapping.dmp

Download
memory/1436-67-0x0000000000000000-mapping.dmp

Download
memory/1980-61-0x0000000000000000-mapping.dmp

Download
memory/1980-62-0x0000000075051000-0x0000000075053000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads