qakbot | 4d0bcd02aa9858d6cfafff3ad1686e2a49e785da11233803879e88e3408849e7

General

Target

final.bin.dll
Size

217KB
MD5

862828ee08c665ff1e9985ff59387645
SHA1

e8e701ca05d8dd7951bdc152088cdca5f6ef6892
SHA256

4d0bcd02aa9858d6cfafff3ad1686e2a49e785da11233803879e88e3408849e7
SHA512

2aea3f55c1ffaa6de87516afbe41efc515b190417ff76947551263fb92e0dc2e78d1e59a4ddfa65c095ff0c168e2d19b44f804c6713c69cdff79ba50056bfc23

Score

10^/10

qakbot tr 1618398298 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

tr

Campaign

1618398298

C2

47.196.192.184:443

216.201.162.158:443

136.232.34.70:443

71.41.184.10:3389

140.82.49.12:443

45.63.107.192:2222

45.63.107.192:443

149.28.98.196:443

45.32.211.207:443

144.202.38.185:443

45.77.115.208:2222

45.77.115.208:8443

207.246.116.237:995

45.77.117.108:443

149.28.99.97:443

149.28.99.97:995

149.28.98.196:995

45.32.211.207:995

45.32.211.207:2222

149.28.98.196:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1748 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3064 1748 WerFault.exe regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2668 schtasks.exe

pid	process
1748	regsvr32.exe

pid	pid_target	process	target process
3064	1748	WerFault.exe	regsvr32.exe

pid	process
2668	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

regsvr32.exeWerFault.exe

pid	process
2804	regsvr32.exe
2804	regsvr32.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

2804 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3064 WerFault.exe
Token: SeBackupPrivilege 3064 WerFault.exe
Token: SeDebugPrivilege 3064 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3064	WerFault.exe
Token: SeBackupPrivilege	3064	WerFault.exe
Token: SeDebugPrivilege	3064	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 2208 wrote to memory of 2804	2208	regsvr32.exe	regsvr32.exe
PID 2208 wrote to memory of 2804	2208	regsvr32.exe	regsvr32.exe
PID 2208 wrote to memory of 2804	2208	regsvr32.exe	regsvr32.exe
PID 2804 wrote to memory of 2656	2804	regsvr32.exe	explorer.exe
PID 2804 wrote to memory of 2656	2804	regsvr32.exe	explorer.exe
PID 2804 wrote to memory of 2656	2804	regsvr32.exe	explorer.exe
PID 2804 wrote to memory of 2656	2804	regsvr32.exe	explorer.exe
PID 2804 wrote to memory of 2656	2804	regsvr32.exe	explorer.exe
PID 2656 wrote to memory of 2668	2656	explorer.exe	schtasks.exe
PID 2656 wrote to memory of 2668	2656	explorer.exe	schtasks.exe
PID 2656 wrote to memory of 2668	2656	explorer.exe	schtasks.exe
PID 1436 wrote to memory of 1748	1436	regsvr32.exe	regsvr32.exe
PID 1436 wrote to memory of 1748	1436	regsvr32.exe	regsvr32.exe
PID 1436 wrote to memory of 1748	1436	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\final.bin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\final.bin.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn gbwwikga /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\final.bin.dll\"" /SC ONCE /Z /ST 10:27 /ET 10:39
4⤵
- Creates scheduled task(s)
PID:2668

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\final.bin.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\final.bin.dll"
2⤵
- Loads dropped DLL
PID:1748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 596
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3064

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\final.bin.dll
MD5
4e9b76618bf9f0d8421a9cbdba35616b

SHA1
887c3de0f7b042c2863cc7e374c70d118c8a9d9b

SHA256
d9e243d00dd1bb0ff3a2578f9a8bbcf945c0c75cb5ddefa19bff85ffae8f4318

SHA512
6880fe5a50798a207608b76e775b71988b5db5d63b2d3643f9eca001beb6c6a56544ea8bfc2fb13a9393aaac9016b800cce4c6cd00802d513ec84afc5b17062e

Download Submit
\Users\Admin\AppData\Local\Temp\final.bin.dll
MD5
4e9b76618bf9f0d8421a9cbdba35616b

SHA1
887c3de0f7b042c2863cc7e374c70d118c8a9d9b

SHA256
d9e243d00dd1bb0ff3a2578f9a8bbcf945c0c75cb5ddefa19bff85ffae8f4318

SHA512
6880fe5a50798a207608b76e775b71988b5db5d63b2d3643f9eca001beb6c6a56544ea8bfc2fb13a9393aaac9016b800cce4c6cd00802d513ec84afc5b17062e

Download Submit
memory/1748-121-0x0000000000000000-mapping.dmp

Download
memory/2656-115-0x0000000000000000-mapping.dmp

Download
memory/2656-119-0x0000000000600000-0x0000000000639000-memory.dmp

Filesize
228KB

Download
memory/2668-116-0x0000000000000000-mapping.dmp

Download
memory/2804-114-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads