qakbot | 2032c13190d9347fc677e840f295918ea8f0f8bb17d29a083afe19c1c09d4fd4

General

Target

dump.dll
Size

232KB
MD5

78ebf1acdac12e5855b0a305149a77c7
SHA1

08209879a52b5a08b945577337097c76f776f8cf
SHA256

2032c13190d9347fc677e840f295918ea8f0f8bb17d29a083afe19c1c09d4fd4
SHA512

0922573efa8367247a550ae48fb6e11990bd39c024eb356d60714ff46ebd4cfa84a39acbd53583d625c84f94321d2144ebf2514e5a3c96d2fa14e0add50d30e2

Score

10^/10

qakbot notset 1618398961 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1618398961

C2

47.196.192.184:443

216.201.162.158:443

136.232.34.70:443

71.41.184.10:3389

140.82.49.12:443

45.63.107.192:2222

45.63.107.192:443

149.28.98.196:443

45.32.211.207:443

144.202.38.185:443

45.77.115.208:2222

45.77.115.208:8443

207.246.116.237:995

45.77.117.108:443

149.28.99.97:443

149.28.99.97:995

149.28.98.196:995

45.32.211.207:995

45.32.211.207:2222

149.28.98.196:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

696 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

804 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

1376 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1376 regsvr32.exe

pid	process
696	regsvr32.exe

pid	process
804	schtasks.exe

pid	process
1376	regsvr32.exe

pid	process
1376	regsvr32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1864 wrote to memory of 1376	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1376	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1376	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1376	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1376	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1376	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1376	1864	regsvr32.exe	regsvr32.exe
PID 1376 wrote to memory of 272	1376	regsvr32.exe	explorer.exe
PID 1376 wrote to memory of 272	1376	regsvr32.exe	explorer.exe
PID 1376 wrote to memory of 272	1376	regsvr32.exe	explorer.exe
PID 1376 wrote to memory of 272	1376	regsvr32.exe	explorer.exe
PID 1376 wrote to memory of 272	1376	regsvr32.exe	explorer.exe
PID 1376 wrote to memory of 272	1376	regsvr32.exe	explorer.exe
PID 272 wrote to memory of 804	272	explorer.exe	schtasks.exe
PID 272 wrote to memory of 804	272	explorer.exe	schtasks.exe
PID 272 wrote to memory of 804	272	explorer.exe	schtasks.exe
PID 272 wrote to memory of 804	272	explorer.exe	schtasks.exe
PID 1904 wrote to memory of 1032	1904	taskeng.exe	regsvr32.exe
PID 1904 wrote to memory of 1032	1904	taskeng.exe	regsvr32.exe
PID 1904 wrote to memory of 1032	1904	taskeng.exe	regsvr32.exe
PID 1904 wrote to memory of 1032	1904	taskeng.exe	regsvr32.exe
PID 1904 wrote to memory of 1032	1904	taskeng.exe	regsvr32.exe
PID 1032 wrote to memory of 696	1032	regsvr32.exe	regsvr32.exe
PID 1032 wrote to memory of 696	1032	regsvr32.exe	regsvr32.exe
PID 1032 wrote to memory of 696	1032	regsvr32.exe	regsvr32.exe
PID 1032 wrote to memory of 696	1032	regsvr32.exe	regsvr32.exe
PID 1032 wrote to memory of 696	1032	regsvr32.exe	regsvr32.exe
PID 1032 wrote to memory of 696	1032	regsvr32.exe	regsvr32.exe
PID 1032 wrote to memory of 696	1032	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dump.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\dump.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:272

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn uvrzziocb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\dump.dll\"" /SC ONCE /Z /ST 16:27 /ET 16:39
4⤵
- Creates scheduled task(s)
PID:804

C:\Windows\system32\taskeng.exe
taskeng.exe {02F81962-19FF-45F7-A87A-40302BAA2423} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\dump.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\dump.dll"
3⤵
- Loads dropped DLL
PID:696

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dump.dll
MD5
e666fb3d680fd65fdced5a59beaa56ae

SHA1
a96cd1d29a062b2713ef976a19c6bd29f4a9c7ec

SHA256
f09b7af4e7ea1b1502ad074978afe631f7179d44a2d7a1eec5d7111977f545bd

SHA512
fe3b262200c2e5955eca95947357f5ff8949dc30fa7d9f77ddf28d085c5993fb796f87d4b8fac0a88850c32cadf04acf6fffae7680acfcf6c246c5cd20627b3b

Download Submit
\Users\Admin\AppData\Local\Temp\dump.dll
MD5
e666fb3d680fd65fdced5a59beaa56ae

SHA1
a96cd1d29a062b2713ef976a19c6bd29f4a9c7ec

SHA256
f09b7af4e7ea1b1502ad074978afe631f7179d44a2d7a1eec5d7111977f545bd

SHA512
fe3b262200c2e5955eca95947357f5ff8949dc30fa7d9f77ddf28d085c5993fb796f87d4b8fac0a88850c32cadf04acf6fffae7680acfcf6c246c5cd20627b3b

Download Submit
memory/272-63-0x0000000000000000-mapping.dmp

Download
memory/272-65-0x0000000074E81000-0x0000000074E83000-memory.dmp

Filesize
8KB

Download
memory/272-67-0x00000000000C0000-0x00000000000FA000-memory.dmp

Filesize
232KB

Download
memory/696-71-0x0000000000000000-mapping.dmp

Download
memory/804-66-0x0000000000000000-mapping.dmp

Download
memory/1032-68-0x0000000000000000-mapping.dmp

Download
memory/1376-60-0x0000000000000000-mapping.dmp

Download
memory/1376-61-0x0000000076A81000-0x0000000076A83000-memory.dmp

Filesize
8KB

Download
memory/1376-62-0x0000000000200000-0x000000000023A000-memory.dmp

Filesize
232KB

Download
memory/1864-59-0x000007FEFC471000-0x000007FEFC473000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads