qakbot | bfa15946d599ea25d58d2e8ec749a1a31c7ae9f785f99e78efdcd7069d42429e

General

Target

de38eb7fd5b7fa9eb360d0f837eee204.dll
Size

594KB
MD5

de38eb7fd5b7fa9eb360d0f837eee204
SHA1

2b33ea04c23752f5fe92e21766ecb69715062080
SHA256

bfa15946d599ea25d58d2e8ec749a1a31c7ae9f785f99e78efdcd7069d42429e
SHA512

1c65257e5bd0edd330ec4a2e36e02038967ee323a53803ec06939e7a2437a96ac2cc1da2ddb9434b0a1e52377e4d62789a420101d0536d21728c6c2f48c4ff79

Score

10^/10

qakbot biden31 1618914389 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

biden31

Campaign

1618914389

C2

75.67.192.125:443

78.63.226.32:443

95.77.223.148:443

83.110.109.164:2222

140.82.49.12:443

71.41.184.10:3389

73.25.124.140:2222

105.198.236.101:443

45.32.211.207:995

207.246.116.237:995

45.77.117.108:8443

45.63.107.192:2222

149.28.101.90:995

45.77.115.208:2222

45.77.115.208:443

45.32.211.207:8443

45.32.211.207:2222

207.246.116.237:443

45.77.117.108:2222

149.28.98.196:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

880 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1548 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2008 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2008 rundll32.exe

pid	process
880	regsvr32.exe

pid	process
1548	schtasks.exe

pid	process
2008	rundll32.exe

pid	process
2008	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1632 wrote to memory of 2008	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2008	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2008	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2008	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2008	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2008	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2008	1632	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1652	2008	rundll32.exe	explorer.exe
PID 2008 wrote to memory of 1652	2008	rundll32.exe	explorer.exe
PID 2008 wrote to memory of 1652	2008	rundll32.exe	explorer.exe
PID 2008 wrote to memory of 1652	2008	rundll32.exe	explorer.exe
PID 2008 wrote to memory of 1652	2008	rundll32.exe	explorer.exe
PID 2008 wrote to memory of 1652	2008	rundll32.exe	explorer.exe
PID 1652 wrote to memory of 1548	1652	explorer.exe	schtasks.exe
PID 1652 wrote to memory of 1548	1652	explorer.exe	schtasks.exe
PID 1652 wrote to memory of 1548	1652	explorer.exe	schtasks.exe
PID 1652 wrote to memory of 1548	1652	explorer.exe	schtasks.exe
PID 572 wrote to memory of 544	572	taskeng.exe	regsvr32.exe
PID 572 wrote to memory of 544	572	taskeng.exe	regsvr32.exe
PID 572 wrote to memory of 544	572	taskeng.exe	regsvr32.exe
PID 572 wrote to memory of 544	572	taskeng.exe	regsvr32.exe
PID 572 wrote to memory of 544	572	taskeng.exe	regsvr32.exe
PID 544 wrote to memory of 880	544	regsvr32.exe	regsvr32.exe
PID 544 wrote to memory of 880	544	regsvr32.exe	regsvr32.exe
PID 544 wrote to memory of 880	544	regsvr32.exe	regsvr32.exe
PID 544 wrote to memory of 880	544	regsvr32.exe	regsvr32.exe
PID 544 wrote to memory of 880	544	regsvr32.exe	regsvr32.exe
PID 544 wrote to memory of 880	544	regsvr32.exe	regsvr32.exe
PID 544 wrote to memory of 880	544	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de38eb7fd5b7fa9eb360d0f837eee204.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de38eb7fd5b7fa9eb360d0f837eee204.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn djznxingd /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\de38eb7fd5b7fa9eb360d0f837eee204.dll\"" /SC ONCE /Z /ST 13:49 /ET 14:01
4⤵
- Creates scheduled task(s)
PID:1548

C:\Windows\system32\taskeng.exe
taskeng.exe {8981F898-9B55-4FC6-9188-2EC0DD7FE5DB} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\de38eb7fd5b7fa9eb360d0f837eee204.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\de38eb7fd5b7fa9eb360d0f837eee204.dll"
3⤵
- Loads dropped DLL
PID:880

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\de38eb7fd5b7fa9eb360d0f837eee204.dll
MD5
85085346c6af6369d0da86bb5328b936

SHA1
5b50ac354166ab8a2ace9fe1bdfa93ec2bdb1fbe

SHA256
dae7a3efd7bd2ff311be36e3c71ce4ea5f032397b67c03bb55612cd760d9b5b2

SHA512
45d9439a7b5302244416b504d1f4f8d7e5bdf7ea184bfaf5a1993a0774c3560b210c04349204079f9b00beafe51b6a24768332325a2c6361ae52927607352b22

Download Submit
\Users\Admin\AppData\Local\Temp\de38eb7fd5b7fa9eb360d0f837eee204.dll
MD5
85085346c6af6369d0da86bb5328b936

SHA1
5b50ac354166ab8a2ace9fe1bdfa93ec2bdb1fbe

SHA256
dae7a3efd7bd2ff311be36e3c71ce4ea5f032397b67c03bb55612cd760d9b5b2

SHA512
45d9439a7b5302244416b504d1f4f8d7e5bdf7ea184bfaf5a1993a0774c3560b210c04349204079f9b00beafe51b6a24768332325a2c6361ae52927607352b22

Download Submit
memory/544-71-0x000007FEFC031000-0x000007FEFC033000-memory.dmp

Filesize
8KB

Download
memory/544-70-0x0000000000000000-mapping.dmp

Download
memory/880-73-0x0000000000000000-mapping.dmp

Download
memory/1548-69-0x0000000000000000-mapping.dmp

Download
memory/1652-67-0x0000000074CF1000-0x0000000074CF3000-memory.dmp

Filesize
8KB

Download
memory/1652-68-0x00000000000E0000-0x0000000000119000-memory.dmp

Filesize
228KB

Download
memory/1652-65-0x0000000000000000-mapping.dmp

Download
memory/2008-60-0x0000000000000000-mapping.dmp

Download
memory/2008-64-0x0000000000280000-0x00000000002B9000-memory.dmp

Filesize
228KB

Download
memory/2008-63-0x0000000000190000-0x00000000001C9000-memory.dmp

Filesize
228KB

Download
memory/2008-62-0x0000000000350000-0x00000000003E9000-memory.dmp

Filesize
612KB

Download
memory/2008-61-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads