qakbot | e63895d11d4f179f6bcefeef69422ddc9ffe94b86979b574a21091c4c77c2b7d

General

Target

file.dll
Size

400KB
MD5

fc1e6bcea1fe9542c8bf5b5b126af606
SHA1

e359d287c848ca038ae7e3e90aa5a47be4adbcfe
SHA256

e63895d11d4f179f6bcefeef69422ddc9ffe94b86979b574a21091c4c77c2b7d
SHA512

7891df25028d4cbe68dfa2fe1e9220b1648d4effc15472108985c8caf468d2d6a9f9d757280e727001d5680d0f08f9744e9b1ccb0102d29e736d4a30e48d1cd6

Score

10^/10

qakbot biden02 1614154620 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

biden02

Campaign

1614154620

C2

98.173.34.213:995

160.3.187.114:443

73.25.124.140:2222

24.50.118.93:443

82.127.125.209:990

83.110.109.106:2222

79.129.121.81:995

189.223.234.23:995

125.63.101.62:443

113.22.175.141:443

172.78.30.215:443

47.146.169.85:443

47.22.148.6:443

76.25.142.196:443

78.63.226.32:443

105.198.236.101:443

75.67.192.125:443

176.181.247.197:443

105.96.8.96:443

108.31.15.10:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

324 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1332 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1968 regsvr32.exe
1968 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1968 regsvr32.exe

pid	process
324	regsvr32.exe

pid	process
1332	schtasks.exe

pid	process
1968	regsvr32.exe
1968	regsvr32.exe

pid	process
1968	regsvr32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 940 wrote to memory of 1968	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1968	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1968	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1968	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1968	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1968	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1968	940	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 1376	1968	regsvr32.exe	explorer.exe
PID 1968 wrote to memory of 1376	1968	regsvr32.exe	explorer.exe
PID 1968 wrote to memory of 1376	1968	regsvr32.exe	explorer.exe
PID 1968 wrote to memory of 1376	1968	regsvr32.exe	explorer.exe
PID 1968 wrote to memory of 1376	1968	regsvr32.exe	explorer.exe
PID 1968 wrote to memory of 1376	1968	regsvr32.exe	explorer.exe
PID 1376 wrote to memory of 1332	1376	explorer.exe	schtasks.exe
PID 1376 wrote to memory of 1332	1376	explorer.exe	schtasks.exe
PID 1376 wrote to memory of 1332	1376	explorer.exe	schtasks.exe
PID 1376 wrote to memory of 1332	1376	explorer.exe	schtasks.exe
PID 1240 wrote to memory of 1108	1240	taskeng.exe	regsvr32.exe
PID 1240 wrote to memory of 1108	1240	taskeng.exe	regsvr32.exe
PID 1240 wrote to memory of 1108	1240	taskeng.exe	regsvr32.exe
PID 1240 wrote to memory of 1108	1240	taskeng.exe	regsvr32.exe
PID 1240 wrote to memory of 1108	1240	taskeng.exe	regsvr32.exe
PID 1108 wrote to memory of 324	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 324	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 324	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 324	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 324	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 324	1108	regsvr32.exe	regsvr32.exe
PID 1108 wrote to memory of 324	1108	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\file.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ubjeipnqay /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\file.dll\"" /SC ONCE /Z /ST 03:19 /ET 03:31
4⤵
- Creates scheduled task(s)
PID:1332

C:\Windows\system32\taskeng.exe
taskeng.exe {B9A30BDE-DB68-4B48-BE39-46EA748BC4BB} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\file.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\file.dll"
3⤵
- Loads dropped DLL
PID:324

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\file.dll
MD5
a3f61c50e9a80555a752d4e34bb92680

SHA1
66149f61eaa32730d0047a083378f6fe3217caea

SHA256
fee9ebbc98a5065a8cc2fcfd853c0301c1f84b129c01362376eb050d3dbda1da

SHA512
adec7b995fb27492bffcdbfb9cc3a7ab7e63b35a6dceafeb7c77dac74ecb6879e6d8064167539112d2c6e99cb94f98425a4228b7f5a59685cfd0e702d8670b19

Download Submit
\Users\Admin\AppData\Local\Temp\file.dll
MD5
a3f61c50e9a80555a752d4e34bb92680

SHA1
66149f61eaa32730d0047a083378f6fe3217caea

SHA256
fee9ebbc98a5065a8cc2fcfd853c0301c1f84b129c01362376eb050d3dbda1da

SHA512
adec7b995fb27492bffcdbfb9cc3a7ab7e63b35a6dceafeb7c77dac74ecb6879e6d8064167539112d2c6e99cb94f98425a4228b7f5a59685cfd0e702d8670b19

Download Submit
memory/324-72-0x0000000000000000-mapping.dmp

Download
memory/940-59-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

Filesize
8KB

Download
memory/1108-69-0x0000000000000000-mapping.dmp

Download
memory/1332-67-0x0000000000000000-mapping.dmp

Download
memory/1376-66-0x0000000073F41000-0x0000000073F43000-memory.dmp

Filesize
8KB

Download
memory/1376-64-0x0000000000000000-mapping.dmp

Download
memory/1376-68-0x0000000000080000-0x00000000000B5000-memory.dmp

Filesize
212KB

Download
memory/1968-63-0x0000000010000000-0x0000000010066000-memory.dmp

Filesize
408KB

Download
memory/1968-62-0x0000000000390000-0x0000000000410000-memory.dmp

Filesize
512KB

Download
memory/1968-61-0x0000000075051000-0x0000000075053000-memory.dmp

Filesize
8KB

Download
memory/1968-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads