General

  • Target

    rundll32_041E0000.dll

  • Size

    200KB

  • Sample

    210502-s4k1t39t82

  • MD5

    f27773e57e5cabd4d4dc0c7f068cb9ca

  • SHA1

    61eda8b76e9e87b8e4d43ff543b2f3de241361f1

  • SHA256

    1597cf6c9fadf5190b80f34a06fb049c43a899f9c081b908b532083cdb236961

  • SHA512

    ebef47413fd61ec4eeda2dc7c96f6d914a44f925cb9d9e476dba1956af20e2145fb2ec5d5b35ae11aa11b0241841e4e0b2a04356536e71a2aa32946bee0ddde2

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

tr

Campaign

1614598087

C2

24.95.61.62:443

89.3.198.238:443

196.151.252.84:443

90.65.236.181:2222

2.232.253.79:995

217.133.54.140:32100

195.43.173.70:443

84.247.55.190:8443

136.232.34.70:443

45.63.107.192:443

45.77.115.208:443

149.28.98.196:995

45.32.211.207:8443

149.28.98.196:443

149.28.99.97:443

45.63.107.192:2222

207.246.77.75:443

207.246.77.75:8443

45.77.117.108:443

45.32.211.207:995

Targets

    • Target

      rundll32_041E0000.dll

    • Size

      200KB

    • MD5

      f27773e57e5cabd4d4dc0c7f068cb9ca

    • SHA1

      61eda8b76e9e87b8e4d43ff543b2f3de241361f1

    • SHA256

      1597cf6c9fadf5190b80f34a06fb049c43a899f9c081b908b532083cdb236961

    • SHA512

      ebef47413fd61ec4eeda2dc7c96f6d914a44f925cb9d9e476dba1956af20e2145fb2ec5d5b35ae11aa11b0241841e4e0b2a04356536e71a2aa32946bee0ddde2

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks