qakbot | 655ce3209ab8b61a4a560aef2edd2969d3e807c662b926be73c6cef58b8245c9

General

Target

7618c96cd8808205cd008be91e90ccc0.dll
Size

480KB
MD5

7618c96cd8808205cd008be91e90ccc0
SHA1

39cddd992916f2536ab5a433fa8b1435258f609f
SHA256

655ce3209ab8b61a4a560aef2edd2969d3e807c662b926be73c6cef58b8245c9
SHA512

f6bad33841fe47aaef0343e31afea73b865b33456abfa35587f00aaed6a3e464893590333ca8c3056c20e161ad7c984b43887f9360b720557536916005e75120

Score

10^/10

qakbot tr 1618935072 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.12

Botnet

tr

Campaign

1618935072

C2

140.82.49.12:443

190.85.91.154:443

96.37.113.36:993

71.41.184.10:3389

186.31.46.121:443

73.25.124.140:2222

109.12.111.14:443

24.229.150.54:995

45.32.211.207:443

45.77.117.108:443

45.77.117.108:8443

149.28.98.196:443

149.28.98.196:2222

144.202.38.185:443

144.202.38.185:995

45.32.211.207:995

207.246.116.237:995

149.28.99.97:995

45.63.107.192:2222

149.28.101.90:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1184 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

888 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1060 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1060 rundll32.exe

pid	process
1184	regsvr32.exe

pid	process
888	schtasks.exe

pid	process
1060	rundll32.exe

pid	process
1060	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1084 wrote to memory of 1060	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 1060	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 1060	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 1060	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 1060	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 1060	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 1060	1084	rundll32.exe	rundll32.exe
PID 1060 wrote to memory of 1680	1060	rundll32.exe	explorer.exe
PID 1060 wrote to memory of 1680	1060	rundll32.exe	explorer.exe
PID 1060 wrote to memory of 1680	1060	rundll32.exe	explorer.exe
PID 1060 wrote to memory of 1680	1060	rundll32.exe	explorer.exe
PID 1060 wrote to memory of 1680	1060	rundll32.exe	explorer.exe
PID 1060 wrote to memory of 1680	1060	rundll32.exe	explorer.exe
PID 1680 wrote to memory of 888	1680	explorer.exe	schtasks.exe
PID 1680 wrote to memory of 888	1680	explorer.exe	schtasks.exe
PID 1680 wrote to memory of 888	1680	explorer.exe	schtasks.exe
PID 1680 wrote to memory of 888	1680	explorer.exe	schtasks.exe
PID 1144 wrote to memory of 340	1144	taskeng.exe	regsvr32.exe
PID 1144 wrote to memory of 340	1144	taskeng.exe	regsvr32.exe
PID 1144 wrote to memory of 340	1144	taskeng.exe	regsvr32.exe
PID 1144 wrote to memory of 340	1144	taskeng.exe	regsvr32.exe
PID 1144 wrote to memory of 340	1144	taskeng.exe	regsvr32.exe
PID 340 wrote to memory of 1184	340	regsvr32.exe	regsvr32.exe
PID 340 wrote to memory of 1184	340	regsvr32.exe	regsvr32.exe
PID 340 wrote to memory of 1184	340	regsvr32.exe	regsvr32.exe
PID 340 wrote to memory of 1184	340	regsvr32.exe	regsvr32.exe
PID 340 wrote to memory of 1184	340	regsvr32.exe	regsvr32.exe
PID 340 wrote to memory of 1184	340	regsvr32.exe	regsvr32.exe
PID 340 wrote to memory of 1184	340	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7618c96cd8808205cd008be91e90ccc0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7618c96cd8808205cd008be91e90ccc0.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dkbhnrzm /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\7618c96cd8808205cd008be91e90ccc0.dll\"" /SC ONCE /Z /ST 13:38 /ET 13:50
4⤵
- Creates scheduled task(s)
PID:888

C:\Windows\system32\taskeng.exe
taskeng.exe {DFF2F14F-C589-436D-8C9F-D96D3D7151F2} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\7618c96cd8808205cd008be91e90ccc0.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:340

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\7618c96cd8808205cd008be91e90ccc0.dll"
3⤵
- Loads dropped DLL
PID:1184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7618c96cd8808205cd008be91e90ccc0.dll

MD5
4d7131e8031741a64302d59fbead593c

SHA1
cd08f6c707315e23200c12aa5123e37cede01c6d

SHA256
0b793e314a9026d473fb59d4651d109dc1886b1e955a7df041f16be983908bfc

SHA512
9c805bc9279b125e6d558e9bfd35d15a596e707ce19cfb60b7f33f5a7b3fdf5d7f9d3343897ca98e33c94b5937df629da4f3c789a91f134f844f41e9ed5e1bc3

Download Submit
\Users\Admin\AppData\Local\Temp\7618c96cd8808205cd008be91e90ccc0.dll

MD5
4d7131e8031741a64302d59fbead593c

SHA1
cd08f6c707315e23200c12aa5123e37cede01c6d

SHA256
0b793e314a9026d473fb59d4651d109dc1886b1e955a7df041f16be983908bfc

SHA512
9c805bc9279b125e6d558e9bfd35d15a596e707ce19cfb60b7f33f5a7b3fdf5d7f9d3343897ca98e33c94b5937df629da4f3c789a91f134f844f41e9ed5e1bc3

Download Submit
memory/340-69-0x0000000000000000-mapping.dmp

Download
memory/340-70-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Filesize
8KB

Download
memory/888-67-0x0000000000000000-mapping.dmp

Download
memory/1060-60-0x0000000000000000-mapping.dmp

Download
memory/1060-63-0x0000000010000000-0x0000000010078000-memory.dmp

Filesize
480KB

Download
memory/1060-62-0x00000000001E0000-0x0000000000252000-memory.dmp

Filesize
456KB

Download
memory/1060-61-0x00000000752F1000-0x00000000752F3000-memory.dmp

Filesize
8KB

Download
memory/1184-72-0x0000000000000000-mapping.dmp

Download
memory/1680-66-0x0000000074BD1000-0x0000000074BD3000-memory.dmp

Filesize
8KB

Download
memory/1680-68-0x0000000000080000-0x00000000000B9000-memory.dmp

Filesize
228KB

Download
memory/1680-64-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads