qakbot | 4a14a8b28709afd3003beb39044bbbfde5bdffdd1f9b24f836dbaa1d73ab617f

General

Target

4a14a8b28709afd3003beb39044bbbfde5bdffdd1f9b24f836dbaa1d73ab617f.dll
Size

480KB
MD5

0031b6b380045ba014bb3c32f6ec7877
SHA1

d9d2db0c1b2991ea1b86d7f4a9298f07bda0f04a
SHA256

4a14a8b28709afd3003beb39044bbbfde5bdffdd1f9b24f836dbaa1d73ab617f
SHA512

6c9458fd42f347f03496a590a60be2ca87e6a2013203e483d78f2aceebef3d38c2d7bec378aff3d34dcdd878f5bb8b436a925e8f9825f9aa061ef9c8718c70ff

Score

10^/10

qakbot tr 1618935072 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.12

Botnet

tr

Campaign

1618935072

C2

140.82.49.12:443

190.85.91.154:443

96.37.113.36:993

71.41.184.10:3389

186.31.46.121:443

73.25.124.140:2222

109.12.111.14:443

24.229.150.54:995

45.32.211.207:443

45.77.117.108:443

45.77.117.108:8443

149.28.98.196:443

149.28.98.196:2222

144.202.38.185:443

144.202.38.185:995

45.32.211.207:995

207.246.116.237:995

149.28.99.97:995

45.63.107.192:2222

149.28.101.90:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1036 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1700 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2036 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2036 rundll32.exe

pid	process
1036	regsvr32.exe

pid	process
1700	schtasks.exe

pid	process
2036	rundll32.exe

pid	process
2036	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1828 wrote to memory of 2036	1828	rundll32.exe	rundll32.exe
PID 1828 wrote to memory of 2036	1828	rundll32.exe	rundll32.exe
PID 1828 wrote to memory of 2036	1828	rundll32.exe	rundll32.exe
PID 1828 wrote to memory of 2036	1828	rundll32.exe	rundll32.exe
PID 1828 wrote to memory of 2036	1828	rundll32.exe	rundll32.exe
PID 1828 wrote to memory of 2036	1828	rundll32.exe	rundll32.exe
PID 1828 wrote to memory of 2036	1828	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1864	2036	rundll32.exe	explorer.exe
PID 2036 wrote to memory of 1864	2036	rundll32.exe	explorer.exe
PID 2036 wrote to memory of 1864	2036	rundll32.exe	explorer.exe
PID 2036 wrote to memory of 1864	2036	rundll32.exe	explorer.exe
PID 2036 wrote to memory of 1864	2036	rundll32.exe	explorer.exe
PID 2036 wrote to memory of 1864	2036	rundll32.exe	explorer.exe
PID 1864 wrote to memory of 1700	1864	explorer.exe	schtasks.exe
PID 1864 wrote to memory of 1700	1864	explorer.exe	schtasks.exe
PID 1864 wrote to memory of 1700	1864	explorer.exe	schtasks.exe
PID 1864 wrote to memory of 1700	1864	explorer.exe	schtasks.exe
PID 1912 wrote to memory of 1848	1912	taskeng.exe	regsvr32.exe
PID 1912 wrote to memory of 1848	1912	taskeng.exe	regsvr32.exe
PID 1912 wrote to memory of 1848	1912	taskeng.exe	regsvr32.exe
PID 1912 wrote to memory of 1848	1912	taskeng.exe	regsvr32.exe
PID 1912 wrote to memory of 1848	1912	taskeng.exe	regsvr32.exe
PID 1848 wrote to memory of 1036	1848	regsvr32.exe	regsvr32.exe
PID 1848 wrote to memory of 1036	1848	regsvr32.exe	regsvr32.exe
PID 1848 wrote to memory of 1036	1848	regsvr32.exe	regsvr32.exe
PID 1848 wrote to memory of 1036	1848	regsvr32.exe	regsvr32.exe
PID 1848 wrote to memory of 1036	1848	regsvr32.exe	regsvr32.exe
PID 1848 wrote to memory of 1036	1848	regsvr32.exe	regsvr32.exe
PID 1848 wrote to memory of 1036	1848	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a14a8b28709afd3003beb39044bbbfde5bdffdd1f9b24f836dbaa1d73ab617f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a14a8b28709afd3003beb39044bbbfde5bdffdd1f9b24f836dbaa1d73ab617f.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ewfgmfq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\4a14a8b28709afd3003beb39044bbbfde5bdffdd1f9b24f836dbaa1d73ab617f.dll\"" /SC ONCE /Z /ST 15:30 /ET 15:42
4⤵
- Creates scheduled task(s)
PID:1700

C:\Windows\system32\taskeng.exe
taskeng.exe {5337464E-C2AC-4692-9734-809D2A72E0B3} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\4a14a8b28709afd3003beb39044bbbfde5bdffdd1f9b24f836dbaa1d73ab617f.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\4a14a8b28709afd3003beb39044bbbfde5bdffdd1f9b24f836dbaa1d73ab617f.dll"
3⤵
- Loads dropped DLL
PID:1036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4a14a8b28709afd3003beb39044bbbfde5bdffdd1f9b24f836dbaa1d73ab617f.dll

MD5
812361c898a7c1d76284c7b88f69d727

SHA1
4cd99b54fa9858919776942cf5328d1eda7c3f73

SHA256
c905dd3111fd0d0b88ecd01c8e5534414175fb6236959b3fc75e396b64cc855c

SHA512
4cd4cf2213dc3b7de6228a8d872a913f41944a4e0a0d8439db6a8ed749d807378556d6dc0e06f111576fc4492e4d2fe30fa5aa767be8e18f1e402151680d2247

Download Submit
\Users\Admin\AppData\Local\Temp\4a14a8b28709afd3003beb39044bbbfde5bdffdd1f9b24f836dbaa1d73ab617f.dll

MD5
812361c898a7c1d76284c7b88f69d727

SHA1
4cd99b54fa9858919776942cf5328d1eda7c3f73

SHA256
c905dd3111fd0d0b88ecd01c8e5534414175fb6236959b3fc75e396b64cc855c

SHA512
4cd4cf2213dc3b7de6228a8d872a913f41944a4e0a0d8439db6a8ed749d807378556d6dc0e06f111576fc4492e4d2fe30fa5aa767be8e18f1e402151680d2247

Download Submit
memory/1036-72-0x0000000000000000-mapping.dmp

Download
memory/1700-67-0x0000000000000000-mapping.dmp

Download
memory/1848-70-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

Filesize
8KB

Download
memory/1848-69-0x0000000000000000-mapping.dmp

Download
memory/1864-66-0x0000000074501000-0x0000000074503000-memory.dmp

Filesize
8KB

Download
memory/1864-64-0x0000000000000000-mapping.dmp

Download
memory/1864-68-0x00000000000E0000-0x0000000000119000-memory.dmp

Filesize
228KB

Download
memory/2036-60-0x0000000000000000-mapping.dmp

Download
memory/2036-63-0x0000000010000000-0x0000000010078000-memory.dmp

Filesize
480KB

Download
memory/2036-62-0x0000000001BD0000-0x0000000001C42000-memory.dmp

Filesize
456KB

Download
memory/2036-61-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads