qakbot | e6310432b75e3c0013fc39d51da6590c4aff5e5ba35ad5da63694f660359765b

General

Target

44313_6048108796.dat.dll
Size

839KB
MD5

91fc8a03b1feaf21b3243ed08713ed8e
SHA1

e020e7a65146d52860197c295492c947a4d7608c
SHA256

e6310432b75e3c0013fc39d51da6590c4aff5e5ba35ad5da63694f660359765b
SHA512

0e27f67b385a7181d3a919565569c1e2b05e3f32eac910b41edee2809730505759efcc9aea49ed86c587ae07a08387d4eccf0ae8ef74ea31127915dc14566629

Score

10^/10

qakbot biden39 1620299739 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

biden39

Campaign

1620299739

C2

71.187.170.235:443

190.85.91.154:443

47.22.148.6:443

95.77.223.148:443

75.67.192.125:443

83.110.108.100:2222

81.97.154.100:443

97.69.160.4:2222

24.179.77.148:443

45.63.107.192:995

24.152.219.253:995

67.8.103.21:443

71.41.184.10:3389

184.185.103.157:443

73.25.124.140:2222

140.82.49.12:443

197.45.110.165:995

149.28.101.90:443

45.77.115.208:995

207.246.116.237:8443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1444 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

280 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1768 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1768 rundll32.exe

pid	process
1444	regsvr32.exe

pid	process
280	schtasks.exe

pid	process
1768	rundll32.exe

pid	process
1768	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 736 wrote to memory of 1768	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1768	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1768	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1768	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1768	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1768	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1768	736	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 844	1768	rundll32.exe	explorer.exe
PID 1768 wrote to memory of 844	1768	rundll32.exe	explorer.exe
PID 1768 wrote to memory of 844	1768	rundll32.exe	explorer.exe
PID 1768 wrote to memory of 844	1768	rundll32.exe	explorer.exe
PID 1768 wrote to memory of 844	1768	rundll32.exe	explorer.exe
PID 1768 wrote to memory of 844	1768	rundll32.exe	explorer.exe
PID 844 wrote to memory of 280	844	explorer.exe	schtasks.exe
PID 844 wrote to memory of 280	844	explorer.exe	schtasks.exe
PID 844 wrote to memory of 280	844	explorer.exe	schtasks.exe
PID 844 wrote to memory of 280	844	explorer.exe	schtasks.exe
PID 1660 wrote to memory of 784	1660	taskeng.exe	regsvr32.exe
PID 1660 wrote to memory of 784	1660	taskeng.exe	regsvr32.exe
PID 1660 wrote to memory of 784	1660	taskeng.exe	regsvr32.exe
PID 1660 wrote to memory of 784	1660	taskeng.exe	regsvr32.exe
PID 1660 wrote to memory of 784	1660	taskeng.exe	regsvr32.exe
PID 784 wrote to memory of 1444	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1444	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1444	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1444	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1444	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1444	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1444	784	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44313_6048108796.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:736

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44313_6048108796.dat.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fsluaou /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44313_6048108796.dat.dll\"" /SC ONCE /Z /ST 10:07 /ET 10:19
4⤵
- Creates scheduled task(s)
PID:280

C:\Windows\system32\taskeng.exe
taskeng.exe {49D81E13-DE46-4BCE-8E90-2AE1D46ED668} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44313_6048108796.dat.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\44313_6048108796.dat.dll"
3⤵
- Loads dropped DLL
PID:1444

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44313_6048108796.dat.dll
MD5
4fd5cdc4f4d80dee1171c9a4c4266122

SHA1
f4debe17d86480ca324ea38377bd7bd454ab218c

SHA256
6177f5c370667af36b4e96950719296aa2631a7951642832631425de591b396f

SHA512
61138b180159797815a630b5b46b3ef472eb2a07ea73dcbc56f77bb13ca994668c6c50ad78d7424ea700ba93803131a48557405e9393de88bc0e7017d30d6a44

Download Submit
\Users\Admin\AppData\Local\Temp\44313_6048108796.dat.dll
MD5
4fd5cdc4f4d80dee1171c9a4c4266122

SHA1
f4debe17d86480ca324ea38377bd7bd454ab218c

SHA256
6177f5c370667af36b4e96950719296aa2631a7951642832631425de591b396f

SHA512
61138b180159797815a630b5b46b3ef472eb2a07ea73dcbc56f77bb13ca994668c6c50ad78d7424ea700ba93803131a48557405e9393de88bc0e7017d30d6a44

Download Submit
memory/280-67-0x0000000000000000-mapping.dmp

Download
memory/784-70-0x000007FEFBEA1000-0x000007FEFBEA3000-memory.dmp

Filesize
8KB

Download
memory/784-69-0x0000000000000000-mapping.dmp

Download
memory/844-66-0x0000000074B31000-0x0000000074B33000-memory.dmp

Filesize
8KB

Download
memory/844-64-0x0000000000000000-mapping.dmp

Download
memory/844-68-0x0000000000080000-0x00000000000BD000-memory.dmp

Filesize
244KB

Download
memory/1444-72-0x0000000000000000-mapping.dmp

Download
memory/1768-59-0x0000000000000000-mapping.dmp

Download
memory/1768-62-0x0000000000200000-0x0000000000240000-memory.dmp

Filesize
256KB

Download
memory/1768-63-0x0000000001C60000-0x0000000001C9D000-memory.dmp

Filesize
244KB

Download
memory/1768-61-0x0000000000250000-0x0000000000326000-memory.dmp

Filesize
856KB

Download
memory/1768-60-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads