qakbot | 38b3ad4fa2d18bfe9e1d04c5fd24b06bcfcaac5f4ac376bfcfba23f45900f9d0

General

Target

Test.dll
Size

839KB
MD5

d36f24649f440cb0931cb3f2418a09d0
SHA1

61af6abea1cc27c2dff71d90af9e06de191d7aca
SHA256

38b3ad4fa2d18bfe9e1d04c5fd24b06bcfcaac5f4ac376bfcfba23f45900f9d0
SHA512

b1e7c5a8178a1dfea576bb009464e5071963f398f965ff63ae3c64b7cc2c6e028f6523047615b48ef95bbad044c11c129cb58170c48fb8fb589ae50403b0c772

Score

10^/10

qakbot clinton13 1620299491 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

clinton13

Campaign

1620299491

C2

71.187.170.235:443

190.85.91.154:443

47.22.148.6:443

95.77.223.148:443

75.67.192.125:443

83.110.108.100:2222

81.97.154.100:443

97.69.160.4:2222

24.179.77.148:443

45.63.107.192:995

24.152.219.253:995

67.8.103.21:443

71.41.184.10:3389

184.185.103.157:443

73.25.124.140:2222

140.82.49.12:443

197.45.110.165:995

149.28.101.90:443

45.77.115.208:995

207.246.116.237:8443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

984 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

800 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2040 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2040 rundll32.exe

pid	process
984	regsvr32.exe

pid	process
800	schtasks.exe

pid	process
2040	rundll32.exe

pid	process
2040	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1420 wrote to memory of 2040	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 2040	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 2040	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 2040	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 2040	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 2040	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 2040	1420	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1764	2040	rundll32.exe	explorer.exe
PID 2040 wrote to memory of 1764	2040	rundll32.exe	explorer.exe
PID 2040 wrote to memory of 1764	2040	rundll32.exe	explorer.exe
PID 2040 wrote to memory of 1764	2040	rundll32.exe	explorer.exe
PID 2040 wrote to memory of 1764	2040	rundll32.exe	explorer.exe
PID 2040 wrote to memory of 1764	2040	rundll32.exe	explorer.exe
PID 1764 wrote to memory of 800	1764	explorer.exe	schtasks.exe
PID 1764 wrote to memory of 800	1764	explorer.exe	schtasks.exe
PID 1764 wrote to memory of 800	1764	explorer.exe	schtasks.exe
PID 1764 wrote to memory of 800	1764	explorer.exe	schtasks.exe
PID 552 wrote to memory of 632	552	taskeng.exe	regsvr32.exe
PID 552 wrote to memory of 632	552	taskeng.exe	regsvr32.exe
PID 552 wrote to memory of 632	552	taskeng.exe	regsvr32.exe
PID 552 wrote to memory of 632	552	taskeng.exe	regsvr32.exe
PID 552 wrote to memory of 632	552	taskeng.exe	regsvr32.exe
PID 632 wrote to memory of 984	632	regsvr32.exe	regsvr32.exe
PID 632 wrote to memory of 984	632	regsvr32.exe	regsvr32.exe
PID 632 wrote to memory of 984	632	regsvr32.exe	regsvr32.exe
PID 632 wrote to memory of 984	632	regsvr32.exe	regsvr32.exe
PID 632 wrote to memory of 984	632	regsvr32.exe	regsvr32.exe
PID 632 wrote to memory of 984	632	regsvr32.exe	regsvr32.exe
PID 632 wrote to memory of 984	632	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Test.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hzspfug /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\Test.dll\"" /SC ONCE /Z /ST 14:55 /ET 15:07
4⤵
- Creates scheduled task(s)
PID:800

C:\Windows\system32\taskeng.exe
taskeng.exe {9655E0E2-3E1E-4A49-8978-B420ACF516FD} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\Test.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:632

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\Test.dll"
3⤵
- Loads dropped DLL
PID:984

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Test.dll
MD5
4fd5cdc4f4d80dee1171c9a4c4266122

SHA1
f4debe17d86480ca324ea38377bd7bd454ab218c

SHA256
6177f5c370667af36b4e96950719296aa2631a7951642832631425de591b396f

SHA512
61138b180159797815a630b5b46b3ef472eb2a07ea73dcbc56f77bb13ca994668c6c50ad78d7424ea700ba93803131a48557405e9393de88bc0e7017d30d6a44

Download Submit
\Users\Admin\AppData\Local\Temp\Test.dll
MD5
4fd5cdc4f4d80dee1171c9a4c4266122

SHA1
f4debe17d86480ca324ea38377bd7bd454ab218c

SHA256
6177f5c370667af36b4e96950719296aa2631a7951642832631425de591b396f

SHA512
61138b180159797815a630b5b46b3ef472eb2a07ea73dcbc56f77bb13ca994668c6c50ad78d7424ea700ba93803131a48557405e9393de88bc0e7017d30d6a44

Download Submit
memory/632-71-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download
memory/632-70-0x0000000000000000-mapping.dmp

Download
memory/800-69-0x0000000000000000-mapping.dmp

Download
memory/984-73-0x0000000000000000-mapping.dmp

Download
memory/1764-67-0x00000000744C1000-0x00000000744C3000-memory.dmp

Filesize
8KB

Download
memory/1764-68-0x0000000000330000-0x000000000036D000-memory.dmp

Filesize
244KB

Download
memory/1764-65-0x0000000000000000-mapping.dmp

Download
memory/2040-60-0x0000000000000000-mapping.dmp

Download
memory/2040-64-0x00000000003E0000-0x000000000041D000-memory.dmp

Filesize
244KB

Download
memory/2040-63-0x00000000001F0000-0x0000000000230000-memory.dmp

Filesize
256KB

Download
memory/2040-62-0x0000000001CA0000-0x0000000001D76000-memory.dmp

Filesize
856KB

Download
memory/2040-61-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads