qakbot | 437a5419d30efa4e091d13acccdbc0920321ea924c6f9f7f216616de25abd75b

General

Target

jehamhcqwy.dll
Size

735KB
MD5

ff792107f35479d553bb80c0281cda33
SHA1

e3455dc43ea621bfc34012115b2dcc6c55a14348
SHA256

437a5419d30efa4e091d13acccdbc0920321ea924c6f9f7f216616de25abd75b
SHA512

90ab29da6140284d8682fa70a0a0ab3a3c99a870f9efdcd7f4a5c16e0d8fd815cb75751b7f0bb97759aa5836cfe317775fccf89ad979cf3a307afd6c16298e48

Score

10^/10

qakbot notset 1618398961 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.12

Botnet

notset

Campaign

1618398961

C2

47.196.192.184:443

216.201.162.158:443

136.232.34.70:443

71.41.184.10:3389

140.82.49.12:443

45.63.107.192:2222

45.63.107.192:443

149.28.98.196:443

45.32.211.207:443

144.202.38.185:443

45.77.115.208:2222

45.77.115.208:8443

207.246.116.237:995

45.77.117.108:443

149.28.99.97:443

149.28.99.97:995

149.28.98.196:995

45.32.211.207:995

45.32.211.207:2222

149.28.98.196:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1148 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1012 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1808 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1808 rundll32.exe

pid	process
1148	regsvr32.exe

pid	process
1012	schtasks.exe

pid	process
1808	rundll32.exe

pid	process
1808	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1640 wrote to memory of 1808	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1808	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1808	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1808	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1808	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1808	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1808	1640	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1680	1808	rundll32.exe	explorer.exe
PID 1808 wrote to memory of 1680	1808	rundll32.exe	explorer.exe
PID 1808 wrote to memory of 1680	1808	rundll32.exe	explorer.exe
PID 1808 wrote to memory of 1680	1808	rundll32.exe	explorer.exe
PID 1808 wrote to memory of 1680	1808	rundll32.exe	explorer.exe
PID 1808 wrote to memory of 1680	1808	rundll32.exe	explorer.exe
PID 1680 wrote to memory of 1012	1680	explorer.exe	schtasks.exe
PID 1680 wrote to memory of 1012	1680	explorer.exe	schtasks.exe
PID 1680 wrote to memory of 1012	1680	explorer.exe	schtasks.exe
PID 1680 wrote to memory of 1012	1680	explorer.exe	schtasks.exe
PID 568 wrote to memory of 1028	568	taskeng.exe	regsvr32.exe
PID 568 wrote to memory of 1028	568	taskeng.exe	regsvr32.exe
PID 568 wrote to memory of 1028	568	taskeng.exe	regsvr32.exe
PID 568 wrote to memory of 1028	568	taskeng.exe	regsvr32.exe
PID 568 wrote to memory of 1028	568	taskeng.exe	regsvr32.exe
PID 1028 wrote to memory of 1148	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1148	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1148	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1148	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1148	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1148	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1148	1028	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jehamhcqwy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jehamhcqwy.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn azykzthz /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\jehamhcqwy.dll\"" /SC ONCE /Z /ST 14:35 /ET 14:47
4⤵
- Creates scheduled task(s)
PID:1012

C:\Windows\system32\taskeng.exe
taskeng.exe {0796F3F4-118C-4E7B-9C6A-B5EFA3A32EC3} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\jehamhcqwy.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\jehamhcqwy.dll"
3⤵
- Loads dropped DLL
PID:1148

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jehamhcqwy.dll
MD5
9190ad1116c50d3b53735aa84661bd82

SHA1
2ec9f61b8a47158833fc19c53d44f58b75a0ac01

SHA256
b8f3249dcd4d07c2f4c42b79be967ac6949a647c98474854cc5e36530674903f

SHA512
3f230414459ec45bdd39b5577972bbd604b8dc22b67da151e6ca0ae4a7480b7beb13ba3f68b976ae01dfa8b557913a763a088a520536747289e7e5fdc7b7656b

Download Submit
\Users\Admin\AppData\Local\Temp\jehamhcqwy.dll
MD5
9190ad1116c50d3b53735aa84661bd82

SHA1
2ec9f61b8a47158833fc19c53d44f58b75a0ac01

SHA256
b8f3249dcd4d07c2f4c42b79be967ac6949a647c98474854cc5e36530674903f

SHA512
3f230414459ec45bdd39b5577972bbd604b8dc22b67da151e6ca0ae4a7480b7beb13ba3f68b976ae01dfa8b557913a763a088a520536747289e7e5fdc7b7656b

Download Submit
memory/1012-67-0x0000000000000000-mapping.dmp

Download
memory/1028-70-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

Filesize
8KB

Download
memory/1028-69-0x0000000000000000-mapping.dmp

Download
memory/1148-72-0x0000000000000000-mapping.dmp

Download
memory/1680-66-0x0000000074641000-0x0000000074643000-memory.dmp

Filesize
8KB

Download
memory/1680-68-0x00000000000F0000-0x0000000000129000-memory.dmp

Filesize
228KB

Download
memory/1680-64-0x0000000000000000-mapping.dmp

Download
memory/1808-59-0x0000000000000000-mapping.dmp

Download
memory/1808-63-0x00000000002E0000-0x0000000000319000-memory.dmp

Filesize
228KB

Download
memory/1808-62-0x0000000000290000-0x00000000002D2000-memory.dmp

Filesize
264KB

Download
memory/1808-61-0x0000000000340000-0x00000000003FD000-memory.dmp

Filesize
756KB

Download
memory/1808-60-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads