qakbot | 82f9a22b3d48eee0cd84f7f1b7273bfcefb6e4454c031db7c80a8953764a1b49

General

Target

82f9a22b3d48eee0cd84f7f1b7273bfcefb6e4454c031db7c80a8953764a1b49.dll
Size

764KB
MD5

a072d40df69c27b45f993f17226c0075
SHA1

5da0b7bf73bd7e37c2023d7afee50ece27d51d89
SHA256

82f9a22b3d48eee0cd84f7f1b7273bfcefb6e4454c031db7c80a8953764a1b49
SHA512

d999ef40fa3e5aeeeec9f34c4254ff9f8710969511ea3e83ead1593e47a716d2741ff0ccbc72f3eb6a4232f5f5078babe87f10aa5aa6438b16a937d592ac049a

Score

10^/10

qakbot tr 1619706851 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

tr

Campaign

1619706851

C2

24.117.107.120:443

190.85.91.154:443

72.252.201.69:443

189.210.115.207:443

71.41.184.10:3389

81.97.154.100:443

50.29.166.232:995

140.82.49.12:443

75.137.47.174:443

71.74.12.34:443

73.25.124.140:2222

149.28.99.97:2222

45.77.115.208:2222

45.32.211.207:995

207.246.116.237:443

149.28.99.97:443

207.246.77.75:443

149.28.98.196:995

207.246.116.237:2222

45.77.115.208:8443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

788 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1652 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1828 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1828 rundll32.exe

pid	process
788	regsvr32.exe

pid	process
1652	schtasks.exe

pid	process
1828	rundll32.exe

pid	process
1828	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1616 wrote to memory of 1828	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1828	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1828	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1828	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1828	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1828	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1828	1616	rundll32.exe	rundll32.exe
PID 1828 wrote to memory of 1588	1828	rundll32.exe	explorer.exe
PID 1828 wrote to memory of 1588	1828	rundll32.exe	explorer.exe
PID 1828 wrote to memory of 1588	1828	rundll32.exe	explorer.exe
PID 1828 wrote to memory of 1588	1828	rundll32.exe	explorer.exe
PID 1828 wrote to memory of 1588	1828	rundll32.exe	explorer.exe
PID 1828 wrote to memory of 1588	1828	rundll32.exe	explorer.exe
PID 1588 wrote to memory of 1652	1588	explorer.exe	schtasks.exe
PID 1588 wrote to memory of 1652	1588	explorer.exe	schtasks.exe
PID 1588 wrote to memory of 1652	1588	explorer.exe	schtasks.exe
PID 1588 wrote to memory of 1652	1588	explorer.exe	schtasks.exe
PID 1116 wrote to memory of 1692	1116	taskeng.exe	regsvr32.exe
PID 1116 wrote to memory of 1692	1116	taskeng.exe	regsvr32.exe
PID 1116 wrote to memory of 1692	1116	taskeng.exe	regsvr32.exe
PID 1116 wrote to memory of 1692	1116	taskeng.exe	regsvr32.exe
PID 1116 wrote to memory of 1692	1116	taskeng.exe	regsvr32.exe
PID 1692 wrote to memory of 788	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 788	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 788	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 788	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 788	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 788	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 788	1692	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\82f9a22b3d48eee0cd84f7f1b7273bfcefb6e4454c031db7c80a8953764a1b49.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\82f9a22b3d48eee0cd84f7f1b7273bfcefb6e4454c031db7c80a8953764a1b49.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lggcjhwl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\82f9a22b3d48eee0cd84f7f1b7273bfcefb6e4454c031db7c80a8953764a1b49.dll\"" /SC ONCE /Z /ST 13:38 /ET 13:50
4⤵
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\taskeng.exe
taskeng.exe {0796F3F4-118C-4E7B-9C6A-B5EFA3A32EC3} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\82f9a22b3d48eee0cd84f7f1b7273bfcefb6e4454c031db7c80a8953764a1b49.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\82f9a22b3d48eee0cd84f7f1b7273bfcefb6e4454c031db7c80a8953764a1b49.dll"
3⤵
- Loads dropped DLL
PID:788

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\82f9a22b3d48eee0cd84f7f1b7273bfcefb6e4454c031db7c80a8953764a1b49.dll
MD5
4d2dacabadee24338aca05d5f4c715b2

SHA1
cdf2776ab097c6c58bf50b14220cffd36a2b1f23

SHA256
5b421ba8fc65d96b16765c8c37ba8051697dd3b5ca6073a8d72e6be45137c2e5

SHA512
257cca70ee0cb2e29a209589a38b2d1bc7d6bfdf66c1f527110285fec970a621fb795d481a45fd72d6c41950a14b0e815fa4cd498dd51e3eb9c4b380355d43f1

Download Submit
\Users\Admin\AppData\Local\Temp\82f9a22b3d48eee0cd84f7f1b7273bfcefb6e4454c031db7c80a8953764a1b49.dll
MD5
4d2dacabadee24338aca05d5f4c715b2

SHA1
cdf2776ab097c6c58bf50b14220cffd36a2b1f23

SHA256
5b421ba8fc65d96b16765c8c37ba8051697dd3b5ca6073a8d72e6be45137c2e5

SHA512
257cca70ee0cb2e29a209589a38b2d1bc7d6bfdf66c1f527110285fec970a621fb795d481a45fd72d6c41950a14b0e815fa4cd498dd51e3eb9c4b380355d43f1

Download Submit
memory/788-72-0x0000000000000000-mapping.dmp

Download
memory/1588-68-0x00000000000C0000-0x00000000000FD000-memory.dmp

Filesize
244KB

Download
memory/1588-64-0x0000000000000000-mapping.dmp

Download
memory/1588-66-0x0000000074641000-0x0000000074643000-memory.dmp

Filesize
8KB

Download
memory/1652-67-0x0000000000000000-mapping.dmp

Download
memory/1692-69-0x0000000000000000-mapping.dmp

Download
memory/1692-70-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

Filesize
8KB

Download
memory/1828-63-0x00000000002B0000-0x00000000002ED000-memory.dmp

Filesize
244KB

Download
memory/1828-59-0x0000000000000000-mapping.dmp

Download
memory/1828-62-0x0000000000130000-0x0000000000170000-memory.dmp

Filesize
256KB

Download
memory/1828-61-0x0000000000440000-0x00000000004FC000-memory.dmp

Filesize
752KB

Download
memory/1828-60-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads