qakbot | 89e5e164965e0c8750880546d30e27802cc407640f72b1e9851970bc0da02250

General

Target

7b4649f1_by_Libranalysis.dll
Size

934KB
MD5

7b4649f102e014fe295482bbbc014a1e
SHA1

46151d16717f7c8c4d518085261c0d4b1ed71573
SHA256

89e5e164965e0c8750880546d30e27802cc407640f72b1e9851970bc0da02250
SHA512

d1d84d992c8766bc13da66a1b6475b4bdd74504b073114a85b214024e93c6523635f11943d1099dab6721d1c664e4940ec71d65e7fa48a67bb1b03c8c660e4f3

Score

10^/10

qakbot tr 1619706851 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

tr

Campaign

1619706851

C2

24.117.107.120:443

190.85.91.154:443

72.252.201.69:443

189.210.115.207:443

71.41.184.10:3389

81.97.154.100:443

50.29.166.232:995

140.82.49.12:443

75.137.47.174:443

71.74.12.34:443

73.25.124.140:2222

149.28.99.97:2222

45.77.115.208:2222

45.32.211.207:995

207.246.116.237:443

149.28.99.97:443

207.246.77.75:443

149.28.98.196:995

207.246.116.237:2222

45.77.115.208:8443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

620 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

848 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1880 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1880 rundll32.exe

pid	process
620	regsvr32.exe

pid	process
848	schtasks.exe

pid	process
1880	rundll32.exe

pid	process
1880	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 368 wrote to memory of 1880	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 1880	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 1880	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 1880	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 1880	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 1880	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 1880	368	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1528	1880	rundll32.exe	explorer.exe
PID 1880 wrote to memory of 1528	1880	rundll32.exe	explorer.exe
PID 1880 wrote to memory of 1528	1880	rundll32.exe	explorer.exe
PID 1880 wrote to memory of 1528	1880	rundll32.exe	explorer.exe
PID 1880 wrote to memory of 1528	1880	rundll32.exe	explorer.exe
PID 1880 wrote to memory of 1528	1880	rundll32.exe	explorer.exe
PID 1528 wrote to memory of 848	1528	explorer.exe	schtasks.exe
PID 1528 wrote to memory of 848	1528	explorer.exe	schtasks.exe
PID 1528 wrote to memory of 848	1528	explorer.exe	schtasks.exe
PID 1528 wrote to memory of 848	1528	explorer.exe	schtasks.exe
PID 1340 wrote to memory of 1648	1340	taskeng.exe	regsvr32.exe
PID 1340 wrote to memory of 1648	1340	taskeng.exe	regsvr32.exe
PID 1340 wrote to memory of 1648	1340	taskeng.exe	regsvr32.exe
PID 1340 wrote to memory of 1648	1340	taskeng.exe	regsvr32.exe
PID 1340 wrote to memory of 1648	1340	taskeng.exe	regsvr32.exe
PID 1648 wrote to memory of 620	1648	regsvr32.exe	regsvr32.exe
PID 1648 wrote to memory of 620	1648	regsvr32.exe	regsvr32.exe
PID 1648 wrote to memory of 620	1648	regsvr32.exe	regsvr32.exe
PID 1648 wrote to memory of 620	1648	regsvr32.exe	regsvr32.exe
PID 1648 wrote to memory of 620	1648	regsvr32.exe	regsvr32.exe
PID 1648 wrote to memory of 620	1648	regsvr32.exe	regsvr32.exe
PID 1648 wrote to memory of 620	1648	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b4649f1_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:368

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b4649f1_by_Libranalysis.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ycuhusougw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\7b4649f1_by_Libranalysis.dll\"" /SC ONCE /Z /ST 05:13 /ET 05:25
4⤵
- Creates scheduled task(s)
PID:848

C:\Windows\system32\taskeng.exe
taskeng.exe {E44B4BD0-9CE8-4BA6-898B-1CEB9E59EACC} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\7b4649f1_by_Libranalysis.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\7b4649f1_by_Libranalysis.dll"
3⤵
- Loads dropped DLL
PID:620

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7b4649f1_by_Libranalysis.dll
MD5
be92b42d6a8d74ff2275cfb76979a153

SHA1
7f91730c500066ec67b50d22f1f9ce091fdc363d

SHA256
a9b544ac8f0b27b0cc2fc0f6d2cbd8ba3e9e3b9f8410c979dfbb12bb161f2a3e

SHA512
85fa93d31fcd9d2616357571f1275014c9ba211a5fa1c4bb706f0a416ccce71fc0162b852bec7b8bc2acdc9cc09a2612b17a085c64967805ea4c62704010dd9b

Download Submit
\Users\Admin\AppData\Local\Temp\7b4649f1_by_Libranalysis.dll
MD5
be92b42d6a8d74ff2275cfb76979a153

SHA1
7f91730c500066ec67b50d22f1f9ce091fdc363d

SHA256
a9b544ac8f0b27b0cc2fc0f6d2cbd8ba3e9e3b9f8410c979dfbb12bb161f2a3e

SHA512
85fa93d31fcd9d2616357571f1275014c9ba211a5fa1c4bb706f0a416ccce71fc0162b852bec7b8bc2acdc9cc09a2612b17a085c64967805ea4c62704010dd9b

Download Submit
memory/620-72-0x0000000000000000-mapping.dmp

Download
memory/848-67-0x0000000000000000-mapping.dmp

Download
memory/1528-68-0x0000000000310000-0x000000000034D000-memory.dmp

Filesize
244KB

Download
memory/1528-64-0x0000000000000000-mapping.dmp

Download
memory/1528-66-0x0000000074A51000-0x0000000074A53000-memory.dmp

Filesize
8KB

Download
memory/1648-69-0x0000000000000000-mapping.dmp

Download
memory/1648-70-0x000007FEFBDC1000-0x000007FEFBDC3000-memory.dmp

Filesize
8KB

Download
memory/1880-63-0x0000000000260000-0x000000000029D000-memory.dmp

Filesize
244KB

Download
memory/1880-61-0x0000000000970000-0x0000000000A5E000-memory.dmp

Filesize
952KB

Download
memory/1880-62-0x00000000001A0000-0x00000000001E0000-memory.dmp

Filesize
256KB

Download
memory/1880-59-0x0000000000000000-mapping.dmp

Download
memory/1880-60-0x0000000076661000-0x0000000076663000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads