qakbot | 8a8f2fc400d22736477152a5368b53bdfdebefb2c22c586514b2fea4b269512e

General

Target

sun.html.dll
Size

315KB
MD5

d692c23aadd2f5d0a570bb3a7c103285
SHA1

c67d89e596dde56bdb74905c8f2372219318e0b5
SHA256

8a8f2fc400d22736477152a5368b53bdfdebefb2c22c586514b2fea4b269512e
SHA512

7de3171fcc5b63a03fc8cb4952746a5445a894d7dd6d5faaff1bb49d12992123a3f8e8f63d670ff753182633d0ac8c8b18bc1b600a925df0148907e5e0ebcac1

Score

10^/10

qakbot tr 1623837834 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.115

Botnet

tr

Campaign

1623837834

C2

144.139.47.206:443

105.198.236.101:443

136.232.34.70:443

90.65.234.26:2222

71.41.184.10:3389

98.192.185.86:443

184.185.103.157:443

24.179.77.236:443

81.97.154.100:443

186.144.33.73:443

96.253.46.210:443

213.122.113.120:443

47.22.148.6:443

149.28.99.97:995

45.63.107.192:2222

45.32.211.207:443

45.32.211.207:8443

149.28.98.196:995

45.63.107.192:995

45.77.115.208:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1112 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

568 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1620 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1620 rundll32.exe

pid	process
1112	regsvr32.exe

pid	process
568	schtasks.exe

pid	process
1620	rundll32.exe

pid	process
1620	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1968 wrote to memory of 1620	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1620	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1620	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1620	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1620	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1620	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1620	1968	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 580	1620	rundll32.exe	explorer.exe
PID 1620 wrote to memory of 580	1620	rundll32.exe	explorer.exe
PID 1620 wrote to memory of 580	1620	rundll32.exe	explorer.exe
PID 1620 wrote to memory of 580	1620	rundll32.exe	explorer.exe
PID 1620 wrote to memory of 580	1620	rundll32.exe	explorer.exe
PID 1620 wrote to memory of 580	1620	rundll32.exe	explorer.exe
PID 580 wrote to memory of 568	580	explorer.exe	schtasks.exe
PID 580 wrote to memory of 568	580	explorer.exe	schtasks.exe
PID 580 wrote to memory of 568	580	explorer.exe	schtasks.exe
PID 580 wrote to memory of 568	580	explorer.exe	schtasks.exe
PID 1144 wrote to memory of 1776	1144	taskeng.exe	regsvr32.exe
PID 1144 wrote to memory of 1776	1144	taskeng.exe	regsvr32.exe
PID 1144 wrote to memory of 1776	1144	taskeng.exe	regsvr32.exe
PID 1144 wrote to memory of 1776	1144	taskeng.exe	regsvr32.exe
PID 1144 wrote to memory of 1776	1144	taskeng.exe	regsvr32.exe
PID 1776 wrote to memory of 1112	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1112	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1112	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1112	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1112	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1112	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1112	1776	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sun.html.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sun.html.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn uwikhsb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\sun.html.dll\"" /SC ONCE /Z /ST 08:20 /ET 08:32
4⤵
- Creates scheduled task(s)
PID:568

C:\Windows\system32\taskeng.exe
taskeng.exe {775F6138-D6FC-42E7-8D6A-42A39DE24EEB} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\sun.html.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\sun.html.dll"
3⤵
- Loads dropped DLL
PID:1112

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sun.html.dll
MD5
7dbbdc8b3824d69bbf03b67d15ad2dcc

SHA1
8daab97ddc4555aad2a18148c22e00c4d8781571

SHA256
60401632204766d9e6895d445b3b5346f590446b8c0949d37f87c80663f11f7c

SHA512
3c4fbcc026cb14a0974a116181454f749c83aeb22969a2aaf8a94c22863994e1b15040405c29b2f67e947fd826dbe5f425b5014670da885e125073d288f0c376

Download Submit
\Users\Admin\AppData\Local\Temp\sun.html.dll
MD5
7dbbdc8b3824d69bbf03b67d15ad2dcc

SHA1
8daab97ddc4555aad2a18148c22e00c4d8781571

SHA256
60401632204766d9e6895d445b3b5346f590446b8c0949d37f87c80663f11f7c

SHA512
3c4fbcc026cb14a0974a116181454f749c83aeb22969a2aaf8a94c22863994e1b15040405c29b2f67e947fd826dbe5f425b5014670da885e125073d288f0c376

Download Submit
memory/568-66-0x0000000000000000-mapping.dmp

Download
memory/580-67-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/580-63-0x0000000000000000-mapping.dmp

Download
memory/580-65-0x0000000074CE1000-0x0000000074CE3000-memory.dmp

Filesize
8KB

Download
memory/1112-71-0x0000000000000000-mapping.dmp

Download
memory/1620-61-0x00000000001C0000-0x00000000001FB000-memory.dmp

Filesize
236KB

Download
memory/1620-59-0x0000000000000000-mapping.dmp

Download
memory/1620-62-0x0000000010000000-0x000000001004F000-memory.dmp

Filesize
316KB

Download
memory/1620-60-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/1776-68-0x0000000000000000-mapping.dmp

Download
memory/1776-69-0x000007FEFC051000-0x000007FEFC053000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads