qakbot | 363ad1bb5e5f2ca46742870c8d3cd1c4000a2610fa3f7ac7b611d6ed73e10c93

General

Target

dd1f4f272f8839fc025f26b14ab69a97fcead26c.dll
Size

285KB
MD5

6b518674c83347e7331bb6b19e7ae1cb
SHA1

dd1f4f272f8839fc025f26b14ab69a97fcead26c
SHA256

363ad1bb5e5f2ca46742870c8d3cd1c4000a2610fa3f7ac7b611d6ed73e10c93
SHA512

83463b9cc758e94df7e842af93769a76f7b1745806514bae52dbe3588d8b319d1a2a7280cbe7f68049f2b971d5cd44c3df18a933c53d9471de0ed9f83fceefdc

Score

10^/10

qakbot tr 1623837834 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.115

Botnet

tr

Campaign

1623837834

C2

144.139.47.206:443

105.198.236.101:443

136.232.34.70:443

90.65.234.26:2222

71.41.184.10:3389

98.192.185.86:443

184.185.103.157:443

24.179.77.236:443

81.97.154.100:443

186.144.33.73:443

96.253.46.210:443

213.122.113.120:443

47.22.148.6:443

149.28.99.97:995

45.63.107.192:2222

45.32.211.207:443

45.32.211.207:8443

149.28.98.196:995

45.63.107.192:995

45.77.115.208:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1628 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

512 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1188 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1188 rundll32.exe

pid	process
1628	regsvr32.exe

pid	process
512	schtasks.exe

pid	process
1188	rundll32.exe

pid	process
1188	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1936 wrote to memory of 1188	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1188	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1188	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1188	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1188	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1188	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 1188	1936	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 1136	1188	rundll32.exe	explorer.exe
PID 1188 wrote to memory of 1136	1188	rundll32.exe	explorer.exe
PID 1188 wrote to memory of 1136	1188	rundll32.exe	explorer.exe
PID 1188 wrote to memory of 1136	1188	rundll32.exe	explorer.exe
PID 1188 wrote to memory of 1136	1188	rundll32.exe	explorer.exe
PID 1188 wrote to memory of 1136	1188	rundll32.exe	explorer.exe
PID 1136 wrote to memory of 512	1136	explorer.exe	schtasks.exe
PID 1136 wrote to memory of 512	1136	explorer.exe	schtasks.exe
PID 1136 wrote to memory of 512	1136	explorer.exe	schtasks.exe
PID 1136 wrote to memory of 512	1136	explorer.exe	schtasks.exe
PID 820 wrote to memory of 800	820	taskeng.exe	regsvr32.exe
PID 820 wrote to memory of 800	820	taskeng.exe	regsvr32.exe
PID 820 wrote to memory of 800	820	taskeng.exe	regsvr32.exe
PID 820 wrote to memory of 800	820	taskeng.exe	regsvr32.exe
PID 820 wrote to memory of 800	820	taskeng.exe	regsvr32.exe
PID 800 wrote to memory of 1628	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 1628	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 1628	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 1628	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 1628	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 1628	800	regsvr32.exe	regsvr32.exe
PID 800 wrote to memory of 1628	800	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd1f4f272f8839fc025f26b14ab69a97fcead26c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd1f4f272f8839fc025f26b14ab69a97fcead26c.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1188

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1136

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cpjkthn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\dd1f4f272f8839fc025f26b14ab69a97fcead26c.dll\"" /SC ONCE /Z /ST 15:44 /ET 15:56
4⤵
- Creates scheduled task(s)
PID:512

C:\Windows\system32\taskeng.exe
taskeng.exe {E0BF4FFA-5CCF-4C2C-B680-9060AC7B40A1} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:820

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\dd1f4f272f8839fc025f26b14ab69a97fcead26c.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\dd1f4f272f8839fc025f26b14ab69a97fcead26c.dll"
3⤵
- Loads dropped DLL
PID:1628

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dd1f4f272f8839fc025f26b14ab69a97fcead26c.dll
MD5
c399a56f7697e1b015a0b58ffcb95cdb

SHA1
59afb07b1d979ce8a2503d19dbd8d948125de380

SHA256
cd8140b8699f3cd222447e5425a84e8db1879387545762505d3fc1e88b8968ac

SHA512
c36688b9d73f15f5bd1e59142cbf61c85c301af41323bb40babdeb50987dba5c2e75437b327fa41ab4b4e857978cefd58630f8930ae59f40325e7344c188973c

Download Submit
\Users\Admin\AppData\Local\Temp\dd1f4f272f8839fc025f26b14ab69a97fcead26c.dll
MD5
c399a56f7697e1b015a0b58ffcb95cdb

SHA1
59afb07b1d979ce8a2503d19dbd8d948125de380

SHA256
cd8140b8699f3cd222447e5425a84e8db1879387545762505d3fc1e88b8968ac

SHA512
c36688b9d73f15f5bd1e59142cbf61c85c301af41323bb40babdeb50987dba5c2e75437b327fa41ab4b4e857978cefd58630f8930ae59f40325e7344c188973c

Download Submit
memory/512-67-0x0000000000000000-mapping.dmp

Download
memory/800-70-0x000007FEFBC41000-0x000007FEFBC43000-memory.dmp

Filesize
8KB

Download
memory/800-69-0x0000000000000000-mapping.dmp

Download
memory/1136-64-0x0000000000000000-mapping.dmp

Download
memory/1136-66-0x0000000074A31000-0x0000000074A33000-memory.dmp

Filesize
8KB

Download
memory/1136-68-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1188-62-0x00000000001F0000-0x0000000000236000-memory.dmp

Filesize
280KB

Download
memory/1188-60-0x0000000000000000-mapping.dmp

Download
memory/1188-63-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/1188-61-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1628-72-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads