qakbot | 363ad1bb5e5f2ca46742870c8d3cd1c4000a2610fa3f7ac7b611d6ed73e10c93

General

Target

dd1f4f272f8839fc025f26b14ab69a97fcead26c.dll
Size

285KB
MD5

6b518674c83347e7331bb6b19e7ae1cb
SHA1

dd1f4f272f8839fc025f26b14ab69a97fcead26c
SHA256

363ad1bb5e5f2ca46742870c8d3cd1c4000a2610fa3f7ac7b611d6ed73e10c93
SHA512

83463b9cc758e94df7e842af93769a76f7b1745806514bae52dbe3588d8b319d1a2a7280cbe7f68049f2b971d5cd44c3df18a933c53d9471de0ed9f83fceefdc

Score

10^/10

qakbot tr 1623837834 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.115

Botnet

tr

Campaign

1623837834

C2

144.139.47.206:443

105.198.236.101:443

136.232.34.70:443

90.65.234.26:2222

71.41.184.10:3389

98.192.185.86:443

184.185.103.157:443

24.179.77.236:443

81.97.154.100:443

186.144.33.73:443

96.253.46.210:443

213.122.113.120:443

47.22.148.6:443

149.28.99.97:995

45.63.107.192:2222

45.32.211.207:443

45.32.211.207:8443

149.28.98.196:995

45.63.107.192:995

45.77.115.208:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2972 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3124 2972 WerFault.exe regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2880 schtasks.exe

pid	process
2972	regsvr32.exe

pid	pid_target	process	target process
3124	2972	WerFault.exe	regsvr32.exe

pid	process
2880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
1840	rundll32.exe
1840	rundll32.exe
3124	WerFault.exe
3124	WerFault.exe
3124	WerFault.exe
3124	WerFault.exe
3124	WerFault.exe
3124	WerFault.exe
3124	WerFault.exe
3124	WerFault.exe
3124	WerFault.exe
3124	WerFault.exe
3124	WerFault.exe
3124	WerFault.exe
3124	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1840 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3124 WerFault.exe
Token: SeBackupPrivilege 3124 WerFault.exe
Token: SeDebugPrivilege 3124 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3124	WerFault.exe
Token: SeBackupPrivilege	3124	WerFault.exe
Token: SeDebugPrivilege	3124	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 4056 wrote to memory of 1840	4056	rundll32.exe	rundll32.exe
PID 4056 wrote to memory of 1840	4056	rundll32.exe	rundll32.exe
PID 4056 wrote to memory of 1840	4056	rundll32.exe	rundll32.exe
PID 1840 wrote to memory of 3144	1840	rundll32.exe	explorer.exe
PID 1840 wrote to memory of 3144	1840	rundll32.exe	explorer.exe
PID 1840 wrote to memory of 3144	1840	rundll32.exe	explorer.exe
PID 1840 wrote to memory of 3144	1840	rundll32.exe	explorer.exe
PID 1840 wrote to memory of 3144	1840	rundll32.exe	explorer.exe
PID 3144 wrote to memory of 2880	3144	explorer.exe	schtasks.exe
PID 3144 wrote to memory of 2880	3144	explorer.exe	schtasks.exe
PID 3144 wrote to memory of 2880	3144	explorer.exe	schtasks.exe
PID 2404 wrote to memory of 2972	2404	regsvr32.exe	regsvr32.exe
PID 2404 wrote to memory of 2972	2404	regsvr32.exe	regsvr32.exe
PID 2404 wrote to memory of 2972	2404	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd1f4f272f8839fc025f26b14ab69a97fcead26c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4056

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd1f4f272f8839fc025f26b14ab69a97fcead26c.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3144

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yuceenhlyi /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\dd1f4f272f8839fc025f26b14ab69a97fcead26c.dll\"" /SC ONCE /Z /ST 13:51 /ET 14:03
4⤵
- Creates scheduled task(s)
PID:2880

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\dd1f4f272f8839fc025f26b14ab69a97fcead26c.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\dd1f4f272f8839fc025f26b14ab69a97fcead26c.dll"
2⤵
- Loads dropped DLL
PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 596
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3124

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dd1f4f272f8839fc025f26b14ab69a97fcead26c.dll
MD5
c399a56f7697e1b015a0b58ffcb95cdb

SHA1
59afb07b1d979ce8a2503d19dbd8d948125de380

SHA256
cd8140b8699f3cd222447e5425a84e8db1879387545762505d3fc1e88b8968ac

SHA512
c36688b9d73f15f5bd1e59142cbf61c85c301af41323bb40babdeb50987dba5c2e75437b327fa41ab4b4e857978cefd58630f8930ae59f40325e7344c188973c

Download Submit
\Users\Admin\AppData\Local\Temp\dd1f4f272f8839fc025f26b14ab69a97fcead26c.dll
MD5
c399a56f7697e1b015a0b58ffcb95cdb

SHA1
59afb07b1d979ce8a2503d19dbd8d948125de380

SHA256
cd8140b8699f3cd222447e5425a84e8db1879387545762505d3fc1e88b8968ac

SHA512
c36688b9d73f15f5bd1e59142cbf61c85c301af41323bb40babdeb50987dba5c2e75437b327fa41ab4b4e857978cefd58630f8930ae59f40325e7344c188973c

Download Submit
memory/1840-114-0x0000000000000000-mapping.dmp

Download
memory/1840-115-0x0000000002840000-0x0000000002863000-memory.dmp

Filesize
140KB

Download
memory/1840-116-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/2880-118-0x0000000000000000-mapping.dmp

Download
memory/2972-123-0x0000000000000000-mapping.dmp

Download
memory/3144-117-0x0000000000000000-mapping.dmp

Download
memory/3144-121-0x0000000000EF0000-0x0000000000F1F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads