qakbot | 160bc861f844743c52a34eaa0b1053b904277093e50f311726609a7a4084bb50

General

Target

a1a6bbdd0ff39d7f32cae83884aa14b5b75029cd.dll
Size

285KB
MD5

d0d275326faf2b4ff27b6c8f07dbce13
SHA1

a1a6bbdd0ff39d7f32cae83884aa14b5b75029cd
SHA256

160bc861f844743c52a34eaa0b1053b904277093e50f311726609a7a4084bb50
SHA512

373a3a43985de2627cd79926ac533bd70881afb0e0f80226c004428e11377aa030bbd495f6ebcea5b20948770b53027a1339f283f39934c1573ece39957341d5

Score

10^/10

qakbot tr 1623837834 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.115

Botnet

tr

Campaign

1623837834

C2

144.139.47.206:443

105.198.236.101:443

136.232.34.70:443

90.65.234.26:2222

71.41.184.10:3389

98.192.185.86:443

184.185.103.157:443

24.179.77.236:443

81.97.154.100:443

186.144.33.73:443

96.253.46.210:443

213.122.113.120:443

47.22.148.6:443

149.28.99.97:995

45.63.107.192:2222

45.32.211.207:443

45.32.211.207:8443

149.28.98.196:995

45.63.107.192:995

45.77.115.208:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1200 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3680 1200 WerFault.exe regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

624 schtasks.exe

pid	process
1200	regsvr32.exe

pid	pid_target	process	target process
3680	1200	WerFault.exe	regsvr32.exe

pid	process
624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
3924	rundll32.exe
3924	rundll32.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

3924 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3680 WerFault.exe
Token: SeBackupPrivilege 3680 WerFault.exe
Token: SeDebugPrivilege 3680 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3680	WerFault.exe
Token: SeBackupPrivilege	3680	WerFault.exe
Token: SeDebugPrivilege	3680	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 3916 wrote to memory of 3924	3916	rundll32.exe	rundll32.exe
PID 3916 wrote to memory of 3924	3916	rundll32.exe	rundll32.exe
PID 3916 wrote to memory of 3924	3916	rundll32.exe	rundll32.exe
PID 3924 wrote to memory of 3152	3924	rundll32.exe	explorer.exe
PID 3924 wrote to memory of 3152	3924	rundll32.exe	explorer.exe
PID 3924 wrote to memory of 3152	3924	rundll32.exe	explorer.exe
PID 3924 wrote to memory of 3152	3924	rundll32.exe	explorer.exe
PID 3924 wrote to memory of 3152	3924	rundll32.exe	explorer.exe
PID 3152 wrote to memory of 624	3152	explorer.exe	schtasks.exe
PID 3152 wrote to memory of 624	3152	explorer.exe	schtasks.exe
PID 3152 wrote to memory of 624	3152	explorer.exe	schtasks.exe
PID 4048 wrote to memory of 1200	4048	regsvr32.exe	regsvr32.exe
PID 4048 wrote to memory of 1200	4048	regsvr32.exe	regsvr32.exe
PID 4048 wrote to memory of 1200	4048	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1a6bbdd0ff39d7f32cae83884aa14b5b75029cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3916

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1a6bbdd0ff39d7f32cae83884aa14b5b75029cd.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3924

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3152

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vlnodarqi /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a1a6bbdd0ff39d7f32cae83884aa14b5b75029cd.dll\"" /SC ONCE /Z /ST 13:51 /ET 14:03
4⤵
- Creates scheduled task(s)
PID:624

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a1a6bbdd0ff39d7f32cae83884aa14b5b75029cd.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4048

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\a1a6bbdd0ff39d7f32cae83884aa14b5b75029cd.dll"
2⤵
- Loads dropped DLL
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 600
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3680

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a1a6bbdd0ff39d7f32cae83884aa14b5b75029cd.dll
MD5
15c82ccdfe16aba35c26ce530ab83235

SHA1
a5670510025cc0a016d13db00809887bf029ed2a

SHA256
c922237211562a54698b3226248f390c9d37aff87b1009a5dee103fff1b989a2

SHA512
9335f798dc45df84e60f580dc06431a49568f02c33220da02278b3d27f5b6e2d7357bae858ed69fb7fff8acc19f2f6fafa953c5c921b6621791156f906f9201b

Download Submit
\Users\Admin\AppData\Local\Temp\a1a6bbdd0ff39d7f32cae83884aa14b5b75029cd.dll
MD5
15c82ccdfe16aba35c26ce530ab83235

SHA1
a5670510025cc0a016d13db00809887bf029ed2a

SHA256
c922237211562a54698b3226248f390c9d37aff87b1009a5dee103fff1b989a2

SHA512
9335f798dc45df84e60f580dc06431a49568f02c33220da02278b3d27f5b6e2d7357bae858ed69fb7fff8acc19f2f6fafa953c5c921b6621791156f906f9201b

Download Submit
memory/624-118-0x0000000000000000-mapping.dmp

Download
memory/1200-123-0x0000000000000000-mapping.dmp

Download
memory/3152-117-0x0000000000000000-mapping.dmp

Download
memory/3152-121-0x0000000000F20000-0x0000000000F4F000-memory.dmp

Filesize
188KB

Download
memory/3924-114-0x0000000000000000-mapping.dmp

Download
memory/3924-116-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/3924-115-0x0000000002B80000-0x0000000002BA3000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads