qakbot | a5ad66e0217371e44c845dec4eb484b54059f61f873cfb5a5764ca7690fce16e

General

Target

402.12_dll.bin.dll
Size

484KB
MD5

2d0ffdce1fa1871d2581f0fcacd6beba
SHA1

ca5e07063e17f734a400a10c4f434bc14e4c0c5d
SHA256

a5ad66e0217371e44c845dec4eb484b54059f61f873cfb5a5764ca7690fce16e
SHA512

4c9808155d1825cb4dec185289d762c026b3375be46f6dd89fd74e358bc6885104edff13cf1891802c265098b5dae388bedf62867c22085abb42681a3e999f54

Score

10^/10

qakbot tr 1618935072 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.12

Botnet

tr

Campaign

1618935072

C2

140.82.49.12:443

190.85.91.154:443

96.37.113.36:993

71.41.184.10:3389

186.31.46.121:443

73.25.124.140:2222

109.12.111.14:443

24.229.150.54:995

45.32.211.207:443

45.77.117.108:443

45.77.117.108:8443

149.28.98.196:443

149.28.98.196:2222

144.202.38.185:443

144.202.38.185:995

45.32.211.207:995

207.246.116.237:995

149.28.99.97:995

45.63.107.192:2222

149.28.101.90:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1260 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

1468 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1468 regsvr32.exe

pid	process
1260	schtasks.exe

pid	process
1468	regsvr32.exe

pid	process
1468	regsvr32.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 384 wrote to memory of 1468	384	regsvr32.exe	regsvr32.exe
PID 384 wrote to memory of 1468	384	regsvr32.exe	regsvr32.exe
PID 384 wrote to memory of 1468	384	regsvr32.exe	regsvr32.exe
PID 384 wrote to memory of 1468	384	regsvr32.exe	regsvr32.exe
PID 384 wrote to memory of 1468	384	regsvr32.exe	regsvr32.exe
PID 384 wrote to memory of 1468	384	regsvr32.exe	regsvr32.exe
PID 384 wrote to memory of 1468	384	regsvr32.exe	regsvr32.exe
PID 1468 wrote to memory of 1272	1468	regsvr32.exe	explorer.exe
PID 1468 wrote to memory of 1272	1468	regsvr32.exe	explorer.exe
PID 1468 wrote to memory of 1272	1468	regsvr32.exe	explorer.exe
PID 1468 wrote to memory of 1272	1468	regsvr32.exe	explorer.exe
PID 1468 wrote to memory of 1272	1468	regsvr32.exe	explorer.exe
PID 1468 wrote to memory of 1272	1468	regsvr32.exe	explorer.exe
PID 1272 wrote to memory of 1260	1272	explorer.exe	schtasks.exe
PID 1272 wrote to memory of 1260	1272	explorer.exe	schtasks.exe
PID 1272 wrote to memory of 1260	1272	explorer.exe	schtasks.exe
PID 1272 wrote to memory of 1260	1272	explorer.exe	schtasks.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\402.12_dll.bin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:384

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\402.12_dll.bin.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lcujkdixtr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\402.12_dll.bin.dll\"" /SC ONCE /Z /ST 00:08 /ET 00:20
4⤵
- Creates scheduled task(s)
PID:1260

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-59-0x000007FEFBDC1000-0x000007FEFBDC3000-memory.dmp

Filesize
8KB

Download
memory/1260-65-0x0000000000000000-mapping.dmp

Download
memory/1272-62-0x0000000000000000-mapping.dmp

Download
memory/1272-64-0x00000000747D1000-0x00000000747D3000-memory.dmp

Filesize
8KB

Download
memory/1272-66-0x0000000000080000-0x00000000000B9000-memory.dmp

Filesize
228KB

Download
memory/1468-60-0x0000000000000000-mapping.dmp

Download
memory/1468-61-0x0000000076661000-0x0000000076663000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads