qakbot | 99ca4d78c14cfd9f6fe13b48182edf366400ea74aa712edeb780b90acf15d993

General

Target

99ca4d78c14cfd9f6fe13b48182edf366400ea74aa712edeb780b90acf15d993.dll
Size

230KB
MD5

6d5348e093b99e3c50b32a2af135cca6
SHA1

f87edb62046f84f8efb9f54b738850fc538c8f4c
SHA256

99ca4d78c14cfd9f6fe13b48182edf366400ea74aa712edeb780b90acf15d993
SHA512

5b9198e6f6780cb67167da8d013f353f38e596664b58d239e155178b37355aea68b0c1416c15d50184c2216a72521c360545de61c71e6631b983f2478a00d183

Score

10^/10

qakbot clinton16 1620911967 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

clinton16

Campaign

1620911967

C2

71.41.184.10:3389

216.201.162.158:443

95.77.223.148:443

71.74.12.34:443

86.220.62.251:2222

24.229.150.54:995

24.55.112.61:443

76.25.142.196:443

136.232.34.70:443

149.28.99.97:443

45.63.107.192:2222

45.63.107.192:443

149.28.99.97:2222

149.28.99.97:995

45.63.107.192:995

86.248.16.253:2222

86.160.137.225:443

75.67.192.125:443

140.82.49.12:443

47.22.148.6:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1532 2028 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exeWerFault.exe

pid process

2028 regsvr32.exe
1532 WerFault.exe
1532 WerFault.exe
1532 WerFault.exe
1532 WerFault.exe
1532 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1532 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1532 WerFault.exe

pid	pid_target	process	target process
1532	2028	WerFault.exe	regsvr32.exe

pid	process
2028	regsvr32.exe
1532	WerFault.exe
1532	WerFault.exe
1532	WerFault.exe
1532	WerFault.exe
1532	WerFault.exe

pid	process
1532	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1532	WerFault.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1208 wrote to memory of 2028	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 2028	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 2028	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 2028	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 2028	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 2028	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 2028	1208	regsvr32.exe	regsvr32.exe
PID 2028 wrote to memory of 1372	2028	regsvr32.exe	explorer.exe
PID 2028 wrote to memory of 1372	2028	regsvr32.exe	explorer.exe
PID 2028 wrote to memory of 1372	2028	regsvr32.exe	explorer.exe
PID 2028 wrote to memory of 1372	2028	regsvr32.exe	explorer.exe
PID 2028 wrote to memory of 1532	2028	regsvr32.exe	WerFault.exe
PID 2028 wrote to memory of 1532	2028	regsvr32.exe	WerFault.exe
PID 2028 wrote to memory of 1532	2028	regsvr32.exe	WerFault.exe
PID 2028 wrote to memory of 1532	2028	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\99ca4d78c14cfd9f6fe13b48182edf366400ea74aa712edeb780b90acf15d993.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\99ca4d78c14cfd9f6fe13b48182edf366400ea74aa712edeb780b90acf15d993.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 428
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1532

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-59-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

Filesize
8KB

Download
memory/1532-63-0x0000000000000000-mapping.dmp

Download
memory/1532-64-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/2028-60-0x0000000000000000-mapping.dmp

Download
memory/2028-61-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download
memory/2028-62-0x0000000000130000-0x000000000016D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing