qakbot | 41a5e77c99fbd0d58209f8c0fdf9b83b725811d9d6f95da8ca1438692fdec80e

Resubmissions

12-10-2021 13:02

211012-p966maccgj 10

Analysis

max time kernel
146s
max time network
122s
platform
windows10_x64
resource
win10-en-20210920
submitted
12-10-2021 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ocrafhh.html.dll
Size

1.0MB
MD5

454631306dac856ffaf9578cdde53377
SHA1

5cb4a6e3ca563b0600bb1f3ed9c769b21d065f4e
SHA256

41a5e77c99fbd0d58209f8c0fdf9b83b725811d9d6f95da8ca1438692fdec80e
SHA512

f9e96d31f19e33b74932bf1b30ef592409b081e08bdd2749d370333d219974845b11fbaf92fe67df10ed5d0bc8b449870320c3e4819c41475c63469370eb9011

Score

10^/10

qakbot tr 1633943125 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

Campaign

1633943125

140.82.49.12:443

89.137.52.44:443

24.107.165.50:443

66.216.193.114:443

75.131.217.182:443

41.86.42.158:995

24.119.214.7:443

67.166.233.75:443

105.198.236.99:443

120.151.47.189:443

2.222.167.138:443

41.228.22.180:443

78.105.213.151:995

5.193.125.67:995

41.86.42.158:443

96.57.188.174:2078

120.150.218.241:995

66.177.215.152:0

122.11.220.212:2222

73.52.50.32:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1276 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

3132 rundll32.exe
3132 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

3132 rundll32.exe

pid	process
1276	schtasks.exe

pid	process
3132	rundll32.exe
3132	rundll32.exe

pid	process
3132	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exe

description	pid	process	target process
PID 2344 wrote to memory of 3132	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 3132	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 3132	2344	rundll32.exe	rundll32.exe
PID 3132 wrote to memory of 2816	3132	rundll32.exe	explorer.exe
PID 3132 wrote to memory of 2816	3132	rundll32.exe	explorer.exe
PID 3132 wrote to memory of 2816	3132	rundll32.exe	explorer.exe
PID 3132 wrote to memory of 2816	3132	rundll32.exe	explorer.exe
PID 3132 wrote to memory of 2816	3132	rundll32.exe	explorer.exe
PID 2816 wrote to memory of 1276	2816	explorer.exe	schtasks.exe
PID 2816 wrote to memory of 1276	2816	explorer.exe	schtasks.exe
PID 2816 wrote to memory of 1276	2816	explorer.exe	schtasks.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ocrafhh.html.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ocrafhh.html.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3132

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2816

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vyisrvj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\ocrafhh.html.dll\"" /SC ONCE /Z /ST 13:06 /ET 13:18
4⤵
- Creates scheduled task(s)
PID:1276

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-120-0x0000000000000000-mapping.dmp

Download
memory/2816-118-0x0000000000000000-mapping.dmp

Download
memory/2816-119-0x0000000000C10000-0x0000000000C31000-memory.dmp

Filesize
132KB

Download
memory/2816-121-0x0000000001000000-0x0000000001001000-memory.dmp

Filesize
4KB

Download
memory/2816-122-0x0000000001000000-0x0000000001001000-memory.dmp

Filesize
4KB

Download
memory/3132-115-0x0000000000000000-mapping.dmp

Download
memory/3132-117-0x00000000736E0000-0x00000000737E5000-memory.dmp

Filesize
1.0MB

Download
memory/3132-116-0x0000000002DE0000-0x0000000002E00000-memory.dmp

Filesize
128KB

Download