1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe.bin
1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe.bin.dll
890KB
21-10-2021 15:07
94128f783ebffa5f5203389d3dc26a0e
577840a380a9b4f7aeddd00fa21b15a4926755be
1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe
Extracted
| Family | qakbot |
| Version | 402.363 |
| Botnet | biden54 |
| Campaign | 1634810637 |
| C2 |
136.143.11.232:443 63.143.92.99:995 182.176.180.73:443 136.232.34.70:443 123.252.190.14:443 216.201.162.158:443 37.208.181.198:61200 140.82.49.12:443 197.89.144.102:443 89.137.52.44:443 109.12.111.14:443 78.191.24.189:995 105.198.236.99:995 196.207.140.40:995 41.235.69.115:443 2.222.167.138:443 117.198.156.56:443 24.231.209.2:6881 27.223.92.142:995 96.246.158.154:995 81.250.153.227:2222 120.150.218.241:995 76.25.142.196:443 89.101.97.139:443 81.213.59.22:443 173.21.10.71:2222 103.142.10.177:443 71.74.12.34:443 24.231.209.2:2222 75.188.35.168:443 209.210.95.228:995 73.151.236.31:443 220.255.25.187:2222 187.156.134.254:443 189.175.219.53:80 108.4.67.252:443 209.210.95.228:993 67.165.206.193:993 173.25.162.221:443 100.1.119.41:443 93.48.58.123:2222 65.100.174.110:443 201.137.10.225:443 24.229.150.54:995 146.66.238.74:443 68.204.7.158:443 37.208.181.198:443 41.86.42.158:995 189.135.16.92:443 187.75.66.160:995 |
| Attributes |
salt jHxastDcds)oMc=jvh7wdUhxcsdt2 |
Filter: none
-
Qakbot/Qbot
Description
Qbot or Qakbot is a sophisticated worm with banking capabilities.
Tags
-
Loads dropped DLLregsvr32.exe
Reported IOCs
pid process 1948 regsvr32.exe -
Creates scheduled task(s)schtasks.exe
Description
Schtasks is often used by malware for persistence or to perform post-infection execution.
Tags
TTPs
Reported IOCs
pid process 1908 schtasks.exe -
Suspicious behavior: EnumeratesProcessesrundll32.exe
Reported IOCs
pid process 552 rundll32.exe -
Suspicious behavior: MapViewOfSectionrundll32.exe
Reported IOCs
pid process 552 rundll32.exe -
Suspicious use of WriteProcessMemoryrundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe
Reported IOCs
description pid process target process PID 952 wrote to memory of 552 952 rundll32.exe rundll32.exe PID 952 wrote to memory of 552 952 rundll32.exe rundll32.exe PID 952 wrote to memory of 552 952 rundll32.exe rundll32.exe PID 952 wrote to memory of 552 952 rundll32.exe rundll32.exe PID 952 wrote to memory of 552 952 rundll32.exe rundll32.exe PID 952 wrote to memory of 552 952 rundll32.exe rundll32.exe PID 952 wrote to memory of 552 952 rundll32.exe rundll32.exe PID 552 wrote to memory of 1116 552 rundll32.exe explorer.exe PID 552 wrote to memory of 1116 552 rundll32.exe explorer.exe PID 552 wrote to memory of 1116 552 rundll32.exe explorer.exe PID 552 wrote to memory of 1116 552 rundll32.exe explorer.exe PID 552 wrote to memory of 1116 552 rundll32.exe explorer.exe PID 552 wrote to memory of 1116 552 rundll32.exe explorer.exe PID 1116 wrote to memory of 1908 1116 explorer.exe schtasks.exe PID 1116 wrote to memory of 1908 1116 explorer.exe schtasks.exe PID 1116 wrote to memory of 1908 1116 explorer.exe schtasks.exe PID 1116 wrote to memory of 1908 1116 explorer.exe schtasks.exe PID 880 wrote to memory of 1392 880 taskeng.exe regsvr32.exe PID 880 wrote to memory of 1392 880 taskeng.exe regsvr32.exe PID 880 wrote to memory of 1392 880 taskeng.exe regsvr32.exe PID 880 wrote to memory of 1392 880 taskeng.exe regsvr32.exe PID 880 wrote to memory of 1392 880 taskeng.exe regsvr32.exe PID 1392 wrote to memory of 1948 1392 regsvr32.exe regsvr32.exe PID 1392 wrote to memory of 1948 1392 regsvr32.exe regsvr32.exe PID 1392 wrote to memory of 1948 1392 regsvr32.exe regsvr32.exe PID 1392 wrote to memory of 1948 1392 regsvr32.exe regsvr32.exe PID 1392 wrote to memory of 1948 1392 regsvr32.exe regsvr32.exe PID 1392 wrote to memory of 1948 1392 regsvr32.exe regsvr32.exe PID 1392 wrote to memory of 1948 1392 regsvr32.exe regsvr32.exe
-
C:\Windows\system32\rundll32.exePID:952rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe.bin.dll,#1Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exePID:552rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe.bin.dll,#1Suspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSectionSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exePID:1116C:\Windows\SysWOW64\explorer.exeSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exePID:1908"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fkgqree /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe.bin.dll\"" /SC ONCE /Z /ST 17:04 /ET 17:16Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exePID:880taskeng.exe {DDF2568E-E91F-4441-BACE-561B86646F3D} S-1-5-18:NT AUTHORITY\System:Service:Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exePID:1392regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe.bin.dll"Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exePID:1948-s "C:\Users\Admin\AppData\Local\Temp\1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe.bin.dll"Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe.bin.dll
MD594128f783ebffa5f5203389d3dc26a0e
SHA1577840a380a9b4f7aeddd00fa21b15a4926755be
SHA2561a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe
SHA51294afeb12874513354fbf0d23cd7589b962e88efc45a669f01f3f04bde31562b304cd80cdf5d47e75925d4d37292bbe563c0d2f2999e8758520d1858dc4e1765b
-
\Users\Admin\AppData\Local\Temp\1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe.bin.dll
MD594128f783ebffa5f5203389d3dc26a0e
SHA1577840a380a9b4f7aeddd00fa21b15a4926755be
SHA2561a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe
SHA51294afeb12874513354fbf0d23cd7589b962e88efc45a669f01f3f04bde31562b304cd80cdf5d47e75925d4d37292bbe563c0d2f2999e8758520d1858dc4e1765b
-
memory/552-56-0x0000000076431000-0x0000000076433000-memory.dmp
-
memory/552-57-0x00000000748C0000-0x00000000749B3000-memory.dmp
-
memory/552-59-0x00000000748C0000-0x00000000749B3000-memory.dmp
-
memory/552-58-0x00000000748C0000-0x00000000748E1000-memory.dmp
-
memory/552-60-0x0000000000180000-0x0000000000181000-memory.dmp
-
memory/552-55-0x0000000000000000-mapping.dmp
-
memory/1116-62-0x0000000000000000-mapping.dmp
-
memory/1116-65-0x0000000000080000-0x00000000000A1000-memory.dmp
-
memory/1116-61-0x00000000000B0000-0x00000000000B2000-memory.dmp
-
memory/1116-64-0x00000000744B1000-0x00000000744B3000-memory.dmp
-
memory/1392-67-0x0000000000000000-mapping.dmp
-
memory/1392-68-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmp
-
memory/1908-66-0x0000000000000000-mapping.dmp
-
memory/1948-70-0x0000000000000000-mapping.dmp