qakbot | dd8b18f31dcfa89865629c0264283f6631d38d535b077a8afb3c55d8b677075c

General

Target

q.dll
Size

1.3MB
MD5

9ad3a0d8b2064d12a9098952c7ac3ee2
SHA1

bf59513b280b6a3d4fb7bf6c5c2836fa6d5ee4a2
SHA256

dd8b18f31dcfa89865629c0264283f6631d38d535b077a8afb3c55d8b677075c
SHA512

7a7e152c08889e399af1e126efa3f74638d2273ffecc8e779d752052bf75e2288b915909cd4d633045be9cb02bb84b948a82b958e1f8bdba200787320d23374e

Score

10^/10

qakbot notset 1632819510 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

notset

Campaign

1632819510

C2

196.217.156.63:995

120.150.218.241:995

95.77.223.148:443

185.250.148.74:443

181.118.183.94:443

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 508 created 648 508 WerFault.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3612 648 WerFault.exe rundll32.exe

description	pid	process	target process
PID 508 created 648	508	WerFault.exe	rundll32.exe

pid	pid_target	process	target process
3612	648	WerFault.exe	rundll32.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotification.exeWerFault.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2188 schtasks.exe

pid	process
2188	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeWerFault.exe

pid process

648 rundll32.exe
648 rundll32.exe
3612 WerFault.exe
3612 WerFault.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

648 rundll32.exe

pid	process
648	rundll32.exe
648	rundll32.exe
3612	WerFault.exe
3612	WerFault.exe

pid	process
648	rundll32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

WerFault.exeMusNotification.exe

description	pid	process
Token: SeRestorePrivilege	3612	WerFault.exe
Token: SeBackupPrivilege	3612	WerFault.exe
Token: SeShutdownPrivilege	1128	MusNotification.exe
Token: SeCreatePagefilePrivilege	1128	MusNotification.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rundll32.exeWerFault.exerundll32.exeexplorer.exe

description	pid	process	target process
PID 2436 wrote to memory of 648	2436	rundll32.exe	rundll32.exe
PID 2436 wrote to memory of 648	2436	rundll32.exe	rundll32.exe
PID 2436 wrote to memory of 648	2436	rundll32.exe	rundll32.exe
PID 508 wrote to memory of 648	508	WerFault.exe	rundll32.exe
PID 508 wrote to memory of 648	508	WerFault.exe	rundll32.exe
PID 648 wrote to memory of 3420	648	rundll32.exe	explorer.exe
PID 648 wrote to memory of 3420	648	rundll32.exe	explorer.exe
PID 648 wrote to memory of 3420	648	rundll32.exe	explorer.exe
PID 648 wrote to memory of 3420	648	rundll32.exe	explorer.exe
PID 648 wrote to memory of 3420	648	rundll32.exe	explorer.exe
PID 3420 wrote to memory of 2188	3420	explorer.exe	schtasks.exe
PID 3420 wrote to memory of 2188	3420	explorer.exe	schtasks.exe
PID 3420 wrote to memory of 2188	3420	explorer.exe	schtasks.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\q.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2436

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\q.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3420

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ludjwnb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\q.dll\"" /SC ONCE /Z /ST 14:18 /ET 14:30
4⤵
- Creates scheduled task(s)
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 716
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 648 -ip 648
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:508

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1128

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-130-0x0000000000000000-mapping.dmp

Download
memory/648-131-0x0000000003310000-0x0000000003311000-memory.dmp

Filesize
4KB

Download
memory/648-133-0x0000000005100000-0x0000000005121000-memory.dmp

Filesize
132KB

Download
memory/648-132-0x0000000005100000-0x0000000005121000-memory.dmp

Filesize
132KB

Download
memory/648-134-0x00000000050D0000-0x00000000050F1000-memory.dmp

Filesize
132KB

Download
memory/648-135-0x0000000005100000-0x0000000005121000-memory.dmp

Filesize
132KB

Download
memory/2188-138-0x0000000000000000-mapping.dmp

Download
memory/3420-136-0x0000000000000000-mapping.dmp

Download
memory/3420-137-0x0000000002590000-0x00000000025B1000-memory.dmp

Filesize
132KB

Download
memory/3420-139-0x0000000002A90000-0x0000000002A91000-memory.dmp

Filesize
4KB

Download
memory/3420-140-0x0000000002A90000-0x0000000002A91000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads