qakbot | 92e3a986a4ba9a90a83924248c6b24c574e32eeea054e887f4d62fbdd01698b4

General

Target

92e3a986a4ba9a90a83924248c6b24c574e32eeea054e887f4d62fbdd01698b4.dll
Size

2.8MB
MD5

24595417e767d40268434ebe9db44a33
SHA1

a48e5761304fa3b76273da60dc3c8e2c755a4d4b
SHA256

92e3a986a4ba9a90a83924248c6b24c574e32eeea054e887f4d62fbdd01698b4
SHA512

7b1bfcbf38523f2fad3e469d913117baa1e4c0563935cbaddf064455f45272cb98496fed30e5591be997be6c40283fde1fc1612caa919980a386f064aaeef4ca

Score

10^/10

qakbot abc100 1606289576 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.29

Botnet

abc100

Campaign

1606289576

C2

198.2.35.226:2222

84.78.128.76:2078

120.150.34.178:443

24.201.61.153:2078

217.128.117.218:2222

217.133.54.140:32100

156.205.56.98:995

98.26.50.62:995

172.114.116.226:995

109.209.94.165:2222

72.190.101.70:443

92.59.35.196:2083

37.107.82.136:443

85.132.36.111:2222

174.76.11.123:995

219.74.176.225:443

98.118.156.172:443

94.59.120.142:443

72.29.181.78:2078

178.223.20.246:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1564 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1496 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

964 rundll32.exe
964 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

964 rundll32.exe

pid	process
1564	regsvr32.exe

pid	process
1496	schtasks.exe

pid	process
964	rundll32.exe
964	rundll32.exe

pid	process
964	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1672 wrote to memory of 964	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 964	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 964	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 964	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 964	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 964	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 964	1672	rundll32.exe	rundll32.exe
PID 964 wrote to memory of 524	964	rundll32.exe	explorer.exe
PID 964 wrote to memory of 524	964	rundll32.exe	explorer.exe
PID 964 wrote to memory of 524	964	rundll32.exe	explorer.exe
PID 964 wrote to memory of 524	964	rundll32.exe	explorer.exe
PID 964 wrote to memory of 524	964	rundll32.exe	explorer.exe
PID 964 wrote to memory of 524	964	rundll32.exe	explorer.exe
PID 524 wrote to memory of 1496	524	explorer.exe	schtasks.exe
PID 524 wrote to memory of 1496	524	explorer.exe	schtasks.exe
PID 524 wrote to memory of 1496	524	explorer.exe	schtasks.exe
PID 524 wrote to memory of 1496	524	explorer.exe	schtasks.exe
PID 1380 wrote to memory of 1956	1380	taskeng.exe	regsvr32.exe
PID 1380 wrote to memory of 1956	1380	taskeng.exe	regsvr32.exe
PID 1380 wrote to memory of 1956	1380	taskeng.exe	regsvr32.exe
PID 1380 wrote to memory of 1956	1380	taskeng.exe	regsvr32.exe
PID 1380 wrote to memory of 1956	1380	taskeng.exe	regsvr32.exe
PID 1956 wrote to memory of 1564	1956	regsvr32.exe	regsvr32.exe
PID 1956 wrote to memory of 1564	1956	regsvr32.exe	regsvr32.exe
PID 1956 wrote to memory of 1564	1956	regsvr32.exe	regsvr32.exe
PID 1956 wrote to memory of 1564	1956	regsvr32.exe	regsvr32.exe
PID 1956 wrote to memory of 1564	1956	regsvr32.exe	regsvr32.exe
PID 1956 wrote to memory of 1564	1956	regsvr32.exe	regsvr32.exe
PID 1956 wrote to memory of 1564	1956	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92e3a986a4ba9a90a83924248c6b24c574e32eeea054e887f4d62fbdd01698b4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92e3a986a4ba9a90a83924248c6b24c574e32eeea054e887f4d62fbdd01698b4.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:524

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn txxnjhnd /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\92e3a986a4ba9a90a83924248c6b24c574e32eeea054e887f4d62fbdd01698b4.dll\"" /SC ONCE /Z /ST 03:00 /ET 03:12
4⤵
- Creates scheduled task(s)
PID:1496

C:\Windows\system32\taskeng.exe
taskeng.exe {4CD3EFCF-FD08-4E81-B2F8-453E52035033} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\92e3a986a4ba9a90a83924248c6b24c574e32eeea054e887f4d62fbdd01698b4.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\92e3a986a4ba9a90a83924248c6b24c574e32eeea054e887f4d62fbdd01698b4.dll"
3⤵
- Loads dropped DLL
PID:1564

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\92e3a986a4ba9a90a83924248c6b24c574e32eeea054e887f4d62fbdd01698b4.dll
MD5
645a580e28777c7d96e18cd1a164df3a

SHA1
23406f7261921c253738d788fca845d089c40c07

SHA256
8fdf1952914d8f7e7b37860d894e24084fd09321e90f8835ba82e10092120369

SHA512
18948f94333c8780e3f57d2819e3823125d34a5458204395a8a7412df49eeeed6bbe5a9f0bd1c5510bcb6e200220468e050bca349dd89ac52a6664a71ebf68be

Download Submit
\Users\Admin\AppData\Local\Temp\92e3a986a4ba9a90a83924248c6b24c574e32eeea054e887f4d62fbdd01698b4.dll
MD5
645a580e28777c7d96e18cd1a164df3a

SHA1
23406f7261921c253738d788fca845d089c40c07

SHA256
8fdf1952914d8f7e7b37860d894e24084fd09321e90f8835ba82e10092120369

SHA512
18948f94333c8780e3f57d2819e3823125d34a5458204395a8a7412df49eeeed6bbe5a9f0bd1c5510bcb6e200220468e050bca349dd89ac52a6664a71ebf68be

Download Submit
memory/524-58-0x00000000000E0000-0x00000000000E2000-memory.dmp

Filesize
8KB

Download
memory/524-60-0x0000000074831000-0x0000000074833000-memory.dmp

Filesize
8KB

Download
memory/524-61-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/524-62-0x00000000000C0000-0x00000000000E0000-memory.dmp

Filesize
128KB

Download
memory/964-54-0x0000000075341000-0x0000000075343000-memory.dmp

Filesize
8KB

Download
memory/964-55-0x0000000000A40000-0x0000000000C2A000-memory.dmp

Filesize
1.9MB

Download
memory/964-56-0x0000000000270000-0x0000000000290000-memory.dmp

Filesize
128KB

Download
memory/964-57-0x0000000000270000-0x0000000000290000-memory.dmp

Filesize
128KB

Download
memory/1956-63-0x000007FEFBAD1000-0x000007FEFBAD3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads