qakbot | 6a2d87b85a22341e17f989648347d0a0b9614eae65db9f851b8c74fd730dfa4d

General

Target

6a2d87b85a22341e17f989648347d0a0b9614eae65db9f851b8c74fd730dfa4d.dll
Size

198KB
MD5

0d238c087ac5f7ea91b289e709ccd673
SHA1

017b3b753e81d41952b21cbe974d5dab0cd2ac58
SHA256

6a2d87b85a22341e17f989648347d0a0b9614eae65db9f851b8c74fd730dfa4d
SHA512

e0fe457195019631e1a09fb89db6f1c4ba9ad34db64023d4f8aeeeb7b2e0193240751dee0bed0d8abfd10f6bbe9d4caf49f77dc4484c2eeec38548fc8010ed20

Score

10^/10

qakbot krk01 1611569149 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

krk01

Campaign

1611569149

C2

31.5.21.66:995

89.3.198.238:443

202.188.138.162:443

188.24.128.253:443

175.141.219.71:443

151.60.15.183:443

184.189.122.72:443

80.227.5.70:443

140.82.49.12:443

89.211.241.100:995

81.97.154.100:443

77.27.174.49:995

92.154.83.96:2078

42.3.8.54:443

71.187.170.235:443

46.153.36.53:995

71.182.142.63:443

105.186.102.16:443

50.244.112.106:443

78.63.226.32:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1124 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1060 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1568 regsvr32.exe
1568 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1568 regsvr32.exe

pid	process
1124	regsvr32.exe

pid	process
1060	schtasks.exe

pid	process
1568	regsvr32.exe
1568	regsvr32.exe

pid	process
1568	regsvr32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1308 wrote to memory of 1568	1308	regsvr32.exe	regsvr32.exe
PID 1308 wrote to memory of 1568	1308	regsvr32.exe	regsvr32.exe
PID 1308 wrote to memory of 1568	1308	regsvr32.exe	regsvr32.exe
PID 1308 wrote to memory of 1568	1308	regsvr32.exe	regsvr32.exe
PID 1308 wrote to memory of 1568	1308	regsvr32.exe	regsvr32.exe
PID 1308 wrote to memory of 1568	1308	regsvr32.exe	regsvr32.exe
PID 1308 wrote to memory of 1568	1308	regsvr32.exe	regsvr32.exe
PID 1568 wrote to memory of 2032	1568	regsvr32.exe	explorer.exe
PID 1568 wrote to memory of 2032	1568	regsvr32.exe	explorer.exe
PID 1568 wrote to memory of 2032	1568	regsvr32.exe	explorer.exe
PID 1568 wrote to memory of 2032	1568	regsvr32.exe	explorer.exe
PID 1568 wrote to memory of 2032	1568	regsvr32.exe	explorer.exe
PID 1568 wrote to memory of 2032	1568	regsvr32.exe	explorer.exe
PID 2032 wrote to memory of 1060	2032	explorer.exe	schtasks.exe
PID 2032 wrote to memory of 1060	2032	explorer.exe	schtasks.exe
PID 2032 wrote to memory of 1060	2032	explorer.exe	schtasks.exe
PID 2032 wrote to memory of 1060	2032	explorer.exe	schtasks.exe
PID 1064 wrote to memory of 1200	1064	taskeng.exe	regsvr32.exe
PID 1064 wrote to memory of 1200	1064	taskeng.exe	regsvr32.exe
PID 1064 wrote to memory of 1200	1064	taskeng.exe	regsvr32.exe
PID 1064 wrote to memory of 1200	1064	taskeng.exe	regsvr32.exe
PID 1064 wrote to memory of 1200	1064	taskeng.exe	regsvr32.exe
PID 1200 wrote to memory of 1124	1200	regsvr32.exe	regsvr32.exe
PID 1200 wrote to memory of 1124	1200	regsvr32.exe	regsvr32.exe
PID 1200 wrote to memory of 1124	1200	regsvr32.exe	regsvr32.exe
PID 1200 wrote to memory of 1124	1200	regsvr32.exe	regsvr32.exe
PID 1200 wrote to memory of 1124	1200	regsvr32.exe	regsvr32.exe
PID 1200 wrote to memory of 1124	1200	regsvr32.exe	regsvr32.exe
PID 1200 wrote to memory of 1124	1200	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6a2d87b85a22341e17f989648347d0a0b9614eae65db9f851b8c74fd730dfa4d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\6a2d87b85a22341e17f989648347d0a0b9614eae65db9f851b8c74fd730dfa4d.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pksozarcl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\6a2d87b85a22341e17f989648347d0a0b9614eae65db9f851b8c74fd730dfa4d.dll\"" /SC ONCE /Z /ST 15:49 /ET 16:01
4⤵
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\taskeng.exe
taskeng.exe {218FED94-D256-44FE-BEF3-A56E8FFED996} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\6a2d87b85a22341e17f989648347d0a0b9614eae65db9f851b8c74fd730dfa4d.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\6a2d87b85a22341e17f989648347d0a0b9614eae65db9f851b8c74fd730dfa4d.dll"
3⤵
- Loads dropped DLL
PID:1124

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6a2d87b85a22341e17f989648347d0a0b9614eae65db9f851b8c74fd730dfa4d.dll
MD5
53a67f87e42e7b76c2a783aacb62f32d

SHA1
88b33fd47fb8b4acfb1936f7ea0e0dee319ed158

SHA256
79703a0ef95c064489c8528463c73e6ff46335338417728e483cfb011c27e6c3

SHA512
fc1632206b1aa548140268a98e9c383f01ee8c780b5acd1b2886f81402968cb81ded0e4b7396e66d2e225f78734fe52dcffc51f6afe12d4825c3116afa22ab26

Download Submit
\Users\Admin\AppData\Local\Temp\6a2d87b85a22341e17f989648347d0a0b9614eae65db9f851b8c74fd730dfa4d.dll
MD5
53a67f87e42e7b76c2a783aacb62f32d

SHA1
88b33fd47fb8b4acfb1936f7ea0e0dee319ed158

SHA256
79703a0ef95c064489c8528463c73e6ff46335338417728e483cfb011c27e6c3

SHA512
fc1632206b1aa548140268a98e9c383f01ee8c780b5acd1b2886f81402968cb81ded0e4b7396e66d2e225f78734fe52dcffc51f6afe12d4825c3116afa22ab26

Download Submit
memory/1308-54-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Filesize
8KB

Download
memory/1568-55-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Filesize
8KB

Download
memory/2032-56-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/2032-58-0x0000000074C71000-0x0000000074C73000-memory.dmp

Filesize
8KB

Download
memory/2032-59-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/2032-60-0x0000000000160000-0x0000000000195000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads