qakbot | e0d072cabeeb73e77e96509c7a41d1b107e9ad732e3c85835856510fac431f01

General

Target

e0d072cabeeb73e77e96509c7a41d1b107e9ad732e3c85835856510fac431f01.dll
Size

88KB
MD5

f531df4ccf0e79fc7008c027c8da8b19
SHA1

efd0d1ed621c251fed7fd471f25e6ac48d3be1ec
SHA256

e0d072cabeeb73e77e96509c7a41d1b107e9ad732e3c85835856510fac431f01
SHA512

ba705ad5c3336801f8bcc4166b01c0be5bbdab3640fabfdaac3922fb82cfbc0adaeb3246ef8933949ac55344483b5a9a6aabeda00c37941024e76fd233e80e02

Score

10^/10

qakbot tr 1618225074 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.1

Botnet

tr

Campaign

1618225074

C2

197.45.110.165:995

216.201.162.158:443

71.74.12.34:443

45.63.107.192:2222

149.28.101.90:2222

45.32.211.207:443

45.32.211.207:995

45.32.211.207:8443

45.32.211.207:2222

149.28.99.97:995

149.28.98.196:443

149.28.101.90:443

149.28.101.90:8443

207.246.77.75:2222

207.246.116.237:443

207.246.116.237:995

207.246.116.237:2222

45.77.117.108:995

149.28.99.97:443

45.63.107.192:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

984 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1540 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

1032 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1032 regsvr32.exe

pid	process
984	regsvr32.exe

pid	process
1540	schtasks.exe

pid	process
1032	regsvr32.exe

pid	process
1032	regsvr32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1592 wrote to memory of 1032	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1032	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1032	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1032	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1032	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1032	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1032	1592	regsvr32.exe	regsvr32.exe
PID 1032 wrote to memory of 468	1032	regsvr32.exe	explorer.exe
PID 1032 wrote to memory of 468	1032	regsvr32.exe	explorer.exe
PID 1032 wrote to memory of 468	1032	regsvr32.exe	explorer.exe
PID 1032 wrote to memory of 468	1032	regsvr32.exe	explorer.exe
PID 1032 wrote to memory of 468	1032	regsvr32.exe	explorer.exe
PID 1032 wrote to memory of 468	1032	regsvr32.exe	explorer.exe
PID 468 wrote to memory of 1540	468	explorer.exe	schtasks.exe
PID 468 wrote to memory of 1540	468	explorer.exe	schtasks.exe
PID 468 wrote to memory of 1540	468	explorer.exe	schtasks.exe
PID 468 wrote to memory of 1540	468	explorer.exe	schtasks.exe
PID 1568 wrote to memory of 1460	1568	taskeng.exe	regsvr32.exe
PID 1568 wrote to memory of 1460	1568	taskeng.exe	regsvr32.exe
PID 1568 wrote to memory of 1460	1568	taskeng.exe	regsvr32.exe
PID 1568 wrote to memory of 1460	1568	taskeng.exe	regsvr32.exe
PID 1568 wrote to memory of 1460	1568	taskeng.exe	regsvr32.exe
PID 1460 wrote to memory of 984	1460	regsvr32.exe	regsvr32.exe
PID 1460 wrote to memory of 984	1460	regsvr32.exe	regsvr32.exe
PID 1460 wrote to memory of 984	1460	regsvr32.exe	regsvr32.exe
PID 1460 wrote to memory of 984	1460	regsvr32.exe	regsvr32.exe
PID 1460 wrote to memory of 984	1460	regsvr32.exe	regsvr32.exe
PID 1460 wrote to memory of 984	1460	regsvr32.exe	regsvr32.exe
PID 1460 wrote to memory of 984	1460	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e0d072cabeeb73e77e96509c7a41d1b107e9ad732e3c85835856510fac431f01.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\e0d072cabeeb73e77e96509c7a41d1b107e9ad732e3c85835856510fac431f01.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:468

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yigzmjqoh /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\e0d072cabeeb73e77e96509c7a41d1b107e9ad732e3c85835856510fac431f01.dll\"" /SC ONCE /Z /ST 15:02 /ET 15:14
4⤵
- Creates scheduled task(s)
PID:1540

C:\Windows\system32\taskeng.exe
taskeng.exe {52F07838-1A81-43D6-A1B2-AD84F91268D2} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\e0d072cabeeb73e77e96509c7a41d1b107e9ad732e3c85835856510fac431f01.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\e0d072cabeeb73e77e96509c7a41d1b107e9ad732e3c85835856510fac431f01.dll"
3⤵
- Loads dropped DLL
PID:984

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e0d072cabeeb73e77e96509c7a41d1b107e9ad732e3c85835856510fac431f01.dll
MD5
f3270ace4c62496b02582a2020dfe165

SHA1
338941328eb60d292d6f42336c890d819688b49d

SHA256
2c9528c09df4b8a75e9589badce4eccd8ec704b5d3fc8e68fae145420dc0f2c0

SHA512
d9e995a2fe6c87d7815b3254c5e96ab10ee3b965e0409e05d35ee740a30d2319fc426d1e3cdecbe89fb4aa85caf3b5fc94b82b4b26c4088a4eaed5b9ae11d96f

Download Submit
\Users\Admin\AppData\Local\Temp\e0d072cabeeb73e77e96509c7a41d1b107e9ad732e3c85835856510fac431f01.dll
MD5
f3270ace4c62496b02582a2020dfe165

SHA1
338941328eb60d292d6f42336c890d819688b49d

SHA256
2c9528c09df4b8a75e9589badce4eccd8ec704b5d3fc8e68fae145420dc0f2c0

SHA512
d9e995a2fe6c87d7815b3254c5e96ab10ee3b965e0409e05d35ee740a30d2319fc426d1e3cdecbe89fb4aa85caf3b5fc94b82b4b26c4088a4eaed5b9ae11d96f

Download Submit
memory/468-56-0x00000000000E0000-0x00000000000E2000-memory.dmp

Filesize
8KB

Download
memory/468-58-0x0000000074621000-0x0000000074623000-memory.dmp

Filesize
8KB

Download
memory/468-59-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/468-60-0x00000000000C0000-0x00000000000D9000-memory.dmp

Filesize
100KB

Download
memory/1032-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1592-54-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads