qakbot | 2b3a2ce3d0bf4ccd0007e3ecdc5ccbb02d28fb2ebfcff68bfa8001fd424b05c0

General

Target

2b3a2ce3d0bf4ccd0007e3ecdc5ccbb02d28fb2ebfcff68bfa8001fd424b05c0.dll
Size

2.8MB
MD5

289994ebb38837d2febce3570a917a64
SHA1

9a69c9fa04844e3ece2b20348173d6bd58db710c
SHA256

2b3a2ce3d0bf4ccd0007e3ecdc5ccbb02d28fb2ebfcff68bfa8001fd424b05c0
SHA512

24a6c1123c22feca40abc742889ef1a1cad1ac13f36cca5aa3c899e9f2dd24dab27646fff9a5bbcbbf81976a80fb5159dd5d1baa4cb29903baea842d1a4e4a73

Score

10^/10

qakbot abc100 1606289576 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.29

Botnet

abc100

Campaign

1606289576

C2

198.2.35.226:2222

84.78.128.76:2078

120.150.34.178:443

24.201.61.153:2078

217.128.117.218:2222

217.133.54.140:32100

156.205.56.98:995

98.26.50.62:995

172.114.116.226:995

109.209.94.165:2222

72.190.101.70:443

92.59.35.196:2083

37.107.82.136:443

85.132.36.111:2222

174.76.11.123:995

219.74.176.225:443

98.118.156.172:443

94.59.120.142:443

72.29.181.78:2078

178.223.20.246:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1208 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1696 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

588 rundll32.exe
588 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

588 rundll32.exe

pid	process
1208	regsvr32.exe

pid	process
1696	schtasks.exe

pid	process
588	rundll32.exe
588	rundll32.exe

pid	process
588	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 320 wrote to memory of 588	320	rundll32.exe	rundll32.exe
PID 320 wrote to memory of 588	320	rundll32.exe	rundll32.exe
PID 320 wrote to memory of 588	320	rundll32.exe	rundll32.exe
PID 320 wrote to memory of 588	320	rundll32.exe	rundll32.exe
PID 320 wrote to memory of 588	320	rundll32.exe	rundll32.exe
PID 320 wrote to memory of 588	320	rundll32.exe	rundll32.exe
PID 320 wrote to memory of 588	320	rundll32.exe	rundll32.exe
PID 588 wrote to memory of 572	588	rundll32.exe	explorer.exe
PID 588 wrote to memory of 572	588	rundll32.exe	explorer.exe
PID 588 wrote to memory of 572	588	rundll32.exe	explorer.exe
PID 588 wrote to memory of 572	588	rundll32.exe	explorer.exe
PID 588 wrote to memory of 572	588	rundll32.exe	explorer.exe
PID 588 wrote to memory of 572	588	rundll32.exe	explorer.exe
PID 572 wrote to memory of 1696	572	explorer.exe	schtasks.exe
PID 572 wrote to memory of 1696	572	explorer.exe	schtasks.exe
PID 572 wrote to memory of 1696	572	explorer.exe	schtasks.exe
PID 572 wrote to memory of 1696	572	explorer.exe	schtasks.exe
PID 1404 wrote to memory of 1836	1404	taskeng.exe	regsvr32.exe
PID 1404 wrote to memory of 1836	1404	taskeng.exe	regsvr32.exe
PID 1404 wrote to memory of 1836	1404	taskeng.exe	regsvr32.exe
PID 1404 wrote to memory of 1836	1404	taskeng.exe	regsvr32.exe
PID 1404 wrote to memory of 1836	1404	taskeng.exe	regsvr32.exe
PID 1836 wrote to memory of 1208	1836	regsvr32.exe	regsvr32.exe
PID 1836 wrote to memory of 1208	1836	regsvr32.exe	regsvr32.exe
PID 1836 wrote to memory of 1208	1836	regsvr32.exe	regsvr32.exe
PID 1836 wrote to memory of 1208	1836	regsvr32.exe	regsvr32.exe
PID 1836 wrote to memory of 1208	1836	regsvr32.exe	regsvr32.exe
PID 1836 wrote to memory of 1208	1836	regsvr32.exe	regsvr32.exe
PID 1836 wrote to memory of 1208	1836	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b3a2ce3d0bf4ccd0007e3ecdc5ccbb02d28fb2ebfcff68bfa8001fd424b05c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b3a2ce3d0bf4ccd0007e3ecdc5ccbb02d28fb2ebfcff68bfa8001fd424b05c0.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:588

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wgcbkjj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\2b3a2ce3d0bf4ccd0007e3ecdc5ccbb02d28fb2ebfcff68bfa8001fd424b05c0.dll\"" /SC ONCE /Z /ST 11:08 /ET 11:20
4⤵
- Creates scheduled task(s)
PID:1696

C:\Windows\system32\taskeng.exe
taskeng.exe {182685DB-AABF-4ED5-AD61-6E1A29615EA7} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\2b3a2ce3d0bf4ccd0007e3ecdc5ccbb02d28fb2ebfcff68bfa8001fd424b05c0.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\2b3a2ce3d0bf4ccd0007e3ecdc5ccbb02d28fb2ebfcff68bfa8001fd424b05c0.dll"
3⤵
- Loads dropped DLL
PID:1208

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2b3a2ce3d0bf4ccd0007e3ecdc5ccbb02d28fb2ebfcff68bfa8001fd424b05c0.dll
MD5
848c0a3ced0c7f6f337c9cbeb4d18d1a

SHA1
83172ddd5413cf19a4e6b23ea76cecc4ef22c661

SHA256
075b4bb248b09c0a793b30c681a41a9fb7b83726ae3d0b37d6e2e08c9e25b0f9

SHA512
fd77f63ea3ebb696fc10bc0ee8b153a1467878bbc03809e84635ff9d5f22d465c048eb2ace57b97e77e7af8c5b77dafc598137615bc51af9e8f61ef3868886b8

Download Submit
\Users\Admin\AppData\Local\Temp\2b3a2ce3d0bf4ccd0007e3ecdc5ccbb02d28fb2ebfcff68bfa8001fd424b05c0.dll
MD5
848c0a3ced0c7f6f337c9cbeb4d18d1a

SHA1
83172ddd5413cf19a4e6b23ea76cecc4ef22c661

SHA256
075b4bb248b09c0a793b30c681a41a9fb7b83726ae3d0b37d6e2e08c9e25b0f9

SHA512
fd77f63ea3ebb696fc10bc0ee8b153a1467878bbc03809e84635ff9d5f22d465c048eb2ace57b97e77e7af8c5b77dafc598137615bc51af9e8f61ef3868886b8

Download Submit
memory/572-58-0x00000000000A0000-0x00000000000A2000-memory.dmp

Filesize
8KB

Download
memory/572-60-0x00000000750E1000-0x00000000750E3000-memory.dmp

Filesize
8KB

Download
memory/572-61-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/572-62-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download
memory/588-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/588-55-0x0000000000A70000-0x0000000000C5A000-memory.dmp

Filesize
1.9MB

Download
memory/588-57-0x00000000000D0000-0x00000000000F0000-memory.dmp

Filesize
128KB

Download
memory/588-56-0x00000000000D0000-0x00000000000F0000-memory.dmp

Filesize
128KB

Download
memory/1836-63-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads