qakbot | 8e74103c86b4498e63869dd1f458c6bc737ca82be4fcf69c791e69829c4c3d35

General

Target

8e74103c86b4498e63869dd1f458c6bc737ca82be4fcf69c791e69829c4c3d35.dll
Size

2.1MB
MD5

95cc43df7834987b8b7bf933be21c2b8
SHA1

4aa31487c67aaefb7d1fa6807329ca29fb9c87ee
SHA256

8e74103c86b4498e63869dd1f458c6bc737ca82be4fcf69c791e69829c4c3d35
SHA512

c5e6b41eb51e03ee5e4fddd75e91bd05506b2d21aa1163093e72e8a856a61054755f58630b165ee79e182fb6200343cccd847f154080ace4af315db067d22da0

Score

10^/10

qakbot abc107 1607078484 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.62

Botnet

abc107

Campaign

1607078484

C2

32.212.117.188:443

109.205.204.229:2222

72.36.59.46:2222

173.18.126.193:2222

96.225.88.23:443

89.137.211.239:443

110.142.205.182:443

82.76.47.211:443

193.83.25.177:995

67.40.253.209:995

73.244.83.199:443

2.90.186.243:995

189.252.62.238:995

141.237.135.194:443

82.78.70.128:443

185.125.151.172:443

79.117.239.22:2222

86.189.252.131:2222

83.114.243.80:2222

2.50.56.81:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1992 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

456 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1092 rundll32.exe
1092 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1092 rundll32.exe

pid	process
1992	regsvr32.exe

pid	process
456	schtasks.exe

pid	process
1092	rundll32.exe
1092	rundll32.exe

pid	process
1092	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1632 wrote to memory of 1092	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1092	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1092	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1092	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1092	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1092	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1092	1632	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 268	1092	rundll32.exe	explorer.exe
PID 1092 wrote to memory of 268	1092	rundll32.exe	explorer.exe
PID 1092 wrote to memory of 268	1092	rundll32.exe	explorer.exe
PID 1092 wrote to memory of 268	1092	rundll32.exe	explorer.exe
PID 1092 wrote to memory of 268	1092	rundll32.exe	explorer.exe
PID 1092 wrote to memory of 268	1092	rundll32.exe	explorer.exe
PID 268 wrote to memory of 456	268	explorer.exe	schtasks.exe
PID 268 wrote to memory of 456	268	explorer.exe	schtasks.exe
PID 268 wrote to memory of 456	268	explorer.exe	schtasks.exe
PID 268 wrote to memory of 456	268	explorer.exe	schtasks.exe
PID 1952 wrote to memory of 1792	1952	taskeng.exe	regsvr32.exe
PID 1952 wrote to memory of 1792	1952	taskeng.exe	regsvr32.exe
PID 1952 wrote to memory of 1792	1952	taskeng.exe	regsvr32.exe
PID 1952 wrote to memory of 1792	1952	taskeng.exe	regsvr32.exe
PID 1952 wrote to memory of 1792	1952	taskeng.exe	regsvr32.exe
PID 1792 wrote to memory of 1992	1792	regsvr32.exe	regsvr32.exe
PID 1792 wrote to memory of 1992	1792	regsvr32.exe	regsvr32.exe
PID 1792 wrote to memory of 1992	1792	regsvr32.exe	regsvr32.exe
PID 1792 wrote to memory of 1992	1792	regsvr32.exe	regsvr32.exe
PID 1792 wrote to memory of 1992	1792	regsvr32.exe	regsvr32.exe
PID 1792 wrote to memory of 1992	1792	regsvr32.exe	regsvr32.exe
PID 1792 wrote to memory of 1992	1792	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e74103c86b4498e63869dd1f458c6bc737ca82be4fcf69c791e69829c4c3d35.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e74103c86b4498e63869dd1f458c6bc737ca82be4fcf69c791e69829c4c3d35.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn engkuozl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\8e74103c86b4498e63869dd1f458c6bc737ca82be4fcf69c791e69829c4c3d35.dll\"" /SC ONCE /Z /ST 14:11 /ET 14:23
4⤵
- Creates scheduled task(s)
PID:456

C:\Windows\system32\taskeng.exe
taskeng.exe {CF1CCFA3-2CC0-4615-89DB-03D191619835} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\8e74103c86b4498e63869dd1f458c6bc737ca82be4fcf69c791e69829c4c3d35.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\8e74103c86b4498e63869dd1f458c6bc737ca82be4fcf69c791e69829c4c3d35.dll"
3⤵
- Loads dropped DLL
PID:1992

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8e74103c86b4498e63869dd1f458c6bc737ca82be4fcf69c791e69829c4c3d35.dll
MD5
27ccfe8e92c58bf846021b519af5c850

SHA1
e26090cd980ceddfb73fb45102042b5d4eb4340d

SHA256
df8779e74826e315e5024eabfef209ec43129ab74946376ff2025eca14312596

SHA512
8a471a05fe7f9ffd80c0f236beef5d15c70f2c75b2153c7e3969fe866e3c2b50c64874d96702df75a90773b5df7ea90052623cbd6deae09c9fab52d1b6512ae6

Download Submit
\Users\Admin\AppData\Local\Temp\8e74103c86b4498e63869dd1f458c6bc737ca82be4fcf69c791e69829c4c3d35.dll
MD5
27ccfe8e92c58bf846021b519af5c850

SHA1
e26090cd980ceddfb73fb45102042b5d4eb4340d

SHA256
df8779e74826e315e5024eabfef209ec43129ab74946376ff2025eca14312596

SHA512
8a471a05fe7f9ffd80c0f236beef5d15c70f2c75b2153c7e3969fe866e3c2b50c64874d96702df75a90773b5df7ea90052623cbd6deae09c9fab52d1b6512ae6

Download Submit
memory/268-60-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/268-63-0x00000000744F1000-0x00000000744F3000-memory.dmp

Filesize
8KB

Download
memory/268-64-0x0000000000D00000-0x0000000000F81000-memory.dmp

Filesize
2.5MB

Download
memory/268-65-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1092-55-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/1092-57-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1092-56-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1092-58-0x0000000001C80000-0x0000000001E6A000-memory.dmp

Filesize
1.9MB

Download
memory/1092-59-0x0000000010000000-0x0000000010217000-memory.dmp

Filesize
2.1MB

Download
memory/1792-66-0x000007FEFB791000-0x000007FEFB793000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads