qakbot | cec58cc48e92fc5f6c0b8d23307b7fa2e81b160f6d8edc881d64de312d48d039

General

Target

cec58cc48e92fc5f6c0b8d23307b7fa2e81b160f6d8edc881d64de312d48d039.dll
Size

2.1MB
MD5

3157a42f8dc02e6d97b5d46a17effa49
SHA1

0f554d945c133f3148b4aa8420376d42404bcc9c
SHA256

cec58cc48e92fc5f6c0b8d23307b7fa2e81b160f6d8edc881d64de312d48d039
SHA512

1cba54754871841c5b2973ed68f39c62dd5a803edc99f4ecf3c13ed6982647a48fec0a019fcb7f1e34a26636a541283f3284475f90fa4f841440883263167bec

Score

10^/10

qakbot abc107 1607078484 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.62

Botnet

abc107

Campaign

1607078484

C2

32.212.117.188:443

109.205.204.229:2222

72.36.59.46:2222

173.18.126.193:2222

96.225.88.23:443

89.137.211.239:443

110.142.205.182:443

82.76.47.211:443

193.83.25.177:995

67.40.253.209:995

73.244.83.199:443

2.90.186.243:995

189.252.62.238:995

141.237.135.194:443

82.78.70.128:443

185.125.151.172:443

79.117.239.22:2222

86.189.252.131:2222

83.114.243.80:2222

2.50.56.81:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1620 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1204 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

980 rundll32.exe
980 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

980 rundll32.exe

pid	process
1620	regsvr32.exe

pid	process
1204	schtasks.exe

pid	process
980	rundll32.exe
980	rundll32.exe

pid	process
980	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1092 wrote to memory of 980	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 980	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 980	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 980	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 980	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 980	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 980	1092	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 680	980	rundll32.exe	explorer.exe
PID 980 wrote to memory of 680	980	rundll32.exe	explorer.exe
PID 980 wrote to memory of 680	980	rundll32.exe	explorer.exe
PID 980 wrote to memory of 680	980	rundll32.exe	explorer.exe
PID 980 wrote to memory of 680	980	rundll32.exe	explorer.exe
PID 980 wrote to memory of 680	980	rundll32.exe	explorer.exe
PID 680 wrote to memory of 1204	680	explorer.exe	schtasks.exe
PID 680 wrote to memory of 1204	680	explorer.exe	schtasks.exe
PID 680 wrote to memory of 1204	680	explorer.exe	schtasks.exe
PID 680 wrote to memory of 1204	680	explorer.exe	schtasks.exe
PID 1368 wrote to memory of 1396	1368	taskeng.exe	regsvr32.exe
PID 1368 wrote to memory of 1396	1368	taskeng.exe	regsvr32.exe
PID 1368 wrote to memory of 1396	1368	taskeng.exe	regsvr32.exe
PID 1368 wrote to memory of 1396	1368	taskeng.exe	regsvr32.exe
PID 1368 wrote to memory of 1396	1368	taskeng.exe	regsvr32.exe
PID 1396 wrote to memory of 1620	1396	regsvr32.exe	regsvr32.exe
PID 1396 wrote to memory of 1620	1396	regsvr32.exe	regsvr32.exe
PID 1396 wrote to memory of 1620	1396	regsvr32.exe	regsvr32.exe
PID 1396 wrote to memory of 1620	1396	regsvr32.exe	regsvr32.exe
PID 1396 wrote to memory of 1620	1396	regsvr32.exe	regsvr32.exe
PID 1396 wrote to memory of 1620	1396	regsvr32.exe	regsvr32.exe
PID 1396 wrote to memory of 1620	1396	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cec58cc48e92fc5f6c0b8d23307b7fa2e81b160f6d8edc881d64de312d48d039.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cec58cc48e92fc5f6c0b8d23307b7fa2e81b160f6d8edc881d64de312d48d039.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:680
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dcmifwhnqv /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\cec58cc48e92fc5f6c0b8d23307b7fa2e81b160f6d8edc881d64de312d48d039.dll\"" /SC ONCE /Z /ST 12:43 /ET 12:55
      4⤵
      Creates scheduled task(s)
      PID:1204

C:\Windows\system32\taskeng.exe
taskeng.exe {B0729ADF-7D30-4461-B9B7-4AA825087EE7} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\cec58cc48e92fc5f6c0b8d23307b7fa2e81b160f6d8edc881d64de312d48d039.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\cec58cc48e92fc5f6c0b8d23307b7fa2e81b160f6d8edc881d64de312d48d039.dll"
    3⤵
    - Loads dropped DLL
    PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cec58cc48e92fc5f6c0b8d23307b7fa2e81b160f6d8edc881d64de312d48d039.dll

MD5
7a8e6beaec822a2796ac4a99444a8bee

SHA1
38eba8935352367a81da49311420cdcc0ebc2a59

SHA256
3ebe9df08b8faed1112a22e7972c7a158281dd02ecb15d85bd2fa5eeb64b62b5

SHA512
1b7561359cea49c2ca17e45896f446ee05540c4f8c709a585a94cd188b77167c9edce631de8dd9c45f34dde3362480410e7eb9e18ef142cd5b1876402bbaaf61

Download Submit
\Users\Admin\AppData\Local\Temp\cec58cc48e92fc5f6c0b8d23307b7fa2e81b160f6d8edc881d64de312d48d039.dll

MD5
7a8e6beaec822a2796ac4a99444a8bee

SHA1
38eba8935352367a81da49311420cdcc0ebc2a59

SHA256
3ebe9df08b8faed1112a22e7972c7a158281dd02ecb15d85bd2fa5eeb64b62b5

SHA512
1b7561359cea49c2ca17e45896f446ee05540c4f8c709a585a94cd188b77167c9edce631de8dd9c45f34dde3362480410e7eb9e18ef142cd5b1876402bbaaf61

Download Submit
memory/680-59-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/680-62-0x00000000750E1000-0x00000000750E3000-memory.dmp

Filesize
8KB

Download
memory/680-63-0x0000000000F10000-0x0000000001191000-memory.dmp

Filesize
2.5MB

Download
memory/680-64-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/980-54-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/980-56-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/980-55-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/980-57-0x00000000020F0000-0x00000000022DA000-memory.dmp

Filesize
1.9MB

Download
memory/980-58-0x0000000010000000-0x0000000010217000-memory.dmp

Filesize
2.1MB

Download
memory/1396-65-0x000007FEFC381000-0x000007FEFC383000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads