qakbot | 61321e38adbbaa1c29a6c19a17e3a6478887950fa4ec83be02da79bd08fd18e5

General

Target

61321e38adbbaa1c29a6c19a17e3a6478887950fa4ec83be02da79bd08fd18e5.dll
Size

2.1MB
MD5

7e9caf744df9eae973ff592e8e6aade1
SHA1

52d79b4c64caf74e5609010aa9bde289567afe08
SHA256

61321e38adbbaa1c29a6c19a17e3a6478887950fa4ec83be02da79bd08fd18e5
SHA512

68d053794b2bb6cc13fa20e1eb3cc30b8098a38fcce3773bd338c4bb39fe5dfaeba6fc0ac6980d306283d462628def43e0a057c3f29b2616ebee4c60810d27b1

Score

10^/10

qakbot abc107 1607078484 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.62

Botnet

abc107

Campaign

1607078484

C2

32.212.117.188:443

109.205.204.229:2222

72.36.59.46:2222

173.18.126.193:2222

96.225.88.23:443

89.137.211.239:443

110.142.205.182:443

82.76.47.211:443

193.83.25.177:995

67.40.253.209:995

73.244.83.199:443

2.90.186.243:995

189.252.62.238:995

141.237.135.194:443

82.78.70.128:443

185.125.151.172:443

79.117.239.22:2222

86.189.252.131:2222

83.114.243.80:2222

2.50.56.81:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1596 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

976 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1636 rundll32.exe
1636 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1636 rundll32.exe

pid	process
1596	regsvr32.exe

pid	process
976	schtasks.exe

pid	process
1636	rundll32.exe
1636	rundll32.exe

pid	process
1636	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 756 wrote to memory of 1636	756	rundll32.exe	rundll32.exe
PID 756 wrote to memory of 1636	756	rundll32.exe	rundll32.exe
PID 756 wrote to memory of 1636	756	rundll32.exe	rundll32.exe
PID 756 wrote to memory of 1636	756	rundll32.exe	rundll32.exe
PID 756 wrote to memory of 1636	756	rundll32.exe	rundll32.exe
PID 756 wrote to memory of 1636	756	rundll32.exe	rundll32.exe
PID 756 wrote to memory of 1636	756	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1624	1636	rundll32.exe	explorer.exe
PID 1636 wrote to memory of 1624	1636	rundll32.exe	explorer.exe
PID 1636 wrote to memory of 1624	1636	rundll32.exe	explorer.exe
PID 1636 wrote to memory of 1624	1636	rundll32.exe	explorer.exe
PID 1636 wrote to memory of 1624	1636	rundll32.exe	explorer.exe
PID 1636 wrote to memory of 1624	1636	rundll32.exe	explorer.exe
PID 1624 wrote to memory of 976	1624	explorer.exe	schtasks.exe
PID 1624 wrote to memory of 976	1624	explorer.exe	schtasks.exe
PID 1624 wrote to memory of 976	1624	explorer.exe	schtasks.exe
PID 1624 wrote to memory of 976	1624	explorer.exe	schtasks.exe
PID 1000 wrote to memory of 1584	1000	taskeng.exe	regsvr32.exe
PID 1000 wrote to memory of 1584	1000	taskeng.exe	regsvr32.exe
PID 1000 wrote to memory of 1584	1000	taskeng.exe	regsvr32.exe
PID 1000 wrote to memory of 1584	1000	taskeng.exe	regsvr32.exe
PID 1000 wrote to memory of 1584	1000	taskeng.exe	regsvr32.exe
PID 1584 wrote to memory of 1596	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 1596	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 1596	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 1596	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 1596	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 1596	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 1596	1584	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61321e38adbbaa1c29a6c19a17e3a6478887950fa4ec83be02da79bd08fd18e5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61321e38adbbaa1c29a6c19a17e3a6478887950fa4ec83be02da79bd08fd18e5.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn glulngnoj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\61321e38adbbaa1c29a6c19a17e3a6478887950fa4ec83be02da79bd08fd18e5.dll\"" /SC ONCE /Z /ST 15:34 /ET 15:46
4⤵
- Creates scheduled task(s)
PID:976

C:\Windows\system32\taskeng.exe
taskeng.exe {376DA6A8-A4EA-4827-880C-48EB7E73B743} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\61321e38adbbaa1c29a6c19a17e3a6478887950fa4ec83be02da79bd08fd18e5.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\61321e38adbbaa1c29a6c19a17e3a6478887950fa4ec83be02da79bd08fd18e5.dll"
3⤵
- Loads dropped DLL
PID:1596

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\61321e38adbbaa1c29a6c19a17e3a6478887950fa4ec83be02da79bd08fd18e5.dll
MD5
3c5ad43e25cac982915b77cb62741f5e

SHA1
18d2643017beeebf8538c529fde0c1d2c313865c

SHA256
3b4d2c39f41b1120250b4babcd09a3bcc4b581db3329f3fd4377b681e779e2f4

SHA512
d1d2343b59dc3c1cca385e8dc3618654190b70f94df8baa994f335bc6ef7c07edbf17059bab100a6449d1a3dcfd6a0f8f7dbfc7765e10ad2cc5794e60c95c00b

Download Submit
\Users\Admin\AppData\Local\Temp\61321e38adbbaa1c29a6c19a17e3a6478887950fa4ec83be02da79bd08fd18e5.dll
MD5
3c5ad43e25cac982915b77cb62741f5e

SHA1
18d2643017beeebf8538c529fde0c1d2c313865c

SHA256
3b4d2c39f41b1120250b4babcd09a3bcc4b581db3329f3fd4377b681e779e2f4

SHA512
d1d2343b59dc3c1cca385e8dc3618654190b70f94df8baa994f335bc6ef7c07edbf17059bab100a6449d1a3dcfd6a0f8f7dbfc7765e10ad2cc5794e60c95c00b

Download Submit
memory/1584-65-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

Filesize
8KB

Download
memory/1624-59-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/1624-62-0x0000000074661000-0x0000000074663000-memory.dmp

Filesize
8KB

Download
memory/1624-63-0x00000000004B0000-0x0000000000731000-memory.dmp

Filesize
2.5MB

Download
memory/1624-64-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1636-54-0x0000000075781000-0x0000000075783000-memory.dmp

Filesize
8KB

Download
memory/1636-55-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1636-56-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1636-57-0x0000000000A00000-0x0000000000BEA000-memory.dmp

Filesize
1.9MB

Download
memory/1636-58-0x0000000010000000-0x0000000010217000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads