qakbot | 3e2c5dad3b4046c102e478e1c80e640a386abbb1fd6e160cec69928a94fde907

General

Target

3e2c5dad3b4046c102e478e1c80e640a386abbb1fd6e160cec69928a94fde907.dll
Size

2.1MB
MD5

33911ae7c2c0c077d9980d65d109135c
SHA1

4717c2908716b4e0e3de049cc1e845a1101e9ae5
SHA256

3e2c5dad3b4046c102e478e1c80e640a386abbb1fd6e160cec69928a94fde907
SHA512

7bb34d073bdebef0fb04de1bdd059b42197664e4ae7d7f718a1a63f876d6a021ef6d2018dc66e920acd1248107bc902d86b8317113ebca919cf6d0846740d697

Score

10^/10

qakbot abc107 1607078484 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.62

Botnet

abc107

Campaign

1607078484

C2

32.212.117.188:443

109.205.204.229:2222

72.36.59.46:2222

173.18.126.193:2222

96.225.88.23:443

89.137.211.239:443

110.142.205.182:443

82.76.47.211:443

193.83.25.177:995

67.40.253.209:995

73.244.83.199:443

2.90.186.243:995

189.252.62.238:995

141.237.135.194:443

82.78.70.128:443

185.125.151.172:443

79.117.239.22:2222

86.189.252.131:2222

83.114.243.80:2222

2.50.56.81:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1052 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1512 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1836 rundll32.exe
1836 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1836 rundll32.exe

pid	process
1052	regsvr32.exe

pid	process
1512	schtasks.exe

pid	process
1836	rundll32.exe
1836	rundll32.exe

pid	process
1836	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 2020 wrote to memory of 1836	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1836	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1836	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1836	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1836	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1836	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1836	2020	rundll32.exe	rundll32.exe
PID 1836 wrote to memory of 588	1836	rundll32.exe	explorer.exe
PID 1836 wrote to memory of 588	1836	rundll32.exe	explorer.exe
PID 1836 wrote to memory of 588	1836	rundll32.exe	explorer.exe
PID 1836 wrote to memory of 588	1836	rundll32.exe	explorer.exe
PID 1836 wrote to memory of 588	1836	rundll32.exe	explorer.exe
PID 1836 wrote to memory of 588	1836	rundll32.exe	explorer.exe
PID 588 wrote to memory of 1512	588	explorer.exe	schtasks.exe
PID 588 wrote to memory of 1512	588	explorer.exe	schtasks.exe
PID 588 wrote to memory of 1512	588	explorer.exe	schtasks.exe
PID 588 wrote to memory of 1512	588	explorer.exe	schtasks.exe
PID 288 wrote to memory of 1696	288	taskeng.exe	regsvr32.exe
PID 288 wrote to memory of 1696	288	taskeng.exe	regsvr32.exe
PID 288 wrote to memory of 1696	288	taskeng.exe	regsvr32.exe
PID 288 wrote to memory of 1696	288	taskeng.exe	regsvr32.exe
PID 288 wrote to memory of 1696	288	taskeng.exe	regsvr32.exe
PID 1696 wrote to memory of 1052	1696	regsvr32.exe	regsvr32.exe
PID 1696 wrote to memory of 1052	1696	regsvr32.exe	regsvr32.exe
PID 1696 wrote to memory of 1052	1696	regsvr32.exe	regsvr32.exe
PID 1696 wrote to memory of 1052	1696	regsvr32.exe	regsvr32.exe
PID 1696 wrote to memory of 1052	1696	regsvr32.exe	regsvr32.exe
PID 1696 wrote to memory of 1052	1696	regsvr32.exe	regsvr32.exe
PID 1696 wrote to memory of 1052	1696	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e2c5dad3b4046c102e478e1c80e640a386abbb1fd6e160cec69928a94fde907.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e2c5dad3b4046c102e478e1c80e640a386abbb1fd6e160cec69928a94fde907.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:588

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ruwvzixf /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\3e2c5dad3b4046c102e478e1c80e640a386abbb1fd6e160cec69928a94fde907.dll\"" /SC ONCE /Z /ST 15:36 /ET 15:48
4⤵
- Creates scheduled task(s)
PID:1512

C:\Windows\system32\taskeng.exe
taskeng.exe {3AAE3490-4EB3-45C7-9568-9EB4ED494A1D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:288

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\3e2c5dad3b4046c102e478e1c80e640a386abbb1fd6e160cec69928a94fde907.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\3e2c5dad3b4046c102e478e1c80e640a386abbb1fd6e160cec69928a94fde907.dll"
3⤵
- Loads dropped DLL
PID:1052

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3e2c5dad3b4046c102e478e1c80e640a386abbb1fd6e160cec69928a94fde907.dll
MD5
96257bb61c61e13c37badfde1fc9aa6f

SHA1
5c50f297a4a694087b806be96b69703366276d02

SHA256
aa86c7ab1857dd15a7c31f719a0f0a74beae073d367e2a786f76cc71653bb849

SHA512
10bb3cd085c18122cec16bb04f0aecf8823b03bc2a9052f47e816e805e270e75697a49196f1de4414a962963becfb44f2cc7cb17a2d049b77e794aa89fbb6126

Download Submit
\Users\Admin\AppData\Local\Temp\3e2c5dad3b4046c102e478e1c80e640a386abbb1fd6e160cec69928a94fde907.dll
MD5
96257bb61c61e13c37badfde1fc9aa6f

SHA1
5c50f297a4a694087b806be96b69703366276d02

SHA256
aa86c7ab1857dd15a7c31f719a0f0a74beae073d367e2a786f76cc71653bb849

SHA512
10bb3cd085c18122cec16bb04f0aecf8823b03bc2a9052f47e816e805e270e75697a49196f1de4414a962963becfb44f2cc7cb17a2d049b77e794aa89fbb6126

Download Submit
memory/588-59-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/588-62-0x0000000074C81000-0x0000000074C83000-memory.dmp

Filesize
8KB

Download
memory/588-64-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/588-63-0x00000000006C0000-0x0000000000941000-memory.dmp

Filesize
2.5MB

Download
memory/1696-65-0x000007FEFBF51000-0x000007FEFBF53000-memory.dmp

Filesize
8KB

Download
memory/1836-54-0x0000000075751000-0x0000000075753000-memory.dmp

Filesize
8KB

Download
memory/1836-55-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1836-56-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1836-57-0x0000000000960000-0x0000000000B4A000-memory.dmp

Filesize
1.9MB

Download
memory/1836-58-0x0000000010000000-0x0000000010217000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads