qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
160s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll
Size

312KB
MD5

3013c608c43d531a635b9ea4ecfe4449
SHA1

e8236d0921a17c4b3a8c4f000084737b3219e633
SHA256

51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77
SHA512

4b29795250ff7d15cabbb39e00217bab706fb29e4bdbdf2650e8f955d987ee0515d53f751850aae127a1e8a59fe8d38205950e5a2ab0ab9b6c195817c5ed8377

Score

10^/10

qakbot tr 1632152742 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.318

Botnet

Campaign

1632152742

45.46.53.140:2222

144.139.47.206:443

189.210.115.207:443

120.150.218.241:995

47.22.148.6:443

140.82.49.12:443

24.139.72.117:443

24.229.150.54:995

24.55.112.61:443

136.232.34.70:443

95.77.223.148:443

173.21.10.71:2222

76.25.142.196:443

96.37.113.36:993

71.74.12.34:443

73.151.236.31:443

67.165.206.193:993

109.12.111.14:443

68.204.7.158:443

105.198.236.99:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1436 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4748 1436 WerFault.exe regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2484 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1512 rundll32.exe
1512 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1512 rundll32.exe

pid	process
1436	regsvr32.exe

pid	pid_target	process	target process
4748	1436	WerFault.exe	regsvr32.exe

pid	process
2484	schtasks.exe

pid	process
1512	rundll32.exe
1512	rundll32.exe

pid	process
1512	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 4976 wrote to memory of 1512	4976	rundll32.exe	rundll32.exe
PID 4976 wrote to memory of 1512	4976	rundll32.exe	rundll32.exe
PID 4976 wrote to memory of 1512	4976	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1756	1512	rundll32.exe	explorer.exe
PID 1512 wrote to memory of 1756	1512	rundll32.exe	explorer.exe
PID 1512 wrote to memory of 1756	1512	rundll32.exe	explorer.exe
PID 1512 wrote to memory of 1756	1512	rundll32.exe	explorer.exe
PID 1512 wrote to memory of 1756	1512	rundll32.exe	explorer.exe
PID 1756 wrote to memory of 2484	1756	explorer.exe	schtasks.exe
PID 1756 wrote to memory of 2484	1756	explorer.exe	schtasks.exe
PID 1756 wrote to memory of 2484	1756	explorer.exe	schtasks.exe
PID 4452 wrote to memory of 1436	4452	regsvr32.exe	regsvr32.exe
PID 4452 wrote to memory of 1436	4452	regsvr32.exe	regsvr32.exe
PID 4452 wrote to memory of 1436	4452	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn epylvhf /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll\"" /SC ONCE /Z /ST 12:24 /ET 12:36
4⤵
- Creates scheduled task(s)
PID:2484

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4452

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll"
2⤵
- Loads dropped DLL
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 584
3⤵
- Program crash
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1436 -ip 1436
1⤵
PID:4592

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll
MD5
6cdae36428b6bd7cd42a3fbf3c6d261c

SHA1
7636388e5d5c6f2eb07712c1a325159f25cfae38

SHA256
639f07af0fdf17515e628a7116039373c2fa75496cbf5d996a25ba98e8e65232

SHA512
edf6cd167e825f48d9cc006f0fc089b401648cf860a0c7d4b9b8873e72a0b6d370a678a627a1d8d7f293e1c33eec71a76d8d5caf4ac467d0406b5f32036ae3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll
MD5
6cdae36428b6bd7cd42a3fbf3c6d261c

SHA1
7636388e5d5c6f2eb07712c1a325159f25cfae38

SHA256
639f07af0fdf17515e628a7116039373c2fa75496cbf5d996a25ba98e8e65232

SHA512
edf6cd167e825f48d9cc006f0fc089b401648cf860a0c7d4b9b8873e72a0b6d370a678a627a1d8d7f293e1c33eec71a76d8d5caf4ac467d0406b5f32036ae3e9

Download Submit
memory/1512-134-0x00000000024D0000-0x0000000006504000-memory.dmp

Filesize
64.2MB

Download
memory/1512-135-0x0000000010000000-0x000000001404B000-memory.dmp

Filesize
64.3MB

Download
memory/1756-136-0x0000000000D10000-0x0000000000D31000-memory.dmp

Filesize
132KB

Download