qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
4294191s
max time network
129s
platform
windows7_x64
resource
win7-20220311-en
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll
Size

312KB
MD5

3013c608c43d531a635b9ea4ecfe4449
SHA1

e8236d0921a17c4b3a8c4f000084737b3219e633
SHA256

51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77
SHA512

4b29795250ff7d15cabbb39e00217bab706fb29e4bdbdf2650e8f955d987ee0515d53f751850aae127a1e8a59fe8d38205950e5a2ab0ab9b6c195817c5ed8377

Score

10^/10

qakbot tr 1632152742 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.318

Botnet

Campaign

1632152742

45.46.53.140:2222

144.139.47.206:443

189.210.115.207:443

120.150.218.241:995

47.22.148.6:443

140.82.49.12:443

24.139.72.117:443

24.229.150.54:995

24.55.112.61:443

136.232.34.70:443

95.77.223.148:443

173.21.10.71:2222

76.25.142.196:443

96.37.113.36:993

71.74.12.34:443

73.151.236.31:443

67.165.206.193:993

109.12.111.14:443

68.204.7.158:443

105.198.236.99:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1828 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

760 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1168 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1168 rundll32.exe

pid	process
1828	regsvr32.exe

pid	process
760	schtasks.exe

pid	process
1168	rundll32.exe

pid	process
1168	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1328 wrote to memory of 1168	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1168	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1168	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1168	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1168	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1168	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1168	1328	rundll32.exe	rundll32.exe
PID 1168 wrote to memory of 672	1168	rundll32.exe	explorer.exe
PID 1168 wrote to memory of 672	1168	rundll32.exe	explorer.exe
PID 1168 wrote to memory of 672	1168	rundll32.exe	explorer.exe
PID 1168 wrote to memory of 672	1168	rundll32.exe	explorer.exe
PID 1168 wrote to memory of 672	1168	rundll32.exe	explorer.exe
PID 1168 wrote to memory of 672	1168	rundll32.exe	explorer.exe
PID 672 wrote to memory of 760	672	explorer.exe	schtasks.exe
PID 672 wrote to memory of 760	672	explorer.exe	schtasks.exe
PID 672 wrote to memory of 760	672	explorer.exe	schtasks.exe
PID 672 wrote to memory of 760	672	explorer.exe	schtasks.exe
PID 1580 wrote to memory of 1848	1580	taskeng.exe	regsvr32.exe
PID 1580 wrote to memory of 1848	1580	taskeng.exe	regsvr32.exe
PID 1580 wrote to memory of 1848	1580	taskeng.exe	regsvr32.exe
PID 1580 wrote to memory of 1848	1580	taskeng.exe	regsvr32.exe
PID 1580 wrote to memory of 1848	1580	taskeng.exe	regsvr32.exe
PID 1848 wrote to memory of 1828	1848	regsvr32.exe	regsvr32.exe
PID 1848 wrote to memory of 1828	1848	regsvr32.exe	regsvr32.exe
PID 1848 wrote to memory of 1828	1848	regsvr32.exe	regsvr32.exe
PID 1848 wrote to memory of 1828	1848	regsvr32.exe	regsvr32.exe
PID 1848 wrote to memory of 1828	1848	regsvr32.exe	regsvr32.exe
PID 1848 wrote to memory of 1828	1848	regsvr32.exe	regsvr32.exe
PID 1848 wrote to memory of 1828	1848	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn klqktytxj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll\"" /SC ONCE /Z /ST 11:24 /ET 11:36
4⤵
- Creates scheduled task(s)
PID:760

C:\Windows\system32\taskeng.exe
taskeng.exe {52A6D6CE-1BD8-4C75-9777-55617FD7E264} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll"
3⤵
- Loads dropped DLL
PID:1828

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll
MD5
0320f0feb2c89ea3d639638bdc8ad069

SHA1
994d10af40652e172b1b3af45e4b7ec7f0f2d2fc

SHA256
da82e242be6259b5953fff64bedd9af8d36c75aab904b05636093dc0ed5c022e

SHA512
5dd80bd86db3bfa0a14fb38610d56c9e60f2794009d79d3485f8511fa948c44b5cdc6bbaf389d1b81f9a9d804c0eaf0b400177752f688dddbeb63e0177283a91

Download Submit
\Users\Admin\AppData\Local\Temp\51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll
MD5
0320f0feb2c89ea3d639638bdc8ad069

SHA1
994d10af40652e172b1b3af45e4b7ec7f0f2d2fc

SHA256
da82e242be6259b5953fff64bedd9af8d36c75aab904b05636093dc0ed5c022e

SHA512
5dd80bd86db3bfa0a14fb38610d56c9e60f2794009d79d3485f8511fa948c44b5cdc6bbaf389d1b81f9a9d804c0eaf0b400177752f688dddbeb63e0177283a91

Download Submit
memory/672-55-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/672-59-0x0000000074B91000-0x0000000074B93000-memory.dmp

Filesize
8KB

Download
memory/672-61-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1168-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/1168-58-0x0000000002050000-0x0000000006084000-memory.dmp

Filesize
64.2MB

Download
memory/1168-60-0x0000000010000000-0x000000001404B000-memory.dmp

Filesize
64.3MB

Download
memory/1848-62-0x000007FEFBE31000-0x000007FEFBE33000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads