qakbot | 80da9bd012cc3501839c543d6876303726f3f29bb52c472d3dc0b9665f17f89e

General

Target

80da9bd012cc3501839c543d6876303726f3f29bb52c472d3dc0b9665f17f89e.dll
Size

2.2MB
MD5

0c3148a1a93f06a54b7c225de13825c2
SHA1

b89925b4e8342ab1fb6f7449923f964788b8eedb
SHA256

80da9bd012cc3501839c543d6876303726f3f29bb52c472d3dc0b9665f17f89e
SHA512

36a302e661e0c92b50a01964de0c5315b7a9735f6d06e9d7d0952e9c9968ef7fe5e6d4e1df2b21aed3339583d73fdf288f5396da41feab312a3269ccc3860555

Score

10^/10

qakbot abc114 1608129413 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

abc114

Campaign

1608129413

C2

86.127.22.190:443

35.139.242.207:443

108.190.194.146:2222

187.213.199.54:443

68.83.89.188:443

41.233.152.232:993

196.151.252.84:443

181.208.249.141:443

172.87.134.226:443

96.27.47.70:2222

83.110.109.78:2222

93.86.1.159:995

217.162.149.212:443

80.11.210.247:443

72.252.201.69:443

185.163.221.77:2222

189.62.175.92:22

95.76.27.6:443

45.77.115.208:443

187.213.82.104:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Qakbot 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1340-62-0x00000000000C0000-0x00000000000F5000-memory.dmp	Qakbot

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1924 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1412 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

580 rundll32.exe
580 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

580 rundll32.exe

pid	process
1924	regsvr32.exe

pid	process
1412	schtasks.exe

pid	process
580	rundll32.exe
580	rundll32.exe

pid	process
580	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 368 wrote to memory of 580	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 580	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 580	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 580	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 580	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 580	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 580	368	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 1340	580	rundll32.exe	explorer.exe
PID 580 wrote to memory of 1340	580	rundll32.exe	explorer.exe
PID 580 wrote to memory of 1340	580	rundll32.exe	explorer.exe
PID 580 wrote to memory of 1340	580	rundll32.exe	explorer.exe
PID 580 wrote to memory of 1340	580	rundll32.exe	explorer.exe
PID 580 wrote to memory of 1340	580	rundll32.exe	explorer.exe
PID 1340 wrote to memory of 1412	1340	explorer.exe	schtasks.exe
PID 1340 wrote to memory of 1412	1340	explorer.exe	schtasks.exe
PID 1340 wrote to memory of 1412	1340	explorer.exe	schtasks.exe
PID 1340 wrote to memory of 1412	1340	explorer.exe	schtasks.exe
PID 988 wrote to memory of 1560	988	taskeng.exe	regsvr32.exe
PID 988 wrote to memory of 1560	988	taskeng.exe	regsvr32.exe
PID 988 wrote to memory of 1560	988	taskeng.exe	regsvr32.exe
PID 988 wrote to memory of 1560	988	taskeng.exe	regsvr32.exe
PID 988 wrote to memory of 1560	988	taskeng.exe	regsvr32.exe
PID 1560 wrote to memory of 1924	1560	regsvr32.exe	regsvr32.exe
PID 1560 wrote to memory of 1924	1560	regsvr32.exe	regsvr32.exe
PID 1560 wrote to memory of 1924	1560	regsvr32.exe	regsvr32.exe
PID 1560 wrote to memory of 1924	1560	regsvr32.exe	regsvr32.exe
PID 1560 wrote to memory of 1924	1560	regsvr32.exe	regsvr32.exe
PID 1560 wrote to memory of 1924	1560	regsvr32.exe	regsvr32.exe
PID 1560 wrote to memory of 1924	1560	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80da9bd012cc3501839c543d6876303726f3f29bb52c472d3dc0b9665f17f89e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:368

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80da9bd012cc3501839c543d6876303726f3f29bb52c472d3dc0b9665f17f89e.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fqpjxwlw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\80da9bd012cc3501839c543d6876303726f3f29bb52c472d3dc0b9665f17f89e.dll\"" /SC ONCE /Z /ST 18:03 /ET 18:15
4⤵
- Creates scheduled task(s)
PID:1412

C:\Windows\system32\taskeng.exe
taskeng.exe {FC833A8C-BB22-47A7-9BA0-65D176B74B54} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:988

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\80da9bd012cc3501839c543d6876303726f3f29bb52c472d3dc0b9665f17f89e.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\80da9bd012cc3501839c543d6876303726f3f29bb52c472d3dc0b9665f17f89e.dll"
3⤵
- Loads dropped DLL
PID:1924

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\80da9bd012cc3501839c543d6876303726f3f29bb52c472d3dc0b9665f17f89e.dll
MD5
804dbf81697a696d06f43631ba3d2c52

SHA1
82761759880fdaec5e9eea2a10b485937dcb8f11

SHA256
9f5d943b5619aef3d38385960b7a207d81f521daeab6ef4a7edfaf42dbb50d4f

SHA512
164ee601f2a4a5d1868401c698080949aaa6f3e759ab8348088ec2ad83d78799ebb51dd69bb3c351be5456ccefbb9b6dc4f2c8b3f6bf1ec8af3389d9ed750209

Download Submit
\Users\Admin\AppData\Local\Temp\80da9bd012cc3501839c543d6876303726f3f29bb52c472d3dc0b9665f17f89e.dll
MD5
804dbf81697a696d06f43631ba3d2c52

SHA1
82761759880fdaec5e9eea2a10b485937dcb8f11

SHA256
9f5d943b5619aef3d38385960b7a207d81f521daeab6ef4a7edfaf42dbb50d4f

SHA512
164ee601f2a4a5d1868401c698080949aaa6f3e759ab8348088ec2ad83d78799ebb51dd69bb3c351be5456ccefbb9b6dc4f2c8b3f6bf1ec8af3389d9ed750209

Download Submit
memory/580-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/580-55-0x00000000022E0000-0x00000000024CA000-memory.dmp

Filesize
1.9MB

Download
memory/580-56-0x0000000010000000-0x000000001023C000-memory.dmp

Filesize
2.2MB

Download
memory/1340-57-0x0000000000100000-0x0000000000102000-memory.dmp

Filesize
8KB

Download
memory/1340-60-0x0000000075251000-0x0000000075253000-memory.dmp

Filesize
8KB

Download
memory/1340-61-0x0000000000AF0000-0x0000000000D71000-memory.dmp

Filesize
2.5MB

Download
memory/1340-62-0x00000000000C0000-0x00000000000F5000-memory.dmp

Filesize
212KB

Download
memory/1560-63-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads