qakbot | 629f239e44ce7427a340ebd95d50c96659ead929ce1b3277d79bc512700bb426

General

Target

629f239e44ce7427a340ebd95d50c96659ead929ce1b3277d79bc512700bb426.dll
Size

2.5MB
MD5

0295e651ff026e3731f0a65ed123923a
SHA1

1f1dbef6cf7dc07068b0f5283fc387b431b77378
SHA256

629f239e44ce7427a340ebd95d50c96659ead929ce1b3277d79bc512700bb426
SHA512

b03f79d89a55baf59138621e4a3a3c676bbacbfb89cbc058324ea333f4ac93595ce451726121d1e6e6bebcfc6fa07d7190434f37820eb1a7903a20617bf0d534

Score

10^/10

qakbot abc117 1608747966 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.157

Botnet

abc117

Campaign

1608747966

C2

67.6.54.180:443

187.250.170.34:995

67.141.11.98:443

109.154.79.222:2222

2.88.184.160:443

85.52.72.32:2222

86.98.21.234:443

73.166.10.38:50003

90.61.30.155:2222

71.182.142.63:443

178.223.22.192:995

184.189.122.72:443

181.39.236.199:443

72.240.200.181:2222

154.238.45.174:995

47.22.148.6:443

2.51.251.47:995

199.19.117.131:443

200.76.215.87:443

37.104.39.32:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

980 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

976 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

536 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

536 rundll32.exe

pid	process
980	regsvr32.exe

pid	process
976	schtasks.exe

pid	process
536	rundll32.exe

pid	process
536	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1752 wrote to memory of 536	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 536	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 536	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 536	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 536	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 536	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 536	1752	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 576	536	rundll32.exe	explorer.exe
PID 536 wrote to memory of 576	536	rundll32.exe	explorer.exe
PID 536 wrote to memory of 576	536	rundll32.exe	explorer.exe
PID 536 wrote to memory of 576	536	rundll32.exe	explorer.exe
PID 536 wrote to memory of 576	536	rundll32.exe	explorer.exe
PID 536 wrote to memory of 576	536	rundll32.exe	explorer.exe
PID 576 wrote to memory of 976	576	explorer.exe	schtasks.exe
PID 576 wrote to memory of 976	576	explorer.exe	schtasks.exe
PID 576 wrote to memory of 976	576	explorer.exe	schtasks.exe
PID 576 wrote to memory of 976	576	explorer.exe	schtasks.exe
PID 1292 wrote to memory of 1000	1292	taskeng.exe	regsvr32.exe
PID 1292 wrote to memory of 1000	1292	taskeng.exe	regsvr32.exe
PID 1292 wrote to memory of 1000	1292	taskeng.exe	regsvr32.exe
PID 1292 wrote to memory of 1000	1292	taskeng.exe	regsvr32.exe
PID 1292 wrote to memory of 1000	1292	taskeng.exe	regsvr32.exe
PID 1000 wrote to memory of 980	1000	regsvr32.exe	regsvr32.exe
PID 1000 wrote to memory of 980	1000	regsvr32.exe	regsvr32.exe
PID 1000 wrote to memory of 980	1000	regsvr32.exe	regsvr32.exe
PID 1000 wrote to memory of 980	1000	regsvr32.exe	regsvr32.exe
PID 1000 wrote to memory of 980	1000	regsvr32.exe	regsvr32.exe
PID 1000 wrote to memory of 980	1000	regsvr32.exe	regsvr32.exe
PID 1000 wrote to memory of 980	1000	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\629f239e44ce7427a340ebd95d50c96659ead929ce1b3277d79bc512700bb426.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\629f239e44ce7427a340ebd95d50c96659ead929ce1b3277d79bc512700bb426.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:536

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cuqzqizdhp /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\629f239e44ce7427a340ebd95d50c96659ead929ce1b3277d79bc512700bb426.dll\"" /SC ONCE /Z /ST 10:14 /ET 10:26
4⤵
- Creates scheduled task(s)
PID:976

C:\Windows\system32\taskeng.exe
taskeng.exe {47F8E885-5BA1-4FE0-B418-5E767DC89475} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\629f239e44ce7427a340ebd95d50c96659ead929ce1b3277d79bc512700bb426.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\629f239e44ce7427a340ebd95d50c96659ead929ce1b3277d79bc512700bb426.dll"
3⤵
- Loads dropped DLL
PID:980

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\629f239e44ce7427a340ebd95d50c96659ead929ce1b3277d79bc512700bb426.dll
MD5
ccb767f4abd1628e82306428c74143ad

SHA1
cae680a749bd48d63635e15303462c097d717d8f

SHA256
4b13078ca873efd411de5ddb2e408f7371d79151336c6ca4f2f8154bf8e9cf8c

SHA512
df185f77f0d6eb29c538a98a0b0565b9454b37f4e0f199439978227da066d7f5b7dc496200adc7001b4fe7f5ee4ac39f42b650d150f0a2157e67d50639e0a576

Download Submit
\Users\Admin\AppData\Local\Temp\629f239e44ce7427a340ebd95d50c96659ead929ce1b3277d79bc512700bb426.dll
MD5
ccb767f4abd1628e82306428c74143ad

SHA1
cae680a749bd48d63635e15303462c097d717d8f

SHA256
4b13078ca873efd411de5ddb2e408f7371d79151336c6ca4f2f8154bf8e9cf8c

SHA512
df185f77f0d6eb29c538a98a0b0565b9454b37f4e0f199439978227da066d7f5b7dc496200adc7001b4fe7f5ee4ac39f42b650d150f0a2157e67d50639e0a576

Download Submit
memory/536-54-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Filesize
8KB

Download
memory/536-55-0x0000000002080000-0x000000000226A000-memory.dmp

Filesize
1.9MB

Download
memory/536-56-0x0000000010000000-0x000000001028A000-memory.dmp

Filesize
2.5MB

Download
memory/576-57-0x0000000000100000-0x0000000000102000-memory.dmp

Filesize
8KB

Download
memory/576-60-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/576-61-0x0000000000460000-0x00000000006E1000-memory.dmp

Filesize
2.5MB

Download
memory/576-62-0x0000000000080000-0x00000000000B4000-memory.dmp

Filesize
208KB

Download
memory/1000-63-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads