qakbot | fc747fd7a692f1e158278aed49dad6111ea87f141e9d900c8f027fbd7ca6f109

General

Target

fc747fd7a692f1e158278aed49dad6111ea87f141e9d900c8f027fbd7ca6f109.dll
Size

2.4MB
MD5

76442c33a207e181eabf4727e7f358bf
SHA1

d32a2d1d407c051a8e150aa1e93b30731a7681e9
SHA256

fc747fd7a692f1e158278aed49dad6111ea87f141e9d900c8f027fbd7ca6f109
SHA512

2de0b4f54b4b97005907cfdc5bdd1d8c1a400bb1187f3f2bfc199efa0c555348ed8a3eb8c6b69eed5742b55c1209a2fd1d350f6e2685672ee93a24c74194300a

Score

10^/10

qakbot abc117 1608719407 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.157

Botnet

abc117

Campaign

1608719407

C2

41.39.134.183:443

113.193.187.2:995

90.188.91.57:995

176.181.247.197:443

78.191.87.198:20

83.110.241.182:443

93.149.167.254:2222

76.111.128.194:443

32.212.117.188:443

72.36.59.46:2222

68.186.192.69:443

94.98.248.152:443

105.226.38.36:443

92.154.83.96:2222

37.210.255.225:995

74.195.52.3:443

73.166.10.38:443

95.77.223.148:443

80.227.5.70:443

91.104.104.63:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4144 schtasks.exe

pid	process
4144	schtasks.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000004099fae26abc69ab510bd90df180594fbe203fe31d798dec26ccd0241e705a19000000000e80000000020000200000003ca9a6b5086bd10abd54d285f5b9b1cb896abbe1e7f67af12a775013e96fb096100d0000fadd40fab39bd10ba2a812c6fbd077fe0bd2d12e5d00c562b16d8bb085249d5f5bc59f40f559780ba2a7c3a1b97f74c75ef19c2f8dc26472884a26c1647681b64c0d1a41874ef2163c6900b965308fc9efb461994095dcac37c6111c90c1b38684bfae1e75eb95a43b0ff3945f49f11424d32bb9174ada8c5d0ffcc6ef9aed973524b1f1d241c9e2a67d4580a1e332a41ebb705b584a0531c56fc41d5b1176ec4ff8f865538328425fbb6433331d21062c5cc15d98b2539ffbc1af4e645c7f11308d48f45f67e5beeaea74715481910524f3d40dcc9ba4c5416f0e2489b7db9f824d38adaea5f1276fec32beab32be5d59a795deda8324826b400cc2b9970c5342b086cf83cfe92f00c6f14fa6db9e5c00bb55438486fd583225de6a2e04983dc0061320312ca686b798a83a170089a71e5371c6fcc1191c29b5b21f2682aadfacbf1cb83a61dd7c2ad39dc1069863514eb300a1d3ff19cb2f731c11b171020c901a61a4b2d5d587239e53d65a2160a3668d7bb4b36fb5180d1e1eb7475f9e9893774f5a2b00a94be83d58eea8f16c6a18c95a0886515d981b0ffb2df164cbd95a094b7030bcb89fcb44cdeedef3bedfb8b0e1300553140dd7fe895d7eb176f19ebe4f5f518585effa583fed8ed5b1ba7ff1b764ddd047b308434e3290fdbada2fcad121ee4e4c6de58e068f859699094957d877a2bece0558008028f9f1ecff1e7cd3e26118d8fb0b926ba118dfcfa460617645616c45d97b3adaf80713066cc1c981353e825eb500f66db088c08a5e869b7b125d03a7b689fa4399d570aef30577cc95424afcd42f4041f8a66ff8ac5f224e96c7d92965b561f5f6844694dcd955293c50c2ff4f7104c5ddb72edb243625d3566444756877356eb83ba3b83afb1b9de710bf4c8875aea028a9a767c8a2a47e8e3f772def38aecf9830f72b6c13b246eabbde3d1132a65c8629e69ca7355954d92796f03cdb10ebaaa7de494d8b7f7dc19d0bcf262ef4640c3f2a0cfd87a63f250f667bc4aea08229b691a25c1ae8ce224bc870fef0fa4f67d04f8165f22277a0522931a6ef5bc45cb54d6cdad8daa7dba6fd772fe5978dc238974ce8087feb6217f936ceab6e59f193c9e519a8bd3a817f8454f694e4a2cda238e95322a6ce8ef2fea3e2f7e4333fd30a67404f4bb5a71384302f68e0eb1e9ca6c5269b97f14830c4aa6a123f11cf11fa4b981e64795826567aab7654ad499914d3fbe9d14e71c1f6b8529f2148b155b59ae5799c0a507982a5949bf0d837b630a154a8cc09a321cba447cec83a5c72de7f2b5c629bffcd02869306fb0202f3f49aab3bb8f02f4c500c229bf6782f5a3acece824821e69edf95d71814a73021558b834d59b180a0d89d5a49096bd9a249d2657fc65faca66e18dee0bc89e441f2c30add95b9840ca05c3c404c1d496c1c19cb1a94660256c9a4fa4118ff32b92be8b05e8236d211ffdc40d2d58f81217a00b3466cf0ef5bc6c3fbcee7744cf718ebaab0d7bf154abdbaffc913cbd2cdb8e531dfb87fdef39f096d01b37d66062d06317b0db0abe8d4488a382ec562604919e28cd7f514a23f8cf3505669e4e7bb0a77899325090adeb39dac0228a755879634bb4d6981ab3bd27fe440b2ec75fea1896dbe4a882b3dc186e5918861a4853a9fb762ce877fa707605228293b3bb4b1cb65fa345ab816e084300c3b3a57ad0452259528433162f572b11b8c499d56445f2123039aa7e7a7b98e1b3895635d64b339b47d75977b2c896d06ff030496239ef5ba20358389c7cc80eaba204c5e5ac533af6f11960eafe0f0fca38f94f317819b61b8b859ad7e1f7752ec5d1b98bf8ea3b3f761ad786f8cecdaaba4c3e7187cc7bf213df394a98fd90279777ad56e7e3dff40dd6651ed4726d48c0a4be6da0722e2f81c4dd471c9a9c8b80aa113b11212459ba8bdeb37f8e392803bc81d9d08037024e96d6834f21fabc7849c336341ae058a677a5cded764dc4a4f7403a6ff8591b8fcd53dd66350efd56dc877d03e3dc623a4a3c23048bee2bf8ad8b447f6e9047e22d01c791ca30375d45cb2f03b178f4e0a4b8f4d3f8778f9ca869947af4caa5bb82f2da30917b38b4a902b9a1e386eae52eb75fb897d4f6c8c320ab3b72c9256a5c10b044dd911310a8ea7ca066d5a3b494e5a03a13aee7b2d0e289f882f003601d75dd98b66578a711ef57cb520a5afd6a0c6c65baceded99b818de8f8be1498f52f974a9d0d0deaf65eaeb4a2d526162b51f9015611c27bdea7a724ed57ac78f9d5d38d33cedd0422324922ad178050fb9a264b7ad48a73a36b012159177fc1485030005552fcdbb70ffa5456c0bbd82ce32c17bb10cd3a610b5fbe9d01607d167213d9e1b5fb3e09c2b071d6b88b2a076868a093105e8eb16446a5a629ac97486fc176ad87f68f5ae0619874855d2d87557930ec86fe47fc4e77dbe8bf36a891f630669c93ae3ea5d8eac1486f6c87faa9e3c863064712c214f3165f20cc7adbf324d300a95dbd5c13bfaed4daba8121bdbdf103d1e6187537f5685aeea5604851d2a5a08e08e671e6537a9be37cc0b390a2a0edcc2497f999bc88ac86f3cd1349cfed315e7d504c01c5c055b8f564781ac17def890351354d4ea2d97948894b87d45a499928446072d3af2532589c9d29d1ec2f8227eafd4b09f6f713f855a85be505e10ad7068aa2f25c619565a4f170f2ea6544b24016a5c4eed95e60fca123bd1df9eea0b115f126d3ca55f0535e76ff7ebe68c1ce73875436d408698598c3d72a8c5c29809e540e12edcf5ed8fb040ec40f649b930c38eb9edcae85774f509d58c644d992e60d37fefae04475cf9ac71456167978ea47b15c0bed9e47c0df361ecc70dd6f1e51b080f4c47d426d008b7eee80219d9290676c9453cd21b1c89043491560ed11b5e1d22a1b8d105859d2c3d25f3970f0c36b7015496a213aef384cecf28a542ac88adb933190e01f6efba752491a94526ccb41ac0dd3829947a6367b5df442fe3354de578a45dc74705e13142e547c01fce32d0ff133306ae97e169146d4a7e2816c4125fb21cf24bd1dde68bc86cee74ec8ed47b2e597c4ce9fffe11efe798b81b96b8549f0a1c4630e0f3fb3457461925ff8f999f8213ab9c4c3a1bbe7240745367fc2299e61dc696c3c6b26a437fb2cdf032531e46b56bad1ebb8b19ce7cb0902139cd3b493090e731019105771652d6950770ba091b17e3e0ab78f8a23aad48b88a0cbb4eea5fd39c500af547505a155a7ec5b3ede23b6e94e45a54446fdd56c8a59ee2dba0c30d1a3a45134fa407b4ceea60a7de8b33eb929c4fbf5abb4eb34b5bbc184194d4febda5ae571538a3b892d973778634a475d985dfc5a0e76dd360d810620d3c226d8caa98ac41bcb25d4c9df7ee069ae0c1a166e26b0c095333451c9515707b4f21b1a02fb0157cab1a42b9ef4a6c489556ea9e73266b373faceedb1a83e9e0dc1854db3688c21bdacd786b62550cda87a427cce5b5e70ec6e08dcdbdac4096229cb49a4d0bda3d07deaa6d102952e019e5ce99a06a74689adb6b0f70677650e3fa8012ee94db9c825a8591a29523c32de00930556b7321f106f7839ff4bdb8fc65026dff0508bd4ccd5da6507832cb186a9cceb638388230db77fb2257a28134706a6ae0c91822c084e40fdd466a04b9a60c2dcdd4607d150b3c19009a6588d0ae200920c0b3b8632c6bc96a2ed949bec355133d4ab37e91699377790234b7fb7354f60caccce7c0c342c3b11e78b7319d7db6a0eaa152871649e3845a1adf6dd2bdd8db3c0bfd234525c5905fcc2c8c1aecf81759790c3442fde57b045cc6f9fe1b4ae650c2fccfb56d67e26c343b6d8815da218d353c527a03987ef18c72740a7ad5b25655fc9afcd8b6897a4d854d3e7ac6648f1ddd2b4943029755bb58a937652b5f7ba8e2d3c2ce676936de8eec4bf3cd1dd975682bd37da49b0cf18f4d9c5d75b68070fd7fb667584d77f263b2d6103c7d958c3e3b0021137a09af00329767cead44c26c1f39bd0cb7135e28e75b8b7ce7eb0a85f247cb0b1a3b709e35638dde40f6224c17e78e9b34f8b48af082a4f0409b20d5ddad7c898bc1fe82608b0d607c68b4619c5d8c2b0b971883a6a962877b0d9df358c06514620256de07857d805cdcbda814e05ca319b3709b39158fe22bc3d28b0c34f08920f2bb7b270bf2d6c0ad4f5266ed1453f17f819da81855dce7b11c13d47e7dbace36d2c525ca5dd5ef6fd41812d28fa539761797e587ea66481e5514fdd0ae84e5febf09a9cff74e4e9221edf2e03b27ffd1c3d713f5862a432c8e8843073b4c5afda3f46594f91a1f0670c60302ccc0ea9220e0d748a948d4a0d345a078adf7fab6bb58f9529b407b4acbec0cb35c7506e149e2f04a749c6b11ce36cbc128a657d2ab333d675abf4b2ca0d82ec5422035c25e23caa736542926e70fa535cf0f2962f05a229daf2f617156fd6fc7eb963d47691ae9aa6907c0061e579276f106a2438c6d8a6d212e8f027ff91e7f6ef24c43b65bc31a239227892cc82fa1b582515ec7a62d946bc4f85aaae8d2170d366e1bc97a53fbe28836cad271269eea110900e9c465f3bd821e610e753c5bb5f2211afd4703a580a663fbd1d855e36f30a930816ff4e9e8b3ac07b63f7688e7a2214607f01fac455804e84fa873e18dbcf66fa7d7ce286486d96ff2f521184cb140000000d9471c95bd434c0b675e401a907ac76da8eb3d7e0d46b855892532111d2f4efae6fb9a86e56a5e0acba902ab8db41cbe2281f90d6f61d0e95bba8a845edcfd21	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "00188006ADA21012"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\00188006ADA21012 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000003f25eea5300a5b285e7bee0704898b0a7f34ef86688d2718e31cc74a4cb771f9000000000e80000000020000200000007ccb5291a597f302551631c4eb297719c9e4bc25540a1a5058b36019d3b0c15680000000c0a5ff50c06772dc1c5dea26d2b6f745b915d7595f702476548193da8758ed9b93853db148eb330a71d782331f7afd2b778624673868361072eaa6fc9d217e5e359c85f5d2db59f8ec08e41a44e4285e55b9553c74aa6eb922bae72ab07521f1960c74c694ba93487a8758cb72913b6d73d328ff04a771ef7f981e2a2890199940000000c3387117c43558c222bafa0029f83cbaa8457ff26d3f44060673699ac6024d171fa1dfd59d39096dbf10d5311b537794795bc05571c077cda002cf0e7c531e6b	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4368 rundll32.exe
4368 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

4368 rundll32.exe

pid	process
4368	rundll32.exe
4368	rundll32.exe

pid	process
4368	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exe

description	pid	process	target process
PID 4068 wrote to memory of 4368	4068	rundll32.exe	rundll32.exe
PID 4068 wrote to memory of 4368	4068	rundll32.exe	rundll32.exe
PID 4068 wrote to memory of 4368	4068	rundll32.exe	rundll32.exe
PID 4368 wrote to memory of 1132	4368	rundll32.exe	explorer.exe
PID 4368 wrote to memory of 1132	4368	rundll32.exe	explorer.exe
PID 4368 wrote to memory of 1132	4368	rundll32.exe	explorer.exe
PID 4368 wrote to memory of 1132	4368	rundll32.exe	explorer.exe
PID 4368 wrote to memory of 1132	4368	rundll32.exe	explorer.exe
PID 1132 wrote to memory of 4144	1132	explorer.exe	schtasks.exe
PID 1132 wrote to memory of 4144	1132	explorer.exe	schtasks.exe
PID 1132 wrote to memory of 4144	1132	explorer.exe	schtasks.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc747fd7a692f1e158278aed49dad6111ea87f141e9d900c8f027fbd7ca6f109.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc747fd7a692f1e158278aed49dad6111ea87f141e9d900c8f027fbd7ca6f109.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4368

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1132

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kjrjhmopd /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\fc747fd7a692f1e158278aed49dad6111ea87f141e9d900c8f027fbd7ca6f109.dll\"" /SC ONCE /Z /ST 09:13 /ET 09:25
4⤵
- Creates scheduled task(s)
PID:4144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:4156

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1132-136-0x0000000000DB0000-0x00000000011E3000-memory.dmp

Filesize
4.2MB

Download
memory/1132-137-0x0000000000800000-0x0000000000834000-memory.dmp

Filesize
208KB

Download
memory/4368-134-0x0000000002600000-0x00000000027EA000-memory.dmp

Filesize
1.9MB

Download
memory/4368-135-0x0000000010000000-0x000000001026E000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads