qakbot | 0633d3f7c8c10f7b36787799f9231c90404bd6a6ef0faeee1c7599efd3748663

General

Target

0633d3f7c8c10f7b36787799f9231c90404bd6a6ef0faeee1c7599efd3748663.dll
Size

2.4MB
MD5

5cf07240b652eeffadbf22799ad153a5
SHA1

dda07fd924414d2122852faeec7e5e842d1ebf25
SHA256

0633d3f7c8c10f7b36787799f9231c90404bd6a6ef0faeee1c7599efd3748663
SHA512

bed298a7ec4cc4f46a0f8013e886609e4dafea70d7ea7a2db551c246c1edb4dcee32a57f3b81bcacc1740b6cb43ed5255fdb5814d084b9d8edb194e7b09160ae

Score

10^/10

qakbot abc117 1608719407 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.157

Botnet

abc117

Campaign

1608719407

C2

41.39.134.183:443

113.193.187.2:995

90.188.91.57:995

176.181.247.197:443

78.191.87.198:20

83.110.241.182:443

93.149.167.254:2222

76.111.128.194:443

32.212.117.188:443

72.36.59.46:2222

68.186.192.69:443

94.98.248.152:443

105.226.38.36:443

92.154.83.96:2222

37.210.255.225:995

74.195.52.3:443

73.166.10.38:443

95.77.223.148:443

80.227.5.70:443

91.104.104.63:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Drops file in Windows directory 12 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\Cmn5TH6S2lFFnfMN8MLr2EoNUIAGzQo2UUjHGMEC99A=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\5ondRmJ90JlkPETuN535TWk=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\e1a85885fd4453165061351651289cce8f8590c4	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\a3f602ea4d534d006919a2613d91f9506b383314	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\f3535a3b47819a04c6d5ee18905493be086e801e	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\BITC2FB.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BITBA6A.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\BITBDD6.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\BITC039.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\LZOCjtiHKk8=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BITC153.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\BITC2AC.tmp	svchost.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1840 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

780 rundll32.exe
780 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

780 rundll32.exe

pid	process
1840	schtasks.exe

pid	process
780	rundll32.exe
780	rundll32.exe

pid	process
780	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exe

description	pid	process	target process
PID 3368 wrote to memory of 780	3368	rundll32.exe	rundll32.exe
PID 3368 wrote to memory of 780	3368	rundll32.exe	rundll32.exe
PID 3368 wrote to memory of 780	3368	rundll32.exe	rundll32.exe
PID 780 wrote to memory of 1008	780	rundll32.exe	explorer.exe
PID 780 wrote to memory of 1008	780	rundll32.exe	explorer.exe
PID 780 wrote to memory of 1008	780	rundll32.exe	explorer.exe
PID 780 wrote to memory of 1008	780	rundll32.exe	explorer.exe
PID 780 wrote to memory of 1008	780	rundll32.exe	explorer.exe
PID 1008 wrote to memory of 1840	1008	explorer.exe	schtasks.exe
PID 1008 wrote to memory of 1840	1008	explorer.exe	schtasks.exe
PID 1008 wrote to memory of 1840	1008	explorer.exe	schtasks.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0633d3f7c8c10f7b36787799f9231c90404bd6a6ef0faeee1c7599efd3748663.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3368

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0633d3f7c8c10f7b36787799f9231c90404bd6a6ef0faeee1c7599efd3748663.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:780

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1008

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn edschblqa /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\0633d3f7c8c10f7b36787799f9231c90404bd6a6ef0faeee1c7599efd3748663.dll\"" /SC ONCE /Z /ST 18:27 /ET 18:39
4⤵
- Creates scheduled task(s)
PID:1840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Drops file in Windows directory
PID:1264

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-134-0x0000000002E60000-0x000000000304A000-memory.dmp

Filesize
1.9MB

Download
memory/780-135-0x0000000010000000-0x000000001026E000-memory.dmp

Filesize
2.4MB

Download
memory/1008-136-0x0000000000880000-0x0000000000CB3000-memory.dmp

Filesize
4.2MB

Download
memory/1008-137-0x0000000001200000-0x0000000001234000-memory.dmp

Filesize
208KB

Download
memory/1264-138-0x0000013C67870000-0x0000013C67880000-memory.dmp

Filesize
64KB

Download
memory/1264-139-0x0000013C678D0000-0x0000013C678E0000-memory.dmp

Filesize
64KB

Download
memory/1264-140-0x0000013C69E90000-0x0000013C69E94000-memory.dmp

Filesize
16KB

Download
memory/1264-141-0x0000013C6A200000-0x0000013C6A204000-memory.dmp

Filesize
16KB

Download
memory/1264-142-0x0000013C6A1A0000-0x0000013C6A1A4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads