qakbot | e7868020c075fb0644d9fbda1b640ecf7fd73432369d028396c52ffc2e714036

General

Target

e7868020c075fb0644d9fbda1b640ecf7fd73432369d028396c52ffc2e714036.dll
Size

2.4MB
MD5

e1f9502dbc6f316f4be122c327b781fd
SHA1

381b5bf27895bcca4c9efddab5b104ad6d5101b2
SHA256

e7868020c075fb0644d9fbda1b640ecf7fd73432369d028396c52ffc2e714036
SHA512

447b01e6794e934b5c8ebdfa42a65a23bb463eef93afc5be1a90ed908d65dc63ba56f4c74ec2263f559df3c166db22e40187db7e0d81a019c08b15a335f52bb3

Score

10^/10

qakbot tr02 1608026105 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

tr02

Campaign

1608026105

C2

111.95.212.237:2222

190.220.8.10:995

109.154.79.222:2222

83.110.250.71:995

149.28.99.97:2222

45.63.107.192:443

149.28.101.90:2222

149.28.101.90:995

149.28.99.97:443

149.28.98.196:443

144.202.38.185:2222

45.77.115.208:995

149.28.98.196:2222

149.28.98.196:995

149.28.99.97:995

45.63.107.192:2222

144.202.38.185:995

144.202.38.185:443

45.63.107.192:995

5.13.84.186:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1580 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1708 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1816 rundll32.exe
1816 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1816 rundll32.exe

pid	process
1580	regsvr32.exe

pid	process
1708	schtasks.exe

pid	process
1816	rundll32.exe
1816	rundll32.exe

pid	process
1816	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1876 wrote to memory of 1816	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1816	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1816	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1816	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1816	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1816	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1816	1876	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 652	1816	rundll32.exe	explorer.exe
PID 1816 wrote to memory of 652	1816	rundll32.exe	explorer.exe
PID 1816 wrote to memory of 652	1816	rundll32.exe	explorer.exe
PID 1816 wrote to memory of 652	1816	rundll32.exe	explorer.exe
PID 1816 wrote to memory of 652	1816	rundll32.exe	explorer.exe
PID 1816 wrote to memory of 652	1816	rundll32.exe	explorer.exe
PID 652 wrote to memory of 1708	652	explorer.exe	schtasks.exe
PID 652 wrote to memory of 1708	652	explorer.exe	schtasks.exe
PID 652 wrote to memory of 1708	652	explorer.exe	schtasks.exe
PID 652 wrote to memory of 1708	652	explorer.exe	schtasks.exe
PID 1896 wrote to memory of 1516	1896	taskeng.exe	regsvr32.exe
PID 1896 wrote to memory of 1516	1896	taskeng.exe	regsvr32.exe
PID 1896 wrote to memory of 1516	1896	taskeng.exe	regsvr32.exe
PID 1896 wrote to memory of 1516	1896	taskeng.exe	regsvr32.exe
PID 1896 wrote to memory of 1516	1896	taskeng.exe	regsvr32.exe
PID 1516 wrote to memory of 1580	1516	regsvr32.exe	regsvr32.exe
PID 1516 wrote to memory of 1580	1516	regsvr32.exe	regsvr32.exe
PID 1516 wrote to memory of 1580	1516	regsvr32.exe	regsvr32.exe
PID 1516 wrote to memory of 1580	1516	regsvr32.exe	regsvr32.exe
PID 1516 wrote to memory of 1580	1516	regsvr32.exe	regsvr32.exe
PID 1516 wrote to memory of 1580	1516	regsvr32.exe	regsvr32.exe
PID 1516 wrote to memory of 1580	1516	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7868020c075fb0644d9fbda1b640ecf7fd73432369d028396c52ffc2e714036.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7868020c075fb0644d9fbda1b640ecf7fd73432369d028396c52ffc2e714036.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn otxothex /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\e7868020c075fb0644d9fbda1b640ecf7fd73432369d028396c52ffc2e714036.dll\"" /SC ONCE /Z /ST 05:25 /ET 05:37
4⤵
- Creates scheduled task(s)
PID:1708

C:\Windows\system32\taskeng.exe
taskeng.exe {AEF0CD1D-99E6-44FA-AFA6-0C4E2D8DB2D3} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\e7868020c075fb0644d9fbda1b640ecf7fd73432369d028396c52ffc2e714036.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\e7868020c075fb0644d9fbda1b640ecf7fd73432369d028396c52ffc2e714036.dll"
3⤵
- Loads dropped DLL
PID:1580

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e7868020c075fb0644d9fbda1b640ecf7fd73432369d028396c52ffc2e714036.dll
MD5
2ce8952d915c99e07cdb13e2ef596e80

SHA1
e56ea6b2aa80c55635110b534f6cb9607a19738b

SHA256
e636db841343722a7dc5f0aa492e1edd7d1fa777b401cc369820fe469688571e

SHA512
8ce6e995863abdb788b8e7d932b3c4c5ad9f77523bf8d78bb7aed676945b4ec0abd359f63e9f84e3444b3e91d828f510e9951827d6e2c37f5dc775ccfa071e9f

Download Submit
\Users\Admin\AppData\Local\Temp\e7868020c075fb0644d9fbda1b640ecf7fd73432369d028396c52ffc2e714036.dll
MD5
2ce8952d915c99e07cdb13e2ef596e80

SHA1
e56ea6b2aa80c55635110b534f6cb9607a19738b

SHA256
e636db841343722a7dc5f0aa492e1edd7d1fa777b401cc369820fe469688571e

SHA512
8ce6e995863abdb788b8e7d932b3c4c5ad9f77523bf8d78bb7aed676945b4ec0abd359f63e9f84e3444b3e91d828f510e9951827d6e2c37f5dc775ccfa071e9f

Download Submit
memory/652-59-0x00000000000C0000-0x00000000000C2000-memory.dmp

Filesize
8KB

Download
memory/652-62-0x0000000074A91000-0x0000000074A93000-memory.dmp

Filesize
8KB

Download
memory/652-63-0x00000000000E0000-0x0000000000361000-memory.dmp

Filesize
2.5MB

Download
memory/652-64-0x0000000000080000-0x00000000000B5000-memory.dmp

Filesize
212KB

Download
memory/1516-65-0x000007FEFBD31000-0x000007FEFBD33000-memory.dmp

Filesize
8KB

Download
memory/1816-54-0x0000000075EB1000-0x0000000075EB3000-memory.dmp

Filesize
8KB

Download
memory/1816-55-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/1816-56-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/1816-57-0x0000000001FE0000-0x00000000021CA000-memory.dmp

Filesize
1.9MB

Download
memory/1816-58-0x0000000010000000-0x000000001026E000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads