qakbot | fc1dc6aad7a08fa4c3492e7b82dc1a38b7702133dcb24b471703da4a1ed9b71e

General

Target

fc1dc6aad7a08fa4c3492e7b82dc1a38b7702133dcb24b471703da4a1ed9b71e.dll
Size

500KB
MD5

6c36047f029c90116914ac8c755e199b
SHA1

3c5426d2fcbdec65352765945289fa11ea546b9c
SHA256

fc1dc6aad7a08fa4c3492e7b82dc1a38b7702133dcb24b471703da4a1ed9b71e
SHA512

3597364e52017d66527b49af3791000033f1908255b68dce1a6fb4f9808a783fe0d8bcaff6569b2d6b757ecd57785001166b648a878ed0d6cb2667c5eba349a5

Score

10^/10

qakbot abc102 1606735229 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.29

Botnet

abc102

Campaign

1606735229

C2

98.26.50.62:995

98.4.227.199:443

106.51.52.111:443

2.88.53.159:995

83.196.50.197:2222

92.137.138.52:2222

89.33.87.107:443

185.105.131.233:443

80.106.85.24:2222

197.161.154.132:443

79.129.121.81:995

217.133.54.140:32100

118.70.55.146:443

86.97.221.121:443

194.243.78.225:443

87.27.110.90:2222

196.151.252.84:443

85.121.42.12:443

90.23.117.67:2222

197.45.110.165:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1076 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1704 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1984 rundll32.exe
1984 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1984 rundll32.exe

pid	process
1076	regsvr32.exe

pid	process
1704	schtasks.exe

pid	process
1984	rundll32.exe
1984	rundll32.exe

pid	process
1984	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1952 wrote to memory of 1984	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 1984	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 1984	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 1984	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 1984	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 1984	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 1984	1952	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 1508	1984	rundll32.exe	explorer.exe
PID 1984 wrote to memory of 1508	1984	rundll32.exe	explorer.exe
PID 1984 wrote to memory of 1508	1984	rundll32.exe	explorer.exe
PID 1984 wrote to memory of 1508	1984	rundll32.exe	explorer.exe
PID 1984 wrote to memory of 1508	1984	rundll32.exe	explorer.exe
PID 1984 wrote to memory of 1508	1984	rundll32.exe	explorer.exe
PID 1508 wrote to memory of 1704	1508	explorer.exe	schtasks.exe
PID 1508 wrote to memory of 1704	1508	explorer.exe	schtasks.exe
PID 1508 wrote to memory of 1704	1508	explorer.exe	schtasks.exe
PID 1508 wrote to memory of 1704	1508	explorer.exe	schtasks.exe
PID 1896 wrote to memory of 1752	1896	taskeng.exe	regsvr32.exe
PID 1896 wrote to memory of 1752	1896	taskeng.exe	regsvr32.exe
PID 1896 wrote to memory of 1752	1896	taskeng.exe	regsvr32.exe
PID 1896 wrote to memory of 1752	1896	taskeng.exe	regsvr32.exe
PID 1896 wrote to memory of 1752	1896	taskeng.exe	regsvr32.exe
PID 1752 wrote to memory of 1076	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1076	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1076	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1076	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1076	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1076	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1076	1752	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc1dc6aad7a08fa4c3492e7b82dc1a38b7702133dcb24b471703da4a1ed9b71e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc1dc6aad7a08fa4c3492e7b82dc1a38b7702133dcb24b471703da4a1ed9b71e.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn htgalgerfy /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\fc1dc6aad7a08fa4c3492e7b82dc1a38b7702133dcb24b471703da4a1ed9b71e.dll\"" /SC ONCE /Z /ST 10:45 /ET 10:57
4⤵
- Creates scheduled task(s)
PID:1704

C:\Windows\system32\taskeng.exe
taskeng.exe {BA8D48AE-A88A-4CC0-8366-961CE05B99A8} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\fc1dc6aad7a08fa4c3492e7b82dc1a38b7702133dcb24b471703da4a1ed9b71e.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\fc1dc6aad7a08fa4c3492e7b82dc1a38b7702133dcb24b471703da4a1ed9b71e.dll"
3⤵
- Loads dropped DLL
PID:1076

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fc1dc6aad7a08fa4c3492e7b82dc1a38b7702133dcb24b471703da4a1ed9b71e.dll
MD5
b5850ece90d0d4312d755267c589fc5a

SHA1
6337211d54a7bdc1c4c6bdf85a97f9ddcd0b166b

SHA256
454495de1141aa0d6ad82b68a46491813bd1c78d45a92fab83a621e01e159aa8

SHA512
e51345242446b942369fef771a42f35be27f330a197dde62a555a6b0b259944254d57dbf9333c67e485de5cca94a6e595f5d088d093a87655c24de6e42feecfa

Download Submit
\Users\Admin\AppData\Local\Temp\fc1dc6aad7a08fa4c3492e7b82dc1a38b7702133dcb24b471703da4a1ed9b71e.dll
MD5
b5850ece90d0d4312d755267c589fc5a

SHA1
6337211d54a7bdc1c4c6bdf85a97f9ddcd0b166b

SHA256
454495de1141aa0d6ad82b68a46491813bd1c78d45a92fab83a621e01e159aa8

SHA512
e51345242446b942369fef771a42f35be27f330a197dde62a555a6b0b259944254d57dbf9333c67e485de5cca94a6e595f5d088d093a87655c24de6e42feecfa

Download Submit
memory/1076-68-0x0000000000000000-mapping.dmp

Download
memory/1508-64-0x00000000000D0000-0x00000000000F0000-memory.dmp

Filesize
128KB

Download
memory/1508-58-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/1508-60-0x0000000000000000-mapping.dmp

Download
memory/1508-62-0x0000000074971000-0x0000000074973000-memory.dmp

Filesize
8KB

Download
memory/1704-63-0x0000000000000000-mapping.dmp

Download
memory/1752-65-0x0000000000000000-mapping.dmp

Download
memory/1752-66-0x000007FEFBE31000-0x000007FEFBE33000-memory.dmp

Filesize
8KB

Download
memory/1984-54-0x0000000000000000-mapping.dmp

Download
memory/1984-57-0x0000000010000000-0x000000001007D000-memory.dmp

Filesize
500KB

Download
memory/1984-56-0x00000000001A0000-0x000000000021D000-memory.dmp

Filesize
500KB

Download
memory/1984-55-0x0000000075D31000-0x0000000075D33000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads