qakbot | fc1dc6aad7a08fa4c3492e7b82dc1a38b7702133dcb24b471703da4a1ed9b71e

General

Target

fc1dc6aad7a08fa4c3492e7b82dc1a38b7702133dcb24b471703da4a1ed9b71e.dll
Size

500KB
MD5

6c36047f029c90116914ac8c755e199b
SHA1

3c5426d2fcbdec65352765945289fa11ea546b9c
SHA256

fc1dc6aad7a08fa4c3492e7b82dc1a38b7702133dcb24b471703da4a1ed9b71e
SHA512

3597364e52017d66527b49af3791000033f1908255b68dce1a6fb4f9808a783fe0d8bcaff6569b2d6b757ecd57785001166b648a878ed0d6cb2667c5eba349a5

Score

10^/10

qakbot abc102 1606735229 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.29

Botnet

abc102

Campaign

1606735229

C2

98.26.50.62:995

98.4.227.199:443

106.51.52.111:443

2.88.53.159:995

83.196.50.197:2222

92.137.138.52:2222

89.33.87.107:443

185.105.131.233:443

80.106.85.24:2222

197.161.154.132:443

79.129.121.81:995

217.133.54.140:32100

118.70.55.146:443

86.97.221.121:443

194.243.78.225:443

87.27.110.90:2222

196.151.252.84:443

85.121.42.12:443

90.23.117.67:2222

197.45.110.165:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	rundll32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4420 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

552 rundll32.exe
552 rundll32.exe
552 rundll32.exe
552 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

552 rundll32.exe

pid	process
4420	schtasks.exe

pid	process
552	rundll32.exe
552	rundll32.exe
552	rundll32.exe
552	rundll32.exe

pid	process
552	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exe

description	pid	process	target process
PID 4564 wrote to memory of 552	4564	rundll32.exe	rundll32.exe
PID 4564 wrote to memory of 552	4564	rundll32.exe	rundll32.exe
PID 4564 wrote to memory of 552	4564	rundll32.exe	rundll32.exe
PID 552 wrote to memory of 4552	552	rundll32.exe	explorer.exe
PID 552 wrote to memory of 4552	552	rundll32.exe	explorer.exe
PID 552 wrote to memory of 4552	552	rundll32.exe	explorer.exe
PID 552 wrote to memory of 4552	552	rundll32.exe	explorer.exe
PID 552 wrote to memory of 4552	552	rundll32.exe	explorer.exe
PID 4552 wrote to memory of 4420	4552	explorer.exe	schtasks.exe
PID 4552 wrote to memory of 4420	4552	explorer.exe	schtasks.exe
PID 4552 wrote to memory of 4420	4552	explorer.exe	schtasks.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc1dc6aad7a08fa4c3492e7b82dc1a38b7702133dcb24b471703da4a1ed9b71e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4564

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc1dc6aad7a08fa4c3492e7b82dc1a38b7702133dcb24b471703da4a1ed9b71e.dll,#1
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4552

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fpzrwfkb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\fc1dc6aad7a08fa4c3492e7b82dc1a38b7702133dcb24b471703da4a1ed9b71e.dll\"" /SC ONCE /Z /ST 11:45 /ET 11:57
4⤵
- Creates scheduled task(s)
PID:4420

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\fc1dc6aad7a08fa4c3492e7b82dc1a38b7702133dcb24b471703da4a1ed9b71e.dll"
1⤵
PID:4304

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/552-134-0x0000000000000000-mapping.dmp

Download
memory/552-135-0x0000000000A00000-0x0000000000A8D000-memory.dmp

Filesize
564KB

Download
memory/552-136-0x0000000010000000-0x000000001007D000-memory.dmp

Filesize
500KB

Download
memory/4420-139-0x0000000000000000-mapping.dmp

Download
memory/4552-137-0x0000000000000000-mapping.dmp

Download
memory/4552-138-0x0000000001150000-0x0000000001170000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads