qakbot | 3bafc43b0d903ad2811aa3287a7e5548e7d9179c27d4c1bf4dcbdd95d6563862

General

Target

3bafc43b0d903ad2811aa3287a7e5548e7d9179c27d4c1bf4dcbdd95d6563862.dll
Size

2.8MB
MD5

91e82bfefc43fcc5e2a73b38ae865429
SHA1

e52d355078930b224ec1f4eea79438e3c8dcf163
SHA256

3bafc43b0d903ad2811aa3287a7e5548e7d9179c27d4c1bf4dcbdd95d6563862
SHA512

f6cad680d0f5c17b721e34d9c8941e539c66506dfae44a837d14bc20af048dc18bfa6a208675f0c865bddc66228a2511f01d79ea41f68981402dd9529f6955f6

Score

10^/10

qakbot abc100 1606289576 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.29

Botnet

abc100

Campaign

1606289576

C2

198.2.35.226:2222

84.78.128.76:2078

120.150.34.178:443

24.201.61.153:2078

217.128.117.218:2222

217.133.54.140:32100

156.205.56.98:995

98.26.50.62:995

172.114.116.226:995

109.209.94.165:2222

72.190.101.70:443

92.59.35.196:2083

37.107.82.136:443

85.132.36.111:2222

174.76.11.123:995

219.74.176.225:443

98.118.156.172:443

94.59.120.142:443

72.29.181.78:2078

178.223.20.246:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

316 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1936 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1136 rundll32.exe
1136 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1136 rundll32.exe

pid	process
316	regsvr32.exe

pid	process
1936	schtasks.exe

pid	process
1136	rundll32.exe
1136	rundll32.exe

pid	process
1136	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1656 wrote to memory of 1136	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1136	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1136	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1136	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1136	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1136	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1136	1656	rundll32.exe	rundll32.exe
PID 1136 wrote to memory of 1152	1136	rundll32.exe	explorer.exe
PID 1136 wrote to memory of 1152	1136	rundll32.exe	explorer.exe
PID 1136 wrote to memory of 1152	1136	rundll32.exe	explorer.exe
PID 1136 wrote to memory of 1152	1136	rundll32.exe	explorer.exe
PID 1136 wrote to memory of 1152	1136	rundll32.exe	explorer.exe
PID 1136 wrote to memory of 1152	1136	rundll32.exe	explorer.exe
PID 1152 wrote to memory of 1936	1152	explorer.exe	schtasks.exe
PID 1152 wrote to memory of 1936	1152	explorer.exe	schtasks.exe
PID 1152 wrote to memory of 1936	1152	explorer.exe	schtasks.exe
PID 1152 wrote to memory of 1936	1152	explorer.exe	schtasks.exe
PID 1532 wrote to memory of 1840	1532	taskeng.exe	regsvr32.exe
PID 1532 wrote to memory of 1840	1532	taskeng.exe	regsvr32.exe
PID 1532 wrote to memory of 1840	1532	taskeng.exe	regsvr32.exe
PID 1532 wrote to memory of 1840	1532	taskeng.exe	regsvr32.exe
PID 1532 wrote to memory of 1840	1532	taskeng.exe	regsvr32.exe
PID 1840 wrote to memory of 316	1840	regsvr32.exe	regsvr32.exe
PID 1840 wrote to memory of 316	1840	regsvr32.exe	regsvr32.exe
PID 1840 wrote to memory of 316	1840	regsvr32.exe	regsvr32.exe
PID 1840 wrote to memory of 316	1840	regsvr32.exe	regsvr32.exe
PID 1840 wrote to memory of 316	1840	regsvr32.exe	regsvr32.exe
PID 1840 wrote to memory of 316	1840	regsvr32.exe	regsvr32.exe
PID 1840 wrote to memory of 316	1840	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bafc43b0d903ad2811aa3287a7e5548e7d9179c27d4c1bf4dcbdd95d6563862.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bafc43b0d903ad2811aa3287a7e5548e7d9179c27d4c1bf4dcbdd95d6563862.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1136

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hmyobodi /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\3bafc43b0d903ad2811aa3287a7e5548e7d9179c27d4c1bf4dcbdd95d6563862.dll\"" /SC ONCE /Z /ST 12:23 /ET 12:35
4⤵
- Creates scheduled task(s)
PID:1936

C:\Windows\system32\taskeng.exe
taskeng.exe {599CBB35-187B-4F51-BBEC-E2F1023DD70A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\3bafc43b0d903ad2811aa3287a7e5548e7d9179c27d4c1bf4dcbdd95d6563862.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\3bafc43b0d903ad2811aa3287a7e5548e7d9179c27d4c1bf4dcbdd95d6563862.dll"
3⤵
- Loads dropped DLL
PID:316

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3bafc43b0d903ad2811aa3287a7e5548e7d9179c27d4c1bf4dcbdd95d6563862.dll
MD5
8e1e51fa3e862622eaf0b870c9857382

SHA1
d685c9197a755c8143525275a8626816e9e5fbb0

SHA256
aa6c7eb1c65d9244416b78f067f3259637d6c0845b2959e47cb5240fc14318b2

SHA512
c2920d5e8e987fecd8a50cacde229263bcf9e1d4678cdd8acdc0379d4bf9c4ef8fec88fb2b4c7e96ed4a548d74cf41b62335b6aa3f9a1159fc2a969e3a9d362d

Download Submit
\Users\Admin\AppData\Local\Temp\3bafc43b0d903ad2811aa3287a7e5548e7d9179c27d4c1bf4dcbdd95d6563862.dll
MD5
8e1e51fa3e862622eaf0b870c9857382

SHA1
d685c9197a755c8143525275a8626816e9e5fbb0

SHA256
aa6c7eb1c65d9244416b78f067f3259637d6c0845b2959e47cb5240fc14318b2

SHA512
c2920d5e8e987fecd8a50cacde229263bcf9e1d4678cdd8acdc0379d4bf9c4ef8fec88fb2b4c7e96ed4a548d74cf41b62335b6aa3f9a1159fc2a969e3a9d362d

Download Submit
memory/316-70-0x0000000000000000-mapping.dmp

Download
memory/1136-55-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/1136-56-0x00000000001A0000-0x00000000001C0000-memory.dmp

Filesize
128KB

Download
memory/1136-57-0x00000000001A0000-0x00000000001C0000-memory.dmp

Filesize
128KB

Download
memory/1136-58-0x0000000000920000-0x0000000000B0A000-memory.dmp

Filesize
1.9MB

Download
memory/1136-59-0x00000000001A0000-0x00000000001C0000-memory.dmp

Filesize
128KB

Download
memory/1136-54-0x0000000000000000-mapping.dmp

Download
memory/1152-64-0x0000000074BE1000-0x0000000074BE3000-memory.dmp

Filesize
8KB

Download
memory/1152-66-0x00000000000C0000-0x00000000000E0000-memory.dmp

Filesize
128KB

Download
memory/1152-62-0x0000000000000000-mapping.dmp

Download
memory/1152-60-0x00000000000E0000-0x00000000000E2000-memory.dmp

Filesize
8KB

Download
memory/1840-67-0x0000000000000000-mapping.dmp

Download
memory/1840-68-0x000007FEFBEC1000-0x000007FEFBEC3000-memory.dmp

Filesize
8KB

Download
memory/1936-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads