qakbot | 9113daa35884ea7b895e73e5be3a56907e6c096c0ccf685de2e448e5a6e24120

General

Target

9113daa35884ea7b895e73e5be3a56907e6c096c0ccf685de2e448e5a6e24120.dll
Size

2.5MB
MD5

2943e9db87a8a0f80b5b5313c0434bc6
SHA1

e269296923bd2995008fd454e86622fb04f5c2b4
SHA256

9113daa35884ea7b895e73e5be3a56907e6c096c0ccf685de2e448e5a6e24120
SHA512

1e65d78879f5bce1d61dc3e4d345b7fcda430624b0e1f57b27ec07510ba10a2334faf45cdd961e83299837ef39ca38984667fc4952865178f0f4c764486203bd

Score

10^/10

qakbot abc112 1608025881 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

abc112

Campaign

1608025881

C2

149.28.98.196:995

149.28.99.97:995

45.63.107.192:2222

144.202.38.185:995

144.202.38.185:443

45.63.107.192:995

5.13.84.186:995

68.83.89.188:443

67.141.11.98:443

219.76.148.249:443

86.245.82.249:2078

116.240.78.45:995

37.182.244.124:2222

72.186.1.237:443

78.97.207.104:443

80.14.22.234:2222

202.141.225.158:443

72.28.255.159:995

37.6.208.105:2222

161.142.217.62:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1716 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1748 rundll32.exe
1748 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1748 rundll32.exe

pid	process
1716	schtasks.exe

pid	process
1748	rundll32.exe
1748	rundll32.exe

pid	process
1748	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1524 wrote to memory of 1748	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1748	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1748	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1748	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1748	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1748	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1748	1524	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 2028	1748	rundll32.exe	explorer.exe
PID 1748 wrote to memory of 2028	1748	rundll32.exe	explorer.exe
PID 1748 wrote to memory of 2028	1748	rundll32.exe	explorer.exe
PID 1748 wrote to memory of 2028	1748	rundll32.exe	explorer.exe
PID 1748 wrote to memory of 2028	1748	rundll32.exe	explorer.exe
PID 1748 wrote to memory of 2028	1748	rundll32.exe	explorer.exe
PID 2028 wrote to memory of 1716	2028	explorer.exe	schtasks.exe
PID 2028 wrote to memory of 1716	2028	explorer.exe	schtasks.exe
PID 2028 wrote to memory of 1716	2028	explorer.exe	schtasks.exe
PID 2028 wrote to memory of 1716	2028	explorer.exe	schtasks.exe
PID 668 wrote to memory of 1256	668	taskeng.exe	regsvr32.exe
PID 668 wrote to memory of 1256	668	taskeng.exe	regsvr32.exe
PID 668 wrote to memory of 1256	668	taskeng.exe	regsvr32.exe
PID 668 wrote to memory of 1256	668	taskeng.exe	regsvr32.exe
PID 668 wrote to memory of 1256	668	taskeng.exe	regsvr32.exe
PID 1256 wrote to memory of 1840	1256	regsvr32.exe	regsvr32.exe
PID 1256 wrote to memory of 1840	1256	regsvr32.exe	regsvr32.exe
PID 1256 wrote to memory of 1840	1256	regsvr32.exe	regsvr32.exe
PID 1256 wrote to memory of 1840	1256	regsvr32.exe	regsvr32.exe
PID 1256 wrote to memory of 1840	1256	regsvr32.exe	regsvr32.exe
PID 1256 wrote to memory of 1840	1256	regsvr32.exe	regsvr32.exe
PID 1256 wrote to memory of 1840	1256	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9113daa35884ea7b895e73e5be3a56907e6c096c0ccf685de2e448e5a6e24120.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9113daa35884ea7b895e73e5be3a56907e6c096c0ccf685de2e448e5a6e24120.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn joyigmuc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9113daa35884ea7b895e73e5be3a56907e6c096c0ccf685de2e448e5a6e24120.dll\"" /SC ONCE /Z /ST 03:11 /ET 03:23
4⤵
- Creates scheduled task(s)
PID:1716

C:\Windows\system32\taskeng.exe
taskeng.exe {72B16DA2-7844-4C7F-BF40-0B8034C61616} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9113daa35884ea7b895e73e5be3a56907e6c096c0ccf685de2e448e5a6e24120.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\9113daa35884ea7b895e73e5be3a56907e6c096c0ccf685de2e448e5a6e24120.dll"
3⤵
PID:1840

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9113daa35884ea7b895e73e5be3a56907e6c096c0ccf685de2e448e5a6e24120.dll
Filesize
2.5MB

MD5
00b16323786bae96dbf1fb811f937a2d

SHA1
925771d2f87f8a6f6a5480fafbca0b48c666b134

SHA256
6d3d9847fe69b4817a263aa0fcf4e66440add3523f47c756dbd183d19ef922c0

SHA512
bd077d9b32c9a01f585e3b265847051351d7118b1408eb5bd5b61e98ef85319c3e8739db37c78d7447ed2c4de73d19156342200784729d9051c3e98fb9216797

Download Submit
memory/1256-63-0x0000000000000000-mapping.dmp

Download
memory/1256-64-0x000007FEFC4D1000-0x000007FEFC4D3000-memory.dmp

Filesize
8KB

Download
memory/1716-62-0x0000000000000000-mapping.dmp

Download
memory/1748-54-0x0000000000000000-mapping.dmp

Download
memory/1748-55-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download
memory/1748-56-0x0000000000910000-0x0000000000AFA000-memory.dmp

Filesize
1.9MB

Download
memory/1748-57-0x0000000010000000-0x000000001028A000-memory.dmp

Filesize
2.5MB

Download
memory/1840-66-0x0000000000000000-mapping.dmp

Download
memory/2028-58-0x0000000000000000-mapping.dmp

Download
memory/2028-60-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/2028-61-0x0000000000380000-0x00000000003B5000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads