qakbot | 605e372d44e79191af892b85eb3468bedf13916b64198084f58016640f5863da

General

Target

QBot_f1263a039c93f88f4e308f6e17d7863ceb9b48a939357726c152937503dc5b69.dll
Size

1.0MB
MD5

02f53c52811ab112fc110e817a772c1c
SHA1

f4c9cc40472799c03f80069b97ac0485f76e72c1
SHA256

f1263a039c93f88f4e308f6e17d7863ceb9b48a939357726c152937503dc5b69
SHA512

f195e0ea64b0c09148e0009a4bd60ba53dc777e00fce9790afc8b5236e036a19092265314ac6aaec858312c6744a8397fcfc8bbc50e173e76229528af6aa540f

Score

10^/10

qakbot tr 1633334141 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633334141

C2

75.75.179.226:443

185.250.148.74:443

122.11.220.212:2222

120.150.218.241:995

103.148.120.144:443

140.82.49.12:443

40.131.140.155:995

206.47.134.234:2222

73.230.205.91:443

190.198.206.189:2222

103.157.122.198:995

81.250.153.227:2222

167.248.100.227:443

96.57.188.174:2078

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

136.232.34.70:443

68.186.192.69:443

167.248.111.245:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

980 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

944 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

276 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

276 rundll32.exe

pid	process
980	regsvr32.exe

pid	process
944	schtasks.exe

pid	process
276	rundll32.exe

pid	process
276	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 2036 wrote to memory of 276	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 276	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 276	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 276	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 276	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 276	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 276	2036	rundll32.exe	rundll32.exe
PID 276 wrote to memory of 1608	276	rundll32.exe	explorer.exe
PID 276 wrote to memory of 1608	276	rundll32.exe	explorer.exe
PID 276 wrote to memory of 1608	276	rundll32.exe	explorer.exe
PID 276 wrote to memory of 1608	276	rundll32.exe	explorer.exe
PID 276 wrote to memory of 1608	276	rundll32.exe	explorer.exe
PID 276 wrote to memory of 1608	276	rundll32.exe	explorer.exe
PID 1608 wrote to memory of 944	1608	explorer.exe	schtasks.exe
PID 1608 wrote to memory of 944	1608	explorer.exe	schtasks.exe
PID 1608 wrote to memory of 944	1608	explorer.exe	schtasks.exe
PID 1608 wrote to memory of 944	1608	explorer.exe	schtasks.exe
PID 616 wrote to memory of 1524	616	taskeng.exe	regsvr32.exe
PID 616 wrote to memory of 1524	616	taskeng.exe	regsvr32.exe
PID 616 wrote to memory of 1524	616	taskeng.exe	regsvr32.exe
PID 616 wrote to memory of 1524	616	taskeng.exe	regsvr32.exe
PID 616 wrote to memory of 1524	616	taskeng.exe	regsvr32.exe
PID 1524 wrote to memory of 980	1524	regsvr32.exe	regsvr32.exe
PID 1524 wrote to memory of 980	1524	regsvr32.exe	regsvr32.exe
PID 1524 wrote to memory of 980	1524	regsvr32.exe	regsvr32.exe
PID 1524 wrote to memory of 980	1524	regsvr32.exe	regsvr32.exe
PID 1524 wrote to memory of 980	1524	regsvr32.exe	regsvr32.exe
PID 1524 wrote to memory of 980	1524	regsvr32.exe	regsvr32.exe
PID 1524 wrote to memory of 980	1524	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QBot_f1263a039c93f88f4e308f6e17d7863ceb9b48a939357726c152937503dc5b69.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QBot_f1263a039c93f88f4e308f6e17d7863ceb9b48a939357726c152937503dc5b69.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:276

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jzvsakj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\QBot_f1263a039c93f88f4e308f6e17d7863ceb9b48a939357726c152937503dc5b69.dll\"" /SC ONCE /Z /ST 16:57 /ET 17:09
4⤵
- Creates scheduled task(s)
PID:944

C:\Windows\system32\taskeng.exe
taskeng.exe {22708FF8-7725-41A9-8AE8-88A875DD5C32} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:616

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\QBot_f1263a039c93f88f4e308f6e17d7863ceb9b48a939357726c152937503dc5b69.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\QBot_f1263a039c93f88f4e308f6e17d7863ceb9b48a939357726c152937503dc5b69.dll"
3⤵
- Loads dropped DLL
PID:980

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\QBot_f1263a039c93f88f4e308f6e17d7863ceb9b48a939357726c152937503dc5b69.dll
Filesize
1.0MB

MD5
02f53c52811ab112fc110e817a772c1c

SHA1
f4c9cc40472799c03f80069b97ac0485f76e72c1

SHA256
f1263a039c93f88f4e308f6e17d7863ceb9b48a939357726c152937503dc5b69

SHA512
f195e0ea64b0c09148e0009a4bd60ba53dc777e00fce9790afc8b5236e036a19092265314ac6aaec858312c6744a8397fcfc8bbc50e173e76229528af6aa540f

Download Submit
\Users\Admin\AppData\Local\Temp\QBot_f1263a039c93f88f4e308f6e17d7863ceb9b48a939357726c152937503dc5b69.dll
Filesize
1.0MB

MD5
02f53c52811ab112fc110e817a772c1c

SHA1
f4c9cc40472799c03f80069b97ac0485f76e72c1

SHA256
f1263a039c93f88f4e308f6e17d7863ceb9b48a939357726c152937503dc5b69

SHA512
f195e0ea64b0c09148e0009a4bd60ba53dc777e00fce9790afc8b5236e036a19092265314ac6aaec858312c6744a8397fcfc8bbc50e173e76229528af6aa540f

Download Submit
memory/276-61-0x0000000072D00000-0x000000007370C000-memory.dmp

Filesize
10.0MB

Download
memory/276-57-0x0000000072D00000-0x0000000072D21000-memory.dmp

Filesize
132KB

Download
memory/276-58-0x0000000072D00000-0x000000007370C000-memory.dmp

Filesize
10.0MB

Download
memory/276-60-0x0000000072D00000-0x000000007370C000-memory.dmp

Filesize
10.0MB

Download
memory/276-56-0x0000000072D00000-0x000000007370C000-memory.dmp

Filesize
10.0MB

Download
memory/276-54-0x0000000000000000-mapping.dmp

Download
memory/276-65-0x0000000072D00000-0x000000007370C000-memory.dmp

Filesize
10.0MB

Download
memory/276-55-0x0000000075721000-0x0000000075723000-memory.dmp

Filesize
8KB

Download
memory/944-67-0x0000000000000000-mapping.dmp

Download
memory/980-72-0x0000000000000000-mapping.dmp

Download
memory/1524-70-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

Filesize
8KB

Download
memory/1524-69-0x0000000000000000-mapping.dmp

Download
memory/1608-64-0x00000000746F1000-0x00000000746F3000-memory.dmp

Filesize
8KB

Download
memory/1608-68-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1608-66-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1608-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads