qakbot | c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166

General

Target

c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166.dll
Size

1.1MB
MD5

8f24a209d47eae18b6f6b5b3b5806982
SHA1

c9dfcb0ea4efd3920c8f89d9ba0ad6ce0df3dbd6
SHA256

c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166
SHA512

49d9adb4ad98e4dadaf092df7921c3b08cb93965ba9d486e7767a81689d501deb9cc187f5fff61beed29dd35daf9e94bfa7439e84dc28766f80acddeb807cc39

Score

10^/10

qakbot aa 1651213605 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.573

Botnet

AA

Campaign

1651213605

C2

74.14.7.71:2222

1.161.104.149:443

1.161.104.149:995

24.152.219.253:995

180.129.20.164:995

46.107.48.202:443

118.172.250.162:443

102.65.38.74:443

76.25.142.196:443

93.48.80.198:995

47.23.89.62:995

2.34.12.8:443

38.70.253.226:2222

47.23.89.62:993

75.99.168.194:443

41.228.22.180:443

148.64.96.100:443

108.60.213.141:443

172.114.160.81:443

140.82.49.12:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1592 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1128 schtasks.exe

pid	process
1592	regsvr32.exe

pid	process
1128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeexplorer.exe

pid	process
1668	rundll32.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe
1060	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1668 rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 376 wrote to memory of 1668	376	rundll32.exe	rundll32.exe
PID 376 wrote to memory of 1668	376	rundll32.exe	rundll32.exe
PID 376 wrote to memory of 1668	376	rundll32.exe	rundll32.exe
PID 376 wrote to memory of 1668	376	rundll32.exe	rundll32.exe
PID 376 wrote to memory of 1668	376	rundll32.exe	rundll32.exe
PID 376 wrote to memory of 1668	376	rundll32.exe	rundll32.exe
PID 376 wrote to memory of 1668	376	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 1060	1668	rundll32.exe	explorer.exe
PID 1668 wrote to memory of 1060	1668	rundll32.exe	explorer.exe
PID 1668 wrote to memory of 1060	1668	rundll32.exe	explorer.exe
PID 1668 wrote to memory of 1060	1668	rundll32.exe	explorer.exe
PID 1668 wrote to memory of 1060	1668	rundll32.exe	explorer.exe
PID 1668 wrote to memory of 1060	1668	rundll32.exe	explorer.exe
PID 1060 wrote to memory of 1128	1060	explorer.exe	schtasks.exe
PID 1060 wrote to memory of 1128	1060	explorer.exe	schtasks.exe
PID 1060 wrote to memory of 1128	1060	explorer.exe	schtasks.exe
PID 1060 wrote to memory of 1128	1060	explorer.exe	schtasks.exe
PID 1712 wrote to memory of 1804	1712	taskeng.exe	regsvr32.exe
PID 1712 wrote to memory of 1804	1712	taskeng.exe	regsvr32.exe
PID 1712 wrote to memory of 1804	1712	taskeng.exe	regsvr32.exe
PID 1712 wrote to memory of 1804	1712	taskeng.exe	regsvr32.exe
PID 1712 wrote to memory of 1804	1712	taskeng.exe	regsvr32.exe
PID 1804 wrote to memory of 1592	1804	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 1592	1804	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 1592	1804	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 1592	1804	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 1592	1804	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 1592	1804	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 1592	1804	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:376

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn nwrvlcdwc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166.dll\"" /SC ONCE /Z /ST 22:16 /ET 22:28
4⤵
- Creates scheduled task(s)
PID:1128

C:\Windows\system32\taskeng.exe
taskeng.exe {AA33897C-B966-466F-92B7-3CA6276D42B5} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166.dll"
3⤵
- Loads dropped DLL
PID:1592

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166.dll
Filesize
1.1MB

MD5
8f24a209d47eae18b6f6b5b3b5806982

SHA1
c9dfcb0ea4efd3920c8f89d9ba0ad6ce0df3dbd6

SHA256
c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166

SHA512
49d9adb4ad98e4dadaf092df7921c3b08cb93965ba9d486e7767a81689d501deb9cc187f5fff61beed29dd35daf9e94bfa7439e84dc28766f80acddeb807cc39

Download Submit
\Users\Admin\AppData\Local\Temp\c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166.dll
Filesize
1.1MB

MD5
8f24a209d47eae18b6f6b5b3b5806982

SHA1
c9dfcb0ea4efd3920c8f89d9ba0ad6ce0df3dbd6

SHA256
c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166

SHA512
49d9adb4ad98e4dadaf092df7921c3b08cb93965ba9d486e7767a81689d501deb9cc187f5fff61beed29dd35daf9e94bfa7439e84dc28766f80acddeb807cc39

Download Submit
memory/1060-63-0x0000000000000000-mapping.dmp

Download
memory/1060-69-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download
memory/1060-67-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download
memory/1060-65-0x0000000074821000-0x0000000074823000-memory.dmp

Filesize
8KB

Download
memory/1128-68-0x0000000000000000-mapping.dmp

Download
memory/1592-73-0x0000000000000000-mapping.dmp

Download
memory/1592-76-0x0000000000690000-0x00000000007AD000-memory.dmp

Filesize
1.1MB

Download
memory/1592-80-0x00000000010E0000-0x000000000116F000-memory.dmp

Filesize
572KB

Download
memory/1592-79-0x00000000010E0000-0x000000000116F000-memory.dmp

Filesize
572KB

Download
memory/1592-77-0x00000000010E0000-0x000000000116F000-memory.dmp

Filesize
572KB

Download
memory/1592-78-0x00000000010E0000-0x000000000116F000-memory.dmp

Filesize
572KB

Download
memory/1668-59-0x0000000002180000-0x000000000220F000-memory.dmp

Filesize
572KB

Download
memory/1668-57-0x0000000002180000-0x000000000220F000-memory.dmp

Filesize
572KB

Download
memory/1668-56-0x00000000009B0000-0x0000000000ACD000-memory.dmp

Filesize
1.1MB

Download
memory/1668-54-0x0000000000000000-mapping.dmp

Download
memory/1668-55-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/1668-58-0x0000000002180000-0x000000000220F000-memory.dmp

Filesize
572KB

Download
memory/1668-62-0x0000000002180000-0x000000000220F000-memory.dmp

Filesize
572KB

Download
memory/1668-66-0x0000000002180000-0x000000000220F000-memory.dmp

Filesize
572KB

Download
memory/1668-60-0x0000000002180000-0x000000000220F000-memory.dmp

Filesize
572KB

Download
memory/1668-61-0x00000000003F0000-0x000000000047A000-memory.dmp

Filesize
552KB

Download
memory/1804-70-0x0000000000000000-mapping.dmp

Download
memory/1804-71-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads