qakbot | dcffb2fa61007968135189b85bc57108972baeb33a2f99577fdb1ca1c310ff42

General

Target

dcffb2fa61007968135189b85bc57108972baeb33a2f99577fdb1ca1c310ff42.dll
Size

2.2MB
MD5

a4c286f26273de7dcaff6f9176bb4b40
SHA1

c97ab650558645dd6ffa47be89857d22e570bc8a
SHA256

dcffb2fa61007968135189b85bc57108972baeb33a2f99577fdb1ca1c310ff42
SHA512

5ae9c55b6da2815d9de2d0bda6a2661f40c665b8c17fc820b7c3d31ac57c1d38a0b8f29ad0c82d4cfdb986de68569fb6701fae148f40406d0a64962c1dfcebce

Score

10^/10

qakbot abc117 1608747966 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.157

Botnet

abc117

Campaign

1608747966

C2

67.6.54.180:443

187.250.170.34:995

67.141.11.98:443

109.154.79.222:2222

2.88.184.160:443

85.52.72.32:2222

86.98.21.234:443

73.166.10.38:50003

90.61.30.155:2222

71.182.142.63:443

178.223.22.192:995

184.189.122.72:443

181.39.236.199:443

72.240.200.181:2222

154.238.45.174:995

47.22.148.6:443

2.51.251.47:995

199.19.117.131:443

200.76.215.87:443

37.104.39.32:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3160 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1436 3160 WerFault.exe regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1812 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1872 rundll32.exe
1872 rundll32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

1872 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1872 rundll32.exe

pid	process
3160	regsvr32.exe

pid	pid_target	process	target process
1436	3160	WerFault.exe	regsvr32.exe

pid	process
1812	schtasks.exe

pid	process
1872	rundll32.exe
1872	rundll32.exe

pid	process
1872	rundll32.exe

pid	process
1872	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 2824 wrote to memory of 1872	2824	rundll32.exe	rundll32.exe
PID 2824 wrote to memory of 1872	2824	rundll32.exe	rundll32.exe
PID 2824 wrote to memory of 1872	2824	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 1568	1872	rundll32.exe	explorer.exe
PID 1872 wrote to memory of 1568	1872	rundll32.exe	explorer.exe
PID 1872 wrote to memory of 1568	1872	rundll32.exe	explorer.exe
PID 1872 wrote to memory of 1568	1872	rundll32.exe	explorer.exe
PID 1872 wrote to memory of 1568	1872	rundll32.exe	explorer.exe
PID 1568 wrote to memory of 1812	1568	explorer.exe	schtasks.exe
PID 1568 wrote to memory of 1812	1568	explorer.exe	schtasks.exe
PID 1568 wrote to memory of 1812	1568	explorer.exe	schtasks.exe
PID 2148 wrote to memory of 3160	2148	regsvr32.exe	regsvr32.exe
PID 2148 wrote to memory of 3160	2148	regsvr32.exe	regsvr32.exe
PID 2148 wrote to memory of 3160	2148	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dcffb2fa61007968135189b85bc57108972baeb33a2f99577fdb1ca1c310ff42.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dcffb2fa61007968135189b85bc57108972baeb33a2f99577fdb1ca1c310ff42.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cyxxmte /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\dcffb2fa61007968135189b85bc57108972baeb33a2f99577fdb1ca1c310ff42.dll\"" /SC ONCE /Z /ST 16:18 /ET 16:30
4⤵
- Creates scheduled task(s)
PID:1812

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\dcffb2fa61007968135189b85bc57108972baeb33a2f99577fdb1ca1c310ff42.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2148

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\dcffb2fa61007968135189b85bc57108972baeb33a2f99577fdb1ca1c310ff42.dll"
2⤵
- Loads dropped DLL
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 584
3⤵
- Program crash
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3160 -ip 3160
1⤵
PID:4812

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dcffb2fa61007968135189b85bc57108972baeb33a2f99577fdb1ca1c310ff42.dll
Filesize
2.2MB

MD5
52faca1096a1081c447cdfffb3547408

SHA1
97c31a341b530337034c9080411e621665fff205

SHA256
8db61637f33c257ed655b3e00fd4f368712e6f35692eeac94adf2dceb2badc13

SHA512
c9aebc9e3eb7bba9b43765a70f9d1ea281e2c92c9014572680855c45295aceac1dca54d80c613442b370abca086b354cd53ab497c3de7a79fe41e4e6858b8703

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcffb2fa61007968135189b85bc57108972baeb33a2f99577fdb1ca1c310ff42.dll
Filesize
2.2MB

MD5
52faca1096a1081c447cdfffb3547408

SHA1
97c31a341b530337034c9080411e621665fff205

SHA256
8db61637f33c257ed655b3e00fd4f368712e6f35692eeac94adf2dceb2badc13

SHA512
c9aebc9e3eb7bba9b43765a70f9d1ea281e2c92c9014572680855c45295aceac1dca54d80c613442b370abca086b354cd53ab497c3de7a79fe41e4e6858b8703

Download Submit
memory/1568-134-0x0000000000000000-mapping.dmp

Download
memory/1568-135-0x0000000000F00000-0x0000000000F34000-memory.dmp

Filesize
208KB

Download
memory/1568-138-0x0000000000F00000-0x0000000000F34000-memory.dmp

Filesize
208KB

Download
memory/1812-137-0x0000000000000000-mapping.dmp

Download
memory/1872-131-0x0000000000000000-mapping.dmp

Download
memory/1872-132-0x0000000002C50000-0x0000000002E3A000-memory.dmp

Filesize
1.9MB

Download
memory/1872-133-0x0000000010000000-0x0000000010245000-memory.dmp

Filesize
2.3MB

Download
memory/1872-136-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download
memory/3160-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads