qakbot | 4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14

General

Target

4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14.dll
Size

598KB
MD5

da51dd657868bf4d2924b4398e045b27
SHA1

2eca78e78bdc00e02da0a7328a3c57176cf3c011
SHA256

4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14
SHA512

ca168c81ebec1de5ffdcb9b766af4c4c4ae42e3a0c49e82c04bc8e9b31fdb30594b6df12a7f3ecddf0d73a352326e8ebd3265caae152bf2d67409b5f3759b1e8
SSDEEP

12288:hzF6eBVYHBQ3DvlYuZ+wNvYyujPt5ABJXT+gO:ho1HBuKuj61D4XTK

Score

10^/10

qakbot snow01 1662453469 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.858

Botnet

snow01

Campaign

1662453469

C2

200.161.62.126:32101

217.165.68.122:993

99.232.140.205:2222

81.131.161.131:2078

89.211.179.14:2222

186.64.87.202:443

197.94.210.133:443

193.3.19.37:443

37.210.148.30:995

200.100.55.252:32101

70.51.153.182:2222

120.150.218.241:995

173.189.167.21:995

24.139.72.117:443

104.34.212.7:32103

47.23.89.61:995

24.55.67.176:443

172.115.177.204:2222

217.165.77.134:995

24.178.196.158:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1292 schtasks.exe

pid	process
1292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeexplorer.exe

pid	process
540	rundll32.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

540 rundll32.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exe

description	pid	process	target process
PID 1048 wrote to memory of 540	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 540	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 540	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 540	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 540	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 540	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 540	1048	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 1508	540	rundll32.exe	explorer.exe
PID 540 wrote to memory of 1508	540	rundll32.exe	explorer.exe
PID 540 wrote to memory of 1508	540	rundll32.exe	explorer.exe
PID 540 wrote to memory of 1508	540	rundll32.exe	explorer.exe
PID 540 wrote to memory of 1508	540	rundll32.exe	explorer.exe
PID 540 wrote to memory of 1508	540	rundll32.exe	explorer.exe
PID 1508 wrote to memory of 1292	1508	explorer.exe	schtasks.exe
PID 1508 wrote to memory of 1292	1508	explorer.exe	schtasks.exe
PID 1508 wrote to memory of 1292	1508	explorer.exe	schtasks.exe
PID 1508 wrote to memory of 1292	1508	explorer.exe	schtasks.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 14:20 /tn vzmmtuwvfw /ET 14:31 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwANABmADEAMwBkADMANQAxADgAMABiADgANQAyADYAMQBhAGEANAA5AGIAZAAyADgAMABhAGUANQAyAGMANgBmAGYANQAwADEAZgBjAGMAMgAyADQAZQBjAGQAOABmAGYANwAyADkANgA5ADcAMwAzADcAZQAxADQAYwBlADEANAAuAGQAbABsACIA" /SC ONCE
      4⤵
      Creates scheduled task(s)
      PID:1292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-54-0x0000000000000000-mapping.dmp

Download
memory/540-55-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/540-56-0x0000000000240000-0x00000000002D9000-memory.dmp

Filesize
612KB

Download
memory/540-58-0x0000000000340000-0x0000000000362000-memory.dmp

Filesize
136KB

Download
memory/540-57-0x0000000000310000-0x0000000000333000-memory.dmp

Filesize
140KB

Download
memory/540-62-0x0000000000340000-0x0000000000362000-memory.dmp

Filesize
136KB

Download
memory/1292-64-0x0000000000000000-mapping.dmp

Download
memory/1508-59-0x0000000000000000-mapping.dmp

Download
memory/1508-61-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/1508-63-0x00000000000C0000-0x00000000000E2000-memory.dmp

Filesize
136KB

Download
memory/1508-65-0x00000000000C0000-0x00000000000E2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads