qakbot | 1566d011a12613080aaeb6741c06ea832b9d28af725dce6017e11b5eec148836

General

Target

qakbot.dll
Size

533KB
MD5

76dd8de86a8a0c3c66c86cb854617879
SHA1

f4b53cfd6e81b532c585e62defae7c37a6b695ed
SHA256

1566d011a12613080aaeb6741c06ea832b9d28af725dce6017e11b5eec148836
SHA512

3d95fdc7a586d0a2a0b80d2f97bb18fb9321d16bf28cc793778a94f96f76b594cb841d6f53dfaa8163cbef34ee30c8f1553d61989e086ecb95b70d97fd023299
SSDEEP

12288:LWghjfsaHKisYUVJAEvyxN1Us1RvCey4CZfxz4uc:SijHHKH53vU1UwRq3bzp

Score

10^/10

qakbot bb 1662647912 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.860

Botnet

BB

Campaign

1662647912

C2

197.94.210.133:443

193.3.19.37:443

70.51.153.182:2222

99.232.140.205:2222

123.240.131.1:443

177.102.84.28:32101

105.156.152.227:443

190.59.247.136:995

89.211.218.88:2222

81.214.220.237:443

85.99.62.74:443

191.97.234.238:995

81.131.161.131:2078

217.165.68.122:993

219.69.103.199:443

37.210.148.30:995

64.207.215.69:443

113.169.57.104:443

179.225.221.169:32101

151.234.99.49:990

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1960 schtasks.exe

pid	process
1960	schtasks.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 40493385d9c3d801	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeexplorer.exe

pid	process
1172	rundll32.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe
1940	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1172 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1480 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1480	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exe

description	pid	process	target process
PID 1824 wrote to memory of 1172	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1172	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1172	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1172	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1172	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1172	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1172	1824	rundll32.exe	rundll32.exe
PID 1172 wrote to memory of 1940	1172	rundll32.exe	explorer.exe
PID 1172 wrote to memory of 1940	1172	rundll32.exe	explorer.exe
PID 1172 wrote to memory of 1940	1172	rundll32.exe	explorer.exe
PID 1172 wrote to memory of 1940	1172	rundll32.exe	explorer.exe
PID 1172 wrote to memory of 1940	1172	rundll32.exe	explorer.exe
PID 1172 wrote to memory of 1940	1172	rundll32.exe	explorer.exe
PID 1940 wrote to memory of 1960	1940	explorer.exe	schtasks.exe
PID 1940 wrote to memory of 1960	1940	explorer.exe	schtasks.exe
PID 1940 wrote to memory of 1960	1940	explorer.exe	schtasks.exe
PID 1940 wrote to memory of 1960	1940	explorer.exe	schtasks.exe
PID 1420 wrote to memory of 1480	1420	taskeng.exe	powershell.exe
PID 1420 wrote to memory of 1480	1420	taskeng.exe	powershell.exe
PID 1420 wrote to memory of 1480	1420	taskeng.exe	powershell.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qakbot.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qakbot.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 23:20 /tn wcgfmmzo /ET 23:31 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcQBhAGsAYgBvAHQALgBkAGwAbAAiAA==" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:1960

C:\Windows\system32\taskeng.exe
taskeng.exe {28268890-7B01-486A-BD85-8B6655563BD2} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcQBhAGsAYgBvAHQALgBkAGwAbAAiAA==
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\qakbot.dll
3⤵
PID:844

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1172-63-0x0000000000410000-0x0000000000432000-memory.dmp

Filesize
136KB

Download
memory/1172-56-0x0000000000300000-0x0000000000386000-memory.dmp

Filesize
536KB

Download
memory/1172-54-0x0000000000000000-mapping.dmp

Download
memory/1172-57-0x0000000000240000-0x0000000000264000-memory.dmp

Filesize
144KB

Download
memory/1172-58-0x0000000000410000-0x0000000000432000-memory.dmp

Filesize
136KB

Download
memory/1172-59-0x0000000000410000-0x0000000000432000-memory.dmp

Filesize
136KB

Download
memory/1172-55-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1480-72-0x000000000129B000-0x00000000012BA000-memory.dmp

Filesize
124KB

Download
memory/1480-67-0x0000000000000000-mapping.dmp

Download
memory/1480-68-0x000007FEFB5C1000-0x000007FEFB5C3000-memory.dmp

Filesize
8KB

Download
memory/1480-69-0x000007FEF43B0000-0x000007FEF4DD3000-memory.dmp

Filesize
10.1MB

Download
memory/1480-70-0x000007FEF3850000-0x000007FEF43AD000-memory.dmp

Filesize
11.4MB

Download
memory/1480-71-0x0000000001294000-0x0000000001297000-memory.dmp

Filesize
12KB

Download
memory/1940-62-0x00000000740D1000-0x00000000740D3000-memory.dmp

Filesize
8KB

Download
memory/1940-60-0x0000000000000000-mapping.dmp

Download
memory/1940-66-0x00000000000D0000-0x00000000000F2000-memory.dmp

Filesize
136KB

Download
memory/1940-64-0x00000000000D0000-0x00000000000F2000-memory.dmp

Filesize
136KB

Download
memory/1960-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads