qakbot | ff73911c30d6b16e907254ddcc15489869aed63b936218222323f40e1903f1cd

General

Target

ff73911c30d6b16e907254ddcc15489869aed63b936218222323f40e1903f1cd.dll
Size

430KB
MD5

838a66d6b19b82b219778a0e8a083815
SHA1

862f29019b29870b016b9555a9cec55c49e22e89
SHA256

ff73911c30d6b16e907254ddcc15489869aed63b936218222323f40e1903f1cd
SHA512

cc3e9ffc240aa20079a988946a0d5a872c9764adfaa87d6c7b38bc4e8bd840028aa2646ba43cb53232b5ed32c9022230283cf8a0e67c5526eeaccbcb0c36fcb7
SSDEEP

6144:36N5XNlCfcqFhOdpwNzM2a3gfwp3NkOWuzv/24bktfTGoH:KrducqxNzbaP3WOWuLTCfThH

Score

10^/10

qakbot bb 1663148750 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

BB

Campaign

1663148750

C2

193.3.19.37:443

99.232.140.205:2222

99.253.251.74:443

197.94.210.133:443

37.210.148.30:995

14.161.194.86:443

154.181.203.230:995

200.161.62.126:32101

134.35.10.122:443

64.207.215.69:443

81.131.161.131:2078

217.165.85.223:993

78.100.225.34:2222

85.114.110.108:443

102.38.96.108:995

123.240.131.1:443

109.158.159.179:993

186.105.182.127:443

190.44.40.48:995

88.233.194.154:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Drops file in System32 directory 1 IoCs

Processes:

mmc.exe

description ioc process

File opened for modification C:\Windows\system32\taskschd.msc mmc.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1124 schtasks.exe
Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

1696 net.exe
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exenetstat.exe

pid process

1372 ipconfig.exe
528 netstat.exe
Runs net.exe

description	ioc	process
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe

pid	process
1124	schtasks.exe

pid	process
1696	net.exe

pid	process
1372	ipconfig.exe
528	netstat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
1448	regsvr32.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe
1752	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

mmc.exe

pid process

1932 mmc.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1448 regsvr32.exe

pid	process
1932	mmc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

mmc.exe

description	pid	process
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe
Token: 33	1932	mmc.exe
Token: SeIncBasePriorityPrivilege	1932	mmc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

mmc.exe

pid process

1932 mmc.exe
1932 mmc.exe

pid	process
1932	mmc.exe
1932	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exenet.exenet.exe

description	pid	process	target process
PID 1572 wrote to memory of 1448	1572	regsvr32.exe	regsvr32.exe
PID 1572 wrote to memory of 1448	1572	regsvr32.exe	regsvr32.exe
PID 1572 wrote to memory of 1448	1572	regsvr32.exe	regsvr32.exe
PID 1572 wrote to memory of 1448	1572	regsvr32.exe	regsvr32.exe
PID 1572 wrote to memory of 1448	1572	regsvr32.exe	regsvr32.exe
PID 1572 wrote to memory of 1448	1572	regsvr32.exe	regsvr32.exe
PID 1572 wrote to memory of 1448	1572	regsvr32.exe	regsvr32.exe
PID 1448 wrote to memory of 1752	1448	regsvr32.exe	explorer.exe
PID 1448 wrote to memory of 1752	1448	regsvr32.exe	explorer.exe
PID 1448 wrote to memory of 1752	1448	regsvr32.exe	explorer.exe
PID 1448 wrote to memory of 1752	1448	regsvr32.exe	explorer.exe
PID 1448 wrote to memory of 1752	1448	regsvr32.exe	explorer.exe
PID 1448 wrote to memory of 1752	1448	regsvr32.exe	explorer.exe
PID 1752 wrote to memory of 1124	1752	explorer.exe	schtasks.exe
PID 1752 wrote to memory of 1124	1752	explorer.exe	schtasks.exe
PID 1752 wrote to memory of 1124	1752	explorer.exe	schtasks.exe
PID 1752 wrote to memory of 1124	1752	explorer.exe	schtasks.exe
PID 1752 wrote to memory of 1696	1752	explorer.exe	net.exe
PID 1752 wrote to memory of 1696	1752	explorer.exe	net.exe
PID 1752 wrote to memory of 1696	1752	explorer.exe	net.exe
PID 1752 wrote to memory of 1696	1752	explorer.exe	net.exe
PID 1752 wrote to memory of 1464	1752	explorer.exe	cmd.exe
PID 1752 wrote to memory of 1464	1752	explorer.exe	cmd.exe
PID 1752 wrote to memory of 1464	1752	explorer.exe	cmd.exe
PID 1752 wrote to memory of 1464	1752	explorer.exe	cmd.exe
PID 1752 wrote to memory of 1120	1752	explorer.exe	arp.exe
PID 1752 wrote to memory of 1120	1752	explorer.exe	arp.exe
PID 1752 wrote to memory of 1120	1752	explorer.exe	arp.exe
PID 1752 wrote to memory of 1120	1752	explorer.exe	arp.exe
PID 1752 wrote to memory of 1372	1752	explorer.exe	ipconfig.exe
PID 1752 wrote to memory of 1372	1752	explorer.exe	ipconfig.exe
PID 1752 wrote to memory of 1372	1752	explorer.exe	ipconfig.exe
PID 1752 wrote to memory of 1372	1752	explorer.exe	ipconfig.exe
PID 1752 wrote to memory of 896	1752	explorer.exe	nslookup.exe
PID 1752 wrote to memory of 896	1752	explorer.exe	nslookup.exe
PID 1752 wrote to memory of 896	1752	explorer.exe	nslookup.exe
PID 1752 wrote to memory of 896	1752	explorer.exe	nslookup.exe
PID 1752 wrote to memory of 1816	1752	explorer.exe	net.exe
PID 1752 wrote to memory of 1816	1752	explorer.exe	net.exe
PID 1752 wrote to memory of 1816	1752	explorer.exe	net.exe
PID 1752 wrote to memory of 1816	1752	explorer.exe	net.exe
PID 1816 wrote to memory of 1660	1816	net.exe	net1.exe
PID 1816 wrote to memory of 1660	1816	net.exe	net1.exe
PID 1816 wrote to memory of 1660	1816	net.exe	net1.exe
PID 1816 wrote to memory of 1660	1816	net.exe	net1.exe
PID 1752 wrote to memory of 744	1752	explorer.exe	route.exe
PID 1752 wrote to memory of 744	1752	explorer.exe	route.exe
PID 1752 wrote to memory of 744	1752	explorer.exe	route.exe
PID 1752 wrote to memory of 744	1752	explorer.exe	route.exe
PID 1752 wrote to memory of 528	1752	explorer.exe	netstat.exe
PID 1752 wrote to memory of 528	1752	explorer.exe	netstat.exe
PID 1752 wrote to memory of 528	1752	explorer.exe	netstat.exe
PID 1752 wrote to memory of 528	1752	explorer.exe	netstat.exe
PID 1752 wrote to memory of 996	1752	explorer.exe	net.exe
PID 1752 wrote to memory of 996	1752	explorer.exe	net.exe
PID 1752 wrote to memory of 996	1752	explorer.exe	net.exe
PID 1752 wrote to memory of 996	1752	explorer.exe	net.exe
PID 996 wrote to memory of 1652	996	net.exe	net1.exe
PID 996 wrote to memory of 1652	996	net.exe	net1.exe
PID 996 wrote to memory of 1652	996	net.exe	net1.exe
PID 996 wrote to memory of 1652	996	net.exe	net1.exe
PID 1752 wrote to memory of 1044	1752	explorer.exe	whoami.exe
PID 1752 wrote to memory of 1044	1752	explorer.exe	whoami.exe
PID 1752 wrote to memory of 1044	1752	explorer.exe	whoami.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ff73911c30d6b16e907254ddcc15489869aed63b936218222323f40e1903f1cd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\ff73911c30d6b16e907254ddcc15489869aed63b936218222323f40e1903f1cd.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 15:27 /tn eduymmy /ET 15:38 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAZgBmADcAMwA5ADEAMQBjADMAMABkADYAYgAxADYAZQA5ADAANwAyADUANABkAGQAYwBjADEANQA0ADgAOQA4ADYAOQBhAGUAZAA2ADMAYgA5ADMANgAyADEAOAAyADIAMgAzADIAMwBmADQAMABlADEAOQAwADMAZgAxAGMAZAAuAGQAbABsACIA" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:1124

C:\Windows\SysWOW64\net.exe
net view
4⤵
- Discovers systems in the same network
PID:1696

C:\Windows\SysWOW64\cmd.exe
cmd /c set
4⤵
PID:1464

C:\Windows\SysWOW64\arp.exe
arp -a
4⤵
PID:1120

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
4⤵
- Gathers network information
PID:1372

C:\Windows\SysWOW64\nslookup.exe
nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.WORKGROUP
4⤵
PID:896

C:\Windows\SysWOW64\net.exe
net share
4⤵
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 share
5⤵
PID:1660

C:\Windows\SysWOW64\route.exe
route print
4⤵
PID:744

C:\Windows\SysWOW64\netstat.exe
netstat -nao
4⤵
- Gathers network information
PID:528

C:\Windows\SysWOW64\net.exe
net localgroup
4⤵
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup
5⤵
PID:1652

C:\Windows\SysWOW64\whoami.exe
whoami /all
4⤵
PID:1044

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1932

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1700

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Command-Line Interface

1

T1059

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/528-82-0x0000000000000000-mapping.dmp

Download
memory/744-81-0x0000000000000000-mapping.dmp

Download
memory/896-78-0x0000000000000000-mapping.dmp

Download
memory/996-83-0x0000000000000000-mapping.dmp

Download
memory/1044-87-0x0000000000000000-mapping.dmp

Download
memory/1120-75-0x0000000000000000-mapping.dmp

Download
memory/1124-70-0x0000000000000000-mapping.dmp

Download
memory/1372-76-0x0000000000000000-mapping.dmp

Download
memory/1448-55-0x0000000000000000-mapping.dmp

Download
memory/1448-56-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1448-68-0x0000000000220000-0x0000000000242000-memory.dmp

Filesize
136KB

Download
memory/1448-57-0x0000000000220000-0x0000000000242000-memory.dmp

Filesize
136KB

Download
memory/1448-59-0x0000000000220000-0x0000000000242000-memory.dmp

Filesize
136KB

Download
memory/1464-74-0x0000000000000000-mapping.dmp

Download
memory/1572-54-0x000007FEFBD81000-0x000007FEFBD83000-memory.dmp

Filesize
8KB

Download
memory/1652-84-0x0000000000000000-mapping.dmp

Download
memory/1660-80-0x0000000000000000-mapping.dmp

Download
memory/1696-73-0x0000000000000000-mapping.dmp

Download
memory/1752-72-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1752-69-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1752-67-0x0000000073FE1000-0x0000000073FE3000-memory.dmp

Filesize
8KB

Download
memory/1752-65-0x0000000000000000-mapping.dmp

Download
memory/1816-79-0x0000000000000000-mapping.dmp

Download
memory/1932-63-0x0000000003EB8000-0x0000000003ED7000-memory.dmp

Filesize
124KB

Download
memory/1932-71-0x0000000003EB8000-0x0000000003ED7000-memory.dmp

Filesize
124KB

Download
memory/1932-64-0x000000001D910000-0x000000001D929000-memory.dmp

Filesize
100KB

Download
memory/1932-62-0x000007FEEEB00000-0x000007FEEFB96000-memory.dmp

Filesize
16.6MB

Download
memory/1932-61-0x000007FEF3400000-0x000007FEF3E23000-memory.dmp

Filesize
10.1MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads