qakbot | a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0

General

Target

a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0.dll
Size

398KB
MD5

cfb7c326710fed33c1ce0716c58326a7
SHA1

7f2883e74b810aeb372870dfc23b4eb2653e4841
SHA256

a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0
SHA512

20fb985eb87cae9f6891e57be27b4428b927d30e720bf562bca64b8d455c1dfe0a2b8fad346f19aa4492a8de1e294cfc0a73350855eecbd731a5718ccbbe7ecc
SSDEEP

6144:d9ykYklEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesN23wU7HuAmHK+U:b2wr03pdf8vhhOKJET8Byq+U

Score

10^/10

qakbot biden01 1613656969 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

biden01

Campaign

1613656969

C2

172.87.157.235:3389

173.184.119.153:995

81.150.181.168:2222

71.187.170.235:443

197.45.110.165:995

86.160.137.132:443

86.236.77.68:2222

106.51.85.162:443

108.31.15.10:995

38.92.225.121:443

72.252.201.69:443

71.117.132.169:443

98.173.34.212:995

83.110.12.140:2222

95.77.223.148:443

41.39.134.183:443

85.52.72.32:2222

195.12.154.8:443

108.160.123.244:443

96.57.188.174:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1852 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

524 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1528 regsvr32.exe
1528 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1528 regsvr32.exe

pid	process
1852	regsvr32.exe

pid	process
524	schtasks.exe

pid	process
1528	regsvr32.exe
1528	regsvr32.exe

pid	process
1528	regsvr32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 548 wrote to memory of 1528	548	regsvr32.exe	regsvr32.exe
PID 548 wrote to memory of 1528	548	regsvr32.exe	regsvr32.exe
PID 548 wrote to memory of 1528	548	regsvr32.exe	regsvr32.exe
PID 548 wrote to memory of 1528	548	regsvr32.exe	regsvr32.exe
PID 548 wrote to memory of 1528	548	regsvr32.exe	regsvr32.exe
PID 548 wrote to memory of 1528	548	regsvr32.exe	regsvr32.exe
PID 548 wrote to memory of 1528	548	regsvr32.exe	regsvr32.exe
PID 1528 wrote to memory of 596	1528	regsvr32.exe	explorer.exe
PID 1528 wrote to memory of 596	1528	regsvr32.exe	explorer.exe
PID 1528 wrote to memory of 596	1528	regsvr32.exe	explorer.exe
PID 1528 wrote to memory of 596	1528	regsvr32.exe	explorer.exe
PID 1528 wrote to memory of 596	1528	regsvr32.exe	explorer.exe
PID 1528 wrote to memory of 596	1528	regsvr32.exe	explorer.exe
PID 596 wrote to memory of 524	596	explorer.exe	schtasks.exe
PID 596 wrote to memory of 524	596	explorer.exe	schtasks.exe
PID 596 wrote to memory of 524	596	explorer.exe	schtasks.exe
PID 596 wrote to memory of 524	596	explorer.exe	schtasks.exe
PID 700 wrote to memory of 1692	700	taskeng.exe	regsvr32.exe
PID 700 wrote to memory of 1692	700	taskeng.exe	regsvr32.exe
PID 700 wrote to memory of 1692	700	taskeng.exe	regsvr32.exe
PID 700 wrote to memory of 1692	700	taskeng.exe	regsvr32.exe
PID 700 wrote to memory of 1692	700	taskeng.exe	regsvr32.exe
PID 1692 wrote to memory of 1852	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1852	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1852	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1852	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1852	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1852	1692	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1852	1692	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:548

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:596

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mhcwxur /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0.dll\"" /SC ONCE /Z /ST 13:24 /ET 13:36
4⤵
- Creates scheduled task(s)
PID:524

C:\Windows\system32\taskeng.exe
taskeng.exe {28B1FA17-42EC-49F1-9880-B498606CA813} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:700

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0.dll"
3⤵
- Loads dropped DLL
PID:1852

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0.dll
Filesize
398KB

MD5
a68143545ecfc8a50bd94fa0e0925665

SHA1
ebe802d6275f2836072b37cf68e512e354c77b83

SHA256
9aa10c8561c35b6f6d811f36a0382ba06f49732029ab935ac1d22b4bc1647f17

SHA512
5233dcbe5404d1161d54eed59771bdd58eff39e04eed4442c0664b7d57a5a7075d7bc72057777de2e84aa6ae7335943bbd8f04f29aaa3db767eb58eb9c53ce98

Download Submit
\Users\Admin\AppData\Local\Temp\a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0.dll
Filesize
398KB

MD5
a68143545ecfc8a50bd94fa0e0925665

SHA1
ebe802d6275f2836072b37cf68e512e354c77b83

SHA256
9aa10c8561c35b6f6d811f36a0382ba06f49732029ab935ac1d22b4bc1647f17

SHA512
5233dcbe5404d1161d54eed59771bdd58eff39e04eed4442c0664b7d57a5a7075d7bc72057777de2e84aa6ae7335943bbd8f04f29aaa3db767eb58eb9c53ce98

Download Submit
memory/524-64-0x0000000000000000-mapping.dmp

Download
memory/548-54-0x000007FEFBBA1000-0x000007FEFBBA3000-memory.dmp

Filesize
8KB

Download
memory/596-61-0x00000000744F1000-0x00000000744F3000-memory.dmp

Filesize
8KB

Download
memory/596-59-0x0000000000000000-mapping.dmp

Download
memory/596-63-0x00000000000C0000-0x00000000000F5000-memory.dmp

Filesize
212KB

Download
memory/596-65-0x00000000000C0000-0x00000000000F5000-memory.dmp

Filesize
212KB

Download
memory/1528-58-0x0000000000220000-0x00000000002A0000-memory.dmp

Filesize
512KB

Download
memory/1528-62-0x0000000000220000-0x0000000000284000-memory.dmp

Filesize
400KB

Download
memory/1528-57-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download
memory/1528-56-0x00000000753D1000-0x00000000753D3000-memory.dmp

Filesize
8KB

Download
memory/1528-55-0x0000000000000000-mapping.dmp

Download
memory/1692-66-0x0000000000000000-mapping.dmp

Download
memory/1852-69-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads