qakbot | a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0

General

Target

a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0.dll
Size

398KB
MD5

cfb7c326710fed33c1ce0716c58326a7
SHA1

7f2883e74b810aeb372870dfc23b4eb2653e4841
SHA256

a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0
SHA512

20fb985eb87cae9f6891e57be27b4428b927d30e720bf562bca64b8d455c1dfe0a2b8fad346f19aa4492a8de1e294cfc0a73350855eecbd731a5718ccbbe7ecc
SSDEEP

6144:d9ykYklEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesN23wU7HuAmHK+U:b2wr03pdf8vhhOKJET8Byq+U

Score

10^/10

qakbot biden01 1613656969 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

biden01

Campaign

1613656969

C2

172.87.157.235:3389

173.184.119.153:995

81.150.181.168:2222

71.187.170.235:443

197.45.110.165:995

86.160.137.132:443

86.236.77.68:2222

106.51.85.162:443

108.31.15.10:995

38.92.225.121:443

72.252.201.69:443

71.117.132.169:443

98.173.34.212:995

83.110.12.140:2222

95.77.223.148:443

41.39.134.183:443

85.52.72.32:2222

195.12.154.8:443

108.160.123.244:443

96.57.188.174:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4608 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5028 4608 WerFault.exe regsvr32.exe

pid	process
4608	regsvr32.exe

pid	pid_target	process	target process
5028	4608	WerFault.exe	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

740 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exe

pid process

4268 regsvr32.exe
4268 regsvr32.exe
4268 regsvr32.exe
4268 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

4268 regsvr32.exe

pid	process
740	schtasks.exe

pid	process
4268	regsvr32.exe
4268	regsvr32.exe
4268	regsvr32.exe
4268	regsvr32.exe

pid	process
4268	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 5040 wrote to memory of 4268	5040	regsvr32.exe	regsvr32.exe
PID 5040 wrote to memory of 4268	5040	regsvr32.exe	regsvr32.exe
PID 5040 wrote to memory of 4268	5040	regsvr32.exe	regsvr32.exe
PID 4268 wrote to memory of 4644	4268	regsvr32.exe	explorer.exe
PID 4268 wrote to memory of 4644	4268	regsvr32.exe	explorer.exe
PID 4268 wrote to memory of 4644	4268	regsvr32.exe	explorer.exe
PID 4268 wrote to memory of 4644	4268	regsvr32.exe	explorer.exe
PID 4268 wrote to memory of 4644	4268	regsvr32.exe	explorer.exe
PID 4644 wrote to memory of 740	4644	explorer.exe	schtasks.exe
PID 4644 wrote to memory of 740	4644	explorer.exe	schtasks.exe
PID 4644 wrote to memory of 740	4644	explorer.exe	schtasks.exe
PID 392 wrote to memory of 4608	392	regsvr32.exe	regsvr32.exe
PID 392 wrote to memory of 4608	392	regsvr32.exe	regsvr32.exe
PID 392 wrote to memory of 4608	392	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5040

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0.dll
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4268

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4644

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cgingjny /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0.dll\"" /SC ONCE /Z /ST 13:24 /ET 13:36
4⤵
- Creates scheduled task(s)
PID:740

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:392

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0.dll"
2⤵
- Loads dropped DLL
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 584
3⤵
- Program crash
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4608 -ip 4608
1⤵
PID:2112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0.dll
Filesize
398KB

MD5
a68143545ecfc8a50bd94fa0e0925665

SHA1
ebe802d6275f2836072b37cf68e512e354c77b83

SHA256
9aa10c8561c35b6f6d811f36a0382ba06f49732029ab935ac1d22b4bc1647f17

SHA512
5233dcbe5404d1161d54eed59771bdd58eff39e04eed4442c0664b7d57a5a7075d7bc72057777de2e84aa6ae7335943bbd8f04f29aaa3db767eb58eb9c53ce98

Download Submit
C:\Users\Admin\AppData\Local\Temp\a64576e2cc09aca5ae1e14600d984ccf8b417b3b74589603e18f4c80f0f5aab0.dll
Filesize
398KB

MD5
a68143545ecfc8a50bd94fa0e0925665

SHA1
ebe802d6275f2836072b37cf68e512e354c77b83

SHA256
9aa10c8561c35b6f6d811f36a0382ba06f49732029ab935ac1d22b4bc1647f17

SHA512
5233dcbe5404d1161d54eed59771bdd58eff39e04eed4442c0664b7d57a5a7075d7bc72057777de2e84aa6ae7335943bbd8f04f29aaa3db767eb58eb9c53ce98

Download Submit
memory/740-136-0x0000000000000000-mapping.dmp

Download
memory/4268-132-0x0000000000000000-mapping.dmp

Download
memory/4268-133-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download
memory/4268-134-0x0000000002FF0000-0x0000000003054000-memory.dmp

Filesize
400KB

Download
memory/4608-140-0x0000000000000000-mapping.dmp

Download
memory/4608-142-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download
memory/4644-135-0x0000000000000000-mapping.dmp

Download
memory/4644-137-0x0000000000760000-0x0000000000795000-memory.dmp

Filesize
212KB

Download
memory/4644-138-0x0000000000760000-0x0000000000795000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads