qakbot | a5bc6aad1c3205857cf8d29058f8a5283bdc743b9965b5b5d2e69df9a9b6bb1b

General

Target

a5bc6aad1c3205857cf8d29058f8a5283bdc743b9965b5b5d2e69df9a9b6bb1b.dll
Size

260KB
MD5

3b8ca07dfa8d8ed5d7a4522ddcc65e88
SHA1

acc5b1ba536db0f88b8144450ef1f1dbb1338b55
SHA256

a5bc6aad1c3205857cf8d29058f8a5283bdc743b9965b5b5d2e69df9a9b6bb1b
SHA512

e1535e0f95f7635fce77e4a00bed1eb0300934257b5ecc4dbcece970e98cbbf1fcafc9c40ce9a966b17c584b9623c8cd18e681fa43497d1cc4ab1c592a87cd5a
SSDEEP

6144:rwxqaEeZ4POyKmLrLqGvHr0nNK11G9DFj:sHEnxZrkNK11G95

Score

10^/10

qakbot abc105 1606839097 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.51

Botnet

abc105

Campaign

1606839097

C2

90.101.117.122:2222

78.97.207.104:443

189.222.242.165:995

95.76.27.6:443

2.50.56.81:443

96.225.88.23:443

47.21.192.182:2222

189.222.242.165:443

197.86.204.38:443

84.117.176.32:443

93.146.133.102:2222

71.38.13.243:443

96.21.251.127:2222

184.98.97.227:995

58.179.21.147:995

187.213.136.249:995

65.30.213.13:6882

80.195.103.146:2222

106.51.85.162:443

187.227.87.235:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4852 regsvr32.exe

pid	process
4852	regsvr32.exe

Drops file in Windows directory 8 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\INF\audioendpoint.PNF	rundll32.exe
File opened for modification	C:\Windows\INF\netrtl64.PNF	rundll32.exe
File opened for modification	C:\Windows\INF\printqueue.PNF	rundll32.exe
File opened for modification	C:\Windows\INF\kdnic.PNF	rundll32.exe
File opened for modification	C:\Windows\INF\c_swdevice.PNF	rundll32.exe
File opened for modification	C:\Windows\INF\disk.PNF	rundll32.exe
File opened for modification	C:\Windows\INF\vhdmp.PNF	rundll32.exe
File opened for modification	C:\Windows\INF\cpu.PNF	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3236 4852 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
3236	4852	WerFault.exe	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	rundll32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

5096 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

4272 rundll32.exe
4272 rundll32.exe
4272 rundll32.exe
4272 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

4272 rundll32.exe

pid	process
5096	schtasks.exe

pid	process
4272	rundll32.exe
4272	rundll32.exe
4272	rundll32.exe
4272	rundll32.exe

pid	process
4272	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 3068 wrote to memory of 4272	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 4272	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 4272	3068	rundll32.exe	rundll32.exe
PID 4272 wrote to memory of 2144	4272	rundll32.exe	explorer.exe
PID 4272 wrote to memory of 2144	4272	rundll32.exe	explorer.exe
PID 4272 wrote to memory of 2144	4272	rundll32.exe	explorer.exe
PID 4272 wrote to memory of 2144	4272	rundll32.exe	explorer.exe
PID 4272 wrote to memory of 2144	4272	rundll32.exe	explorer.exe
PID 2144 wrote to memory of 5096	2144	explorer.exe	schtasks.exe
PID 2144 wrote to memory of 5096	2144	explorer.exe	schtasks.exe
PID 2144 wrote to memory of 5096	2144	explorer.exe	schtasks.exe
PID 4540 wrote to memory of 4852	4540	regsvr32.exe	regsvr32.exe
PID 4540 wrote to memory of 4852	4540	regsvr32.exe	regsvr32.exe
PID 4540 wrote to memory of 4852	4540	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5bc6aad1c3205857cf8d29058f8a5283bdc743b9965b5b5d2e69df9a9b6bb1b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5bc6aad1c3205857cf8d29058f8a5283bdc743b9965b5b5d2e69df9a9b6bb1b.dll,#1
2⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4272

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2144

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn biwbgks /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a5bc6aad1c3205857cf8d29058f8a5283bdc743b9965b5b5d2e69df9a9b6bb1b.dll\"" /SC ONCE /Z /ST 20:31 /ET 20:43
4⤵
- Creates scheduled task(s)
PID:5096

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a5bc6aad1c3205857cf8d29058f8a5283bdc743b9965b5b5d2e69df9a9b6bb1b.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4540

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\a5bc6aad1c3205857cf8d29058f8a5283bdc743b9965b5b5d2e69df9a9b6bb1b.dll"
2⤵
- Loads dropped DLL
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 584
3⤵
- Program crash
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4852 -ip 4852
1⤵
PID:1676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a5bc6aad1c3205857cf8d29058f8a5283bdc743b9965b5b5d2e69df9a9b6bb1b.dll
Filesize
260KB

MD5
530b4966931ad18914fdf87fc8a8f713

SHA1
0becbe86863faa673acea89e29ae3fbe0bdefbcc

SHA256
8f1e37410b025c56bd0da4fade88f0c5d89368b6ba8c3b5c4fe09cd10935066e

SHA512
72828206761e7dd75d5da385ef514cc9550e8f2f15f040270458fba922cc6123a685d69ca08587c6f893c7dfac14b832cccc2b2c443f8ef916bff1d1ef63a70e

Download Submit
C:\Users\Admin\AppData\Local\Temp\a5bc6aad1c3205857cf8d29058f8a5283bdc743b9965b5b5d2e69df9a9b6bb1b.dll
Filesize
260KB

MD5
530b4966931ad18914fdf87fc8a8f713

SHA1
0becbe86863faa673acea89e29ae3fbe0bdefbcc

SHA256
8f1e37410b025c56bd0da4fade88f0c5d89368b6ba8c3b5c4fe09cd10935066e

SHA512
72828206761e7dd75d5da385ef514cc9550e8f2f15f040270458fba922cc6123a685d69ca08587c6f893c7dfac14b832cccc2b2c443f8ef916bff1d1ef63a70e

Download Submit
C:\Windows\INF\audioendpoint.PNF
Filesize
5KB

MD5
c846d81a5ff9c57611bd9bfda9f7e8b1

SHA1
8f75b0469b194194a7d6ebec207b8076de48d588

SHA256
c2cf15745458220b9af6942fd5114a1590af440be9551b80c5a19d110ff28a6a

SHA512
f6a35c386e79d80ad6f2f38f2dca0acd5296ed3454c2c5cdc1f1c5232868239c77bce349201c067bc5110ad45252bd0996d36dafabb66879b1867b56afe0743b

Download Submit
C:\Windows\INF\c_swdevice.PNF
Filesize
6KB

MD5
af582dd243956f076f0fbb0ce2ca3710

SHA1
3317a5133774b27a2b3da9831a615d9c32a1d6a7

SHA256
ed6d900fe81f39a09c099ea4890a6cdb9413f2de321f2b9e5a04aa65bf8b7049

SHA512
98bdd1f567e20b6b298f55c8e4ee4105752f8a31728ddffafaac2519cd238b62a831bf09702bf9dfa3d135ca3364f7a1f911e14076ba3e3a03bf93ef0743864c

Download Submit
C:\Windows\INF\cpu.PNF
Filesize
19KB

MD5
1108b3bc5b499c0120f9bf3a33e1d635

SHA1
ba4aca2bfd22c866607b2badf4c3d3f4504e846d

SHA256
4aea8b5250c80ac0d9bffc29299466abb388843b5393231cf6cf2d3955247dff

SHA512
d36813f97f8eef38163f521deb739dfccf88ead27f96ec98052a0c3555b10762872ea87680adb4e37c5e5a14cb87ea31b9d9c9cd6c7a9869719f14b81827c75d

Download Submit
C:\Windows\INF\printqueue.PNF
Filesize
7KB

MD5
6e3b1b8c33104124154ee771d8460aad

SHA1
a25551bc3b4eb2f81340fae42fa711cf758af2eb

SHA256
f51c4bd59b47c091aa6c05ce5cba399f7fa15ecec223f3d16cc373dfaa81e8e3

SHA512
ea48fd8e3babd54d9ad1415502c771ce084cbaf3c7e8d0f0e102fe53026659bf14090cdf0063a93c1780d628d3b7f246b18606d064b37f7242fd4fd66061431e

Download Submit
memory/2144-196-0x0000000000710000-0x0000000000731000-memory.dmp

Filesize
132KB

Download
memory/2144-197-0x0000000000710000-0x0000000000731000-memory.dmp

Filesize
132KB

Download
memory/2144-198-0x0000000000710000-0x0000000000731000-memory.dmp

Filesize
132KB

Download
memory/2144-200-0x0000000000710000-0x0000000000731000-memory.dmp

Filesize
132KB

Download
memory/2144-201-0x0000000000710000-0x0000000000731000-memory.dmp

Filesize
132KB

Download
memory/4272-133-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/4272-134-0x00000000008F0000-0x0000000000931000-memory.dmp

Filesize
260KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads