qakbot | c15df67c119c2cfc7845a01f8a36f2b85612660b5464464c5be6370f9afaa173

General

Target

c15df67c119c2cfc7845a01f8a36f2b85612660b5464464c5be6370f9afaa173.dll
Size

293KB
MD5

52597bf4473f6f446102ea205f140321
SHA1

a7aa49955cd61157b29b1c61e194c814a90e6e14
SHA256

c15df67c119c2cfc7845a01f8a36f2b85612660b5464464c5be6370f9afaa173
SHA512

d88ce6df59c8c5bfa97cd9707636ec22bd95a58403694238b50192d74c83ba8de72d1cb032d3ba93c06cd235a824e63e1ef69ad41d9af6e3252dffeea5b0724b
SSDEEP

3072:025H3LUTyMW0L52JD6Z/7sg+9s07pxexALWmxhinnYfhRzl+K39bjXwHK7:02EV+ex7sg+JdxeK3zina9tbUHk

Score

10^/10

qakbot tr 1623837834 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.115

Botnet

tr

Campaign

1623837834

C2

144.139.47.206:443

105.198.236.101:443

136.232.34.70:443

90.65.234.26:2222

71.41.184.10:3389

98.192.185.86:443

184.185.103.157:443

24.179.77.236:443

81.97.154.100:443

186.144.33.73:443

96.253.46.210:443

213.122.113.120:443

47.22.148.6:443

149.28.99.97:995

45.63.107.192:2222

45.32.211.207:443

45.32.211.207:8443

149.28.98.196:995

45.63.107.192:995

45.77.115.208:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1676 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4088 1676 WerFault.exe regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4064 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4548 rundll32.exe
4548 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

4548 rundll32.exe

pid	process
1676	regsvr32.exe

pid	pid_target	process	target process
4088	1676	WerFault.exe	regsvr32.exe

pid	process
4064	schtasks.exe

pid	process
4548	rundll32.exe
4548	rundll32.exe

pid	process
4548	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 1844 wrote to memory of 4548	1844	rundll32.exe	rundll32.exe
PID 1844 wrote to memory of 4548	1844	rundll32.exe	rundll32.exe
PID 1844 wrote to memory of 4548	1844	rundll32.exe	rundll32.exe
PID 4548 wrote to memory of 3284	4548	rundll32.exe	explorer.exe
PID 4548 wrote to memory of 3284	4548	rundll32.exe	explorer.exe
PID 4548 wrote to memory of 3284	4548	rundll32.exe	explorer.exe
PID 4548 wrote to memory of 3284	4548	rundll32.exe	explorer.exe
PID 4548 wrote to memory of 3284	4548	rundll32.exe	explorer.exe
PID 3284 wrote to memory of 4064	3284	explorer.exe	schtasks.exe
PID 3284 wrote to memory of 4064	3284	explorer.exe	schtasks.exe
PID 3284 wrote to memory of 4064	3284	explorer.exe	schtasks.exe
PID 3740 wrote to memory of 1676	3740	regsvr32.exe	regsvr32.exe
PID 3740 wrote to memory of 1676	3740	regsvr32.exe	regsvr32.exe
PID 3740 wrote to memory of 1676	3740	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c15df67c119c2cfc7845a01f8a36f2b85612660b5464464c5be6370f9afaa173.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c15df67c119c2cfc7845a01f8a36f2b85612660b5464464c5be6370f9afaa173.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4548

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3284

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn igeiwkis /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\c15df67c119c2cfc7845a01f8a36f2b85612660b5464464c5be6370f9afaa173.dll\"" /SC ONCE /Z /ST 20:00 /ET 20:12
4⤵
- Creates scheduled task(s)
PID:4064

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\c15df67c119c2cfc7845a01f8a36f2b85612660b5464464c5be6370f9afaa173.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3740

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\c15df67c119c2cfc7845a01f8a36f2b85612660b5464464c5be6370f9afaa173.dll"
2⤵
- Loads dropped DLL
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 584
3⤵
- Program crash
PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1676 -ip 1676
1⤵
PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c15df67c119c2cfc7845a01f8a36f2b85612660b5464464c5be6370f9afaa173.dll
Filesize
293KB

MD5
65cc8a9c47c56e72d09447ebd1347d86

SHA1
6aec51bd8474a2c24798343d899ba7dcd4c3e4a7

SHA256
2cca5fee18d989de733da966f4be6399d5d7b076beecf78918a1a4ec0c6ba6a5

SHA512
9ea0ba2a1446bce5abc70771be921bafb3165413119ee30ff02342d57f714b5119d3194cdf7e9cb13ebb55a3896580bfc6fdad1ecf060b43b6c5bba3c1e6c5e5

Download Submit
memory/1676-15-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/3284-7-0x00000000005D0000-0x00000000005FF000-memory.dmp

Filesize
188KB

Download
memory/3284-4-0x0000000000D60000-0x0000000001193000-memory.dmp

Filesize
4.2MB

Download
memory/3284-5-0x00000000005D0000-0x00000000005FF000-memory.dmp

Filesize
188KB

Download
memory/3284-8-0x00000000005D0000-0x00000000005FF000-memory.dmp

Filesize
188KB

Download
memory/3284-9-0x00000000005D0000-0x00000000005FF000-memory.dmp

Filesize
188KB

Download
memory/3284-10-0x00000000005D0000-0x00000000005FF000-memory.dmp

Filesize
188KB

Download
memory/3284-11-0x00000000005D0000-0x00000000005FF000-memory.dmp

Filesize
188KB

Download
memory/4548-3-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/4548-0-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/4548-2-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/4548-1-0x0000000000E30000-0x0000000000E6A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads