qakbot | 6291d059d56d530c4921f92f00d23a7dde944996576098b540719727845aa122

General

Target

6291d059d56d530c4921f92f00d23a7dde944996576098b540719727845aa122.dll
Size

1.2MB
MD5

8bb2ab310db3b1076866f587bae6e48b
SHA1

ee5e3261fc1fab1cb0fce2c880afd2b3647dc8d6
SHA256

6291d059d56d530c4921f92f00d23a7dde944996576098b540719727845aa122
SHA512

b08b5920123ab9370bd538656a1886c2f9b7cee42514cc0a98c782318f72ea5f5146451dfb7786b2f6d74d14c552d833886a8af10823bc5c8c2c69026f5fbe71
SSDEEP

12288:SEYVEf452qDieCsSv3acLlAIJlVgK7h2GAffhsHmN0ZVR1Ox3LLo/itCqVECqVES:PcYwIeQHR/xEVnhzgq33o/

Score

10^/10

qakbot biden12 1615580905 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.194

Botnet

biden12

Campaign

1615580905

C2

24.229.150.54:995

109.12.111.14:443

173.21.10.71:2222

81.214.126.173:2222

75.118.1.141:443

98.252.118.134:443

71.74.12.34:443

186.31.77.42:443

81.97.154.100:443

71.117.132.169:443

24.139.72.117:443

67.165.206.193:993

106.51.52.111:443

47.196.192.184:443

71.197.126.250:443

24.95.61.62:443

47.22.148.6:443

195.12.154.8:443

71.163.223.159:443

197.45.110.165:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2460 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2600 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2740 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2740 rundll32.exe

pid	process
2460	regsvr32.exe

pid	process
2600	schtasks.exe

pid	process
2740	rundll32.exe

pid	process
2740	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 2480 wrote to memory of 2740	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 2740	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 2740	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 2740	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 2740	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 2740	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 2740	2480	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 2108	2740	rundll32.exe	explorer.exe
PID 2740 wrote to memory of 2108	2740	rundll32.exe	explorer.exe
PID 2740 wrote to memory of 2108	2740	rundll32.exe	explorer.exe
PID 2740 wrote to memory of 2108	2740	rundll32.exe	explorer.exe
PID 2740 wrote to memory of 2108	2740	rundll32.exe	explorer.exe
PID 2740 wrote to memory of 2108	2740	rundll32.exe	explorer.exe
PID 2108 wrote to memory of 2600	2108	explorer.exe	schtasks.exe
PID 2108 wrote to memory of 2600	2108	explorer.exe	schtasks.exe
PID 2108 wrote to memory of 2600	2108	explorer.exe	schtasks.exe
PID 2108 wrote to memory of 2600	2108	explorer.exe	schtasks.exe
PID 1788 wrote to memory of 1240	1788	taskeng.exe	regsvr32.exe
PID 1788 wrote to memory of 1240	1788	taskeng.exe	regsvr32.exe
PID 1788 wrote to memory of 1240	1788	taskeng.exe	regsvr32.exe
PID 1788 wrote to memory of 1240	1788	taskeng.exe	regsvr32.exe
PID 1788 wrote to memory of 1240	1788	taskeng.exe	regsvr32.exe
PID 1240 wrote to memory of 2460	1240	regsvr32.exe	regsvr32.exe
PID 1240 wrote to memory of 2460	1240	regsvr32.exe	regsvr32.exe
PID 1240 wrote to memory of 2460	1240	regsvr32.exe	regsvr32.exe
PID 1240 wrote to memory of 2460	1240	regsvr32.exe	regsvr32.exe
PID 1240 wrote to memory of 2460	1240	regsvr32.exe	regsvr32.exe
PID 1240 wrote to memory of 2460	1240	regsvr32.exe	regsvr32.exe
PID 1240 wrote to memory of 2460	1240	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6291d059d56d530c4921f92f00d23a7dde944996576098b540719727845aa122.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6291d059d56d530c4921f92f00d23a7dde944996576098b540719727845aa122.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bhmccgeda /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\6291d059d56d530c4921f92f00d23a7dde944996576098b540719727845aa122.dll\"" /SC ONCE /Z /ST 22:26 /ET 22:38
4⤵
- Creates scheduled task(s)
PID:2600

C:\Windows\system32\taskeng.exe
taskeng.exe {7037B79E-39B5-4B3B-BF73-4260D887751F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\6291d059d56d530c4921f92f00d23a7dde944996576098b540719727845aa122.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\6291d059d56d530c4921f92f00d23a7dde944996576098b540719727845aa122.dll"
3⤵
- Loads dropped DLL
PID:2460

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6291d059d56d530c4921f92f00d23a7dde944996576098b540719727845aa122.dll
Filesize
1.2MB

MD5
ab51d3969c5a00c5fca9fa39c35ce88f

SHA1
06797d36cead474c1ff21776963bfff263208fc7

SHA256
47396aea444d7fd8d3fd2610ad3021fd26bfb78b02f9df2bcf21ee648c99fdf3

SHA512
3791d42f1e59c476a67f58f05e44fcee619dbdb1831d5e8fe37ba065a110e1f69f98f301feb5c6935e9ab3377190a2edd19374089f91c0e86cf8a0b785abc087

Download Submit
memory/2108-9-0x0000000000080000-0x00000000000BB000-memory.dmp

Filesize
236KB

Download
memory/2108-15-0x0000000000080000-0x00000000000BB000-memory.dmp

Filesize
236KB

Download
memory/2108-13-0x0000000000080000-0x00000000000BB000-memory.dmp

Filesize
236KB

Download
memory/2108-12-0x0000000000080000-0x00000000000BB000-memory.dmp

Filesize
236KB

Download
memory/2108-5-0x00000000000C0000-0x00000000000C2000-memory.dmp

Filesize
8KB

Download
memory/2108-11-0x0000000000080000-0x00000000000BB000-memory.dmp

Filesize
236KB

Download
memory/2740-3-0x0000000000770000-0x00000000007AB000-memory.dmp

Filesize
236KB

Download
memory/2740-7-0x0000000000900000-0x0000000000A31000-memory.dmp

Filesize
1.2MB

Download
memory/2740-8-0x0000000000770000-0x00000000007AB000-memory.dmp

Filesize
236KB

Download
memory/2740-4-0x0000000000260000-0x0000000000299000-memory.dmp

Filesize
228KB

Download
memory/2740-0-0x0000000000900000-0x0000000000A31000-memory.dmp

Filesize
1.2MB

Download
memory/2740-2-0x0000000000770000-0x00000000007AB000-memory.dmp

Filesize
236KB

Download
memory/2740-1-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads