qakbot | 9019cb133061aa1cbc767b73f22d01bae3d2241978557cea4889fc484e9719f0

General

Target

9aacffe08f5bf96a8e96214021094a80N.dll
Size

1.5MB
MD5

9aacffe08f5bf96a8e96214021094a80
SHA1

65d2569e8dafc1cf990c8c2d4605078980630847
SHA256

9019cb133061aa1cbc767b73f22d01bae3d2241978557cea4889fc484e9719f0
SHA512

a40219316089558b3d8c38c4ec3220e593818df0feef9ef505662baf818bd6f2c16d081f8b40c10142e22e500d4cf8b63a58b386cb3f23b321eda12af911df07
SSDEEP

6144:YFjeFW6wiDwJ8pFAhp7Lyf/8c/28AH7O8zu/Ab2:YFj36NpFAXW8cOs

Score

10^/10

qakbot abc118 1611065943 banker discovery stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

abc118

Campaign

1611065943

C2

172.87.157.235:3389

193.248.221.184:2222

208.126.142.17:443

108.31.15.10:995

78.63.226.32:443

67.6.91.75:443

209.210.187.52:995

173.18.126.193:2222

83.110.12.140:2222

50.244.112.106:443

71.117.132.169:443

216.201.162.158:443

90.175.88.99:2222

84.72.35.226:443

85.52.72.32:2222

89.3.198.238:443

140.82.49.12:443

95.76.27.6:443

24.229.150.54:995

202.185.138.143:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2916 regsvr32.exe

pid	process
2916	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rundll32.exeexplorer.exeschtasks.exeregsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2320 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2244 rundll32.exe
2244 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2244 rundll32.exe

pid	process
2320	schtasks.exe

pid	process
2244	rundll32.exe
2244	rundll32.exe

pid	process
2244	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 1560 wrote to memory of 2244	1560	rundll32.exe	rundll32.exe
PID 1560 wrote to memory of 2244	1560	rundll32.exe	rundll32.exe
PID 1560 wrote to memory of 2244	1560	rundll32.exe	rundll32.exe
PID 1560 wrote to memory of 2244	1560	rundll32.exe	rundll32.exe
PID 1560 wrote to memory of 2244	1560	rundll32.exe	rundll32.exe
PID 1560 wrote to memory of 2244	1560	rundll32.exe	rundll32.exe
PID 1560 wrote to memory of 2244	1560	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 1780	2244	rundll32.exe	explorer.exe
PID 2244 wrote to memory of 1780	2244	rundll32.exe	explorer.exe
PID 2244 wrote to memory of 1780	2244	rundll32.exe	explorer.exe
PID 2244 wrote to memory of 1780	2244	rundll32.exe	explorer.exe
PID 2244 wrote to memory of 1780	2244	rundll32.exe	explorer.exe
PID 2244 wrote to memory of 1780	2244	rundll32.exe	explorer.exe
PID 1780 wrote to memory of 2320	1780	explorer.exe	schtasks.exe
PID 1780 wrote to memory of 2320	1780	explorer.exe	schtasks.exe
PID 1780 wrote to memory of 2320	1780	explorer.exe	schtasks.exe
PID 1780 wrote to memory of 2320	1780	explorer.exe	schtasks.exe
PID 1520 wrote to memory of 2928	1520	taskeng.exe	regsvr32.exe
PID 1520 wrote to memory of 2928	1520	taskeng.exe	regsvr32.exe
PID 1520 wrote to memory of 2928	1520	taskeng.exe	regsvr32.exe
PID 1520 wrote to memory of 2928	1520	taskeng.exe	regsvr32.exe
PID 1520 wrote to memory of 2928	1520	taskeng.exe	regsvr32.exe
PID 2928 wrote to memory of 2916	2928	regsvr32.exe	regsvr32.exe
PID 2928 wrote to memory of 2916	2928	regsvr32.exe	regsvr32.exe
PID 2928 wrote to memory of 2916	2928	regsvr32.exe	regsvr32.exe
PID 2928 wrote to memory of 2916	2928	regsvr32.exe	regsvr32.exe
PID 2928 wrote to memory of 2916	2928	regsvr32.exe	regsvr32.exe
PID 2928 wrote to memory of 2916	2928	regsvr32.exe	regsvr32.exe
PID 2928 wrote to memory of 2916	2928	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9aacffe08f5bf96a8e96214021094a80N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9aacffe08f5bf96a8e96214021094a80N.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zsjnuqcq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9aacffe08f5bf96a8e96214021094a80N.dll\"" /SC ONCE /Z /ST 03:59 /ET 04:11
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2320

C:\Windows\system32\taskeng.exe
taskeng.exe {51C20809-6FDB-421C-A1E4-B39F7C41090F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9aacffe08f5bf96a8e96214021094a80N.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\9aacffe08f5bf96a8e96214021094a80N.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9aacffe08f5bf96a8e96214021094a80N.dll

Filesize
1.5MB

MD5
926ba6aca2deac89d49b680f3451b550

SHA1
ba517b6829dc0eb8c25de679612537cc28c8d8e3

SHA256
e428055315159f2368799c93ac4f04895b0e6951e30eb74dab8018909af74317

SHA512
8997ceae7b9866629cf6f90456d89be0c5d8a4ed26cd4a7278f4b257e0cf7116ca553f685be64995202070b3fcfaa7b48e4f93f1bc34818f66a3dd68ed883e9b

Download Submit
memory/1780-2-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/1780-3-0x00000000000D0000-0x0000000000105000-memory.dmp

Filesize
212KB

Download
memory/1780-6-0x00000000000D0000-0x0000000000105000-memory.dmp

Filesize
212KB

Download
memory/1780-8-0x00000000000D0000-0x0000000000105000-memory.dmp

Filesize
212KB

Download
memory/1780-7-0x00000000000D0000-0x0000000000105000-memory.dmp

Filesize
212KB

Download
memory/1780-10-0x00000000000D0000-0x0000000000105000-memory.dmp

Filesize
212KB

Download
memory/2244-0-0x0000000000210000-0x0000000000243000-memory.dmp

Filesize
204KB

Download
memory/2244-1-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/2244-5-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads