qakbot | 336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da

General

Target

test.test.dll
Size

833KB
MD5

97406f2cee93cdb660848c99e6d291e6
SHA1

17aa4ce85e931fdf383b864144a3c1b6e68f91e2
SHA256

336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da
SHA512

4884d65111c7da44832d30eb0cd7bcee9aceb6de24a610eb0709960d1276ad963214b8c620b14960a43319b0d77da7af3f622a5d6f1d36f31190ac2c641be4ef

Score

10^/10

qakbot tr 1632730751 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

tr

Campaign

1632730751

C2

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1792 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1648 schtasks.exe

pid	process
1792	regsvr32.exe

pid	process
1648	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zuyyuiyfa\6c7b658f = b36313675a5549b0a03a6a5689067aa8cbaf7993963c7a2ec0ab576a5438e1df2b482ae14efbb764be	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zuyyuiyfa\d4c702ea = 9f8703cc40deb73fa5277c1c10bf6dcf241de1c3f000a1461e2c78ca359f5ff41530180d25125bc02d3e1e765552d42010023e428ef98bba4a8c5be0d7a6f87f09fbed866c748cba922a09a6fbf3598ae7023ea1d75c8f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zuyyuiyfa\a9cf4d60 = fe10aa9c4c4b96b8a636ecb3e6fd0e323186d15c0959103857452a6afa581a773acf4fb5554a1065131d0d05e7d82abcd303913c8d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zuyyuiyfa\5ba595bd = f6888e7459499345ec4c5bd95eb54a18e5621223ae2e784894c2ab279fb5b2da5ac80e1d11fee54471d42dfc86585d5b959c108e86bb6f6ed473ac99112f3c98675703d7866f89c368844132bbec50bc3aab35d9e265cf9407099ac0004c1f735779c09b1d6af286ca30f9594c73d1f35a59025415819489790755fd67	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zuyyuiyfa	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zuyyuiyfa\6e3a45f3 = df906ab696139d64058082b59d4cc8bd5dbb1b3583b7f09516d252a6e957d7dd565943865e6494e8091a42db337dac8255f1a26121353c9d5a2418f36404ebbd606a81adf159eaf461df94cd6b25e23a0913d118361c40b6d549d234ac7c8053a7ee2059db46887d6b9f5c297b516225681416e3287afbc3f2e81d9d4712fa9ddbc78ba6aef6b2330d1117cc39d1296aa463a67fe52c0e95af39909aab	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zuyyuiyfa\d6862296 = e180530d2af6157aa4c0716e82a05e9aa6c1761fac307e0be002a968d5fe43a186f5ab0c91771eecc2f85533c378c7a52f08e817fe22e64663fcd6ac587d077ca0d34d8b8fb3c82946dec671769e745de7eb391195f9ddf4f5aa53cdb6cfca49dd97bf128c5c17f652ed	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zuyyuiyfa\24ecfa4b = 21b6cb6a31f0fd23cedf69622422e131c0ee8b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zuyyuiyfa\5ba595bd = f68899745949a6dbaf39db68c8dfe68fbbf017932f260dc2e0a2bea68963ca94274b92907d338baed73f4dade9a23ed85dd7a031259fbc325287b09351f6c6db0699d9d843a42cf9f9794fe572fc6b3ca22df01bc5fb6ee44bf35d5ccf4389e4f19d093ba5209f51	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zuyyuiyfa\11732a05 = f582bfab76cc398ad1eaa41084eae90c89e42da71c	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

268 rundll32.exe
1792 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

268 rundll32.exe
1792 regsvr32.exe

pid	process
268	rundll32.exe
1792	regsvr32.exe

pid	process
268	rundll32.exe
1792	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 520 wrote to memory of 268	520	rundll32.exe	rundll32.exe
PID 520 wrote to memory of 268	520	rundll32.exe	rundll32.exe
PID 520 wrote to memory of 268	520	rundll32.exe	rundll32.exe
PID 520 wrote to memory of 268	520	rundll32.exe	rundll32.exe
PID 520 wrote to memory of 268	520	rundll32.exe	rundll32.exe
PID 520 wrote to memory of 268	520	rundll32.exe	rundll32.exe
PID 520 wrote to memory of 268	520	rundll32.exe	rundll32.exe
PID 268 wrote to memory of 1672	268	rundll32.exe	explorer.exe
PID 268 wrote to memory of 1672	268	rundll32.exe	explorer.exe
PID 268 wrote to memory of 1672	268	rundll32.exe	explorer.exe
PID 268 wrote to memory of 1672	268	rundll32.exe	explorer.exe
PID 268 wrote to memory of 1672	268	rundll32.exe	explorer.exe
PID 268 wrote to memory of 1672	268	rundll32.exe	explorer.exe
PID 1672 wrote to memory of 1648	1672	explorer.exe	schtasks.exe
PID 1672 wrote to memory of 1648	1672	explorer.exe	schtasks.exe
PID 1672 wrote to memory of 1648	1672	explorer.exe	schtasks.exe
PID 1672 wrote to memory of 1648	1672	explorer.exe	schtasks.exe
PID 1424 wrote to memory of 1784	1424	taskeng.exe	regsvr32.exe
PID 1424 wrote to memory of 1784	1424	taskeng.exe	regsvr32.exe
PID 1424 wrote to memory of 1784	1424	taskeng.exe	regsvr32.exe
PID 1424 wrote to memory of 1784	1424	taskeng.exe	regsvr32.exe
PID 1424 wrote to memory of 1784	1424	taskeng.exe	regsvr32.exe
PID 1784 wrote to memory of 1792	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1792	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1792	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1792	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1792	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1792	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1792	1784	regsvr32.exe	regsvr32.exe
PID 1792 wrote to memory of 112	1792	regsvr32.exe	explorer.exe
PID 1792 wrote to memory of 112	1792	regsvr32.exe	explorer.exe
PID 1792 wrote to memory of 112	1792	regsvr32.exe	explorer.exe
PID 1792 wrote to memory of 112	1792	regsvr32.exe	explorer.exe
PID 1792 wrote to memory of 112	1792	regsvr32.exe	explorer.exe
PID 1792 wrote to memory of 112	1792	regsvr32.exe	explorer.exe
PID 112 wrote to memory of 752	112	explorer.exe	reg.exe
PID 112 wrote to memory of 752	112	explorer.exe	reg.exe
PID 112 wrote to memory of 752	112	explorer.exe	reg.exe
PID 112 wrote to memory of 752	112	explorer.exe	reg.exe
PID 112 wrote to memory of 1928	112	explorer.exe	reg.exe
PID 112 wrote to memory of 1928	112	explorer.exe	reg.exe
PID 112 wrote to memory of 1928	112	explorer.exe	reg.exe
PID 112 wrote to memory of 1928	112	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:520

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn myyohzekq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test.test.dll\"" /SC ONCE /Z /ST 15:14 /ET 15:26
4⤵
- Creates scheduled task(s)
PID:1648

C:\Windows\system32\taskeng.exe
taskeng.exe {9CAECFE2-5A33-40CA-9499-BA0D65A2186A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:112

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Rnsvmwggobs" /d "0"
5⤵
PID:752

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Aqtxepaurxii" /d "0"
5⤵
PID:1928

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test.test.dll
MD5
97406f2cee93cdb660848c99e6d291e6

SHA1
17aa4ce85e931fdf383b864144a3c1b6e68f91e2

SHA256
336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da

SHA512
4884d65111c7da44832d30eb0cd7bcee9aceb6de24a610eb0709960d1276ad963214b8c620b14960a43319b0d77da7af3f622a5d6f1d36f31190ac2c641be4ef

Download Submit
\Users\Admin\AppData\Local\Temp\test.test.dll
MD5
97406f2cee93cdb660848c99e6d291e6

SHA1
17aa4ce85e931fdf383b864144a3c1b6e68f91e2

SHA256
336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da

SHA512
4884d65111c7da44832d30eb0cd7bcee9aceb6de24a610eb0709960d1276ad963214b8c620b14960a43319b0d77da7af3f622a5d6f1d36f31190ac2c641be4ef

Download Submit
memory/112-77-0x0000000000000000-mapping.dmp

Download
memory/112-81-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/268-60-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/268-61-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/268-62-0x0000000074BD0000-0x0000000074BF1000-memory.dmp

Filesize
132KB

Download
memory/268-63-0x0000000074BD0000-0x0000000074D38000-memory.dmp

Filesize
1.4MB

Download
memory/268-59-0x0000000000000000-mapping.dmp

Download
memory/752-82-0x0000000000000000-mapping.dmp

Download
memory/1648-68-0x0000000000000000-mapping.dmp

Download
memory/1672-67-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1672-66-0x0000000074A61000-0x0000000074A63000-memory.dmp

Filesize
8KB

Download
memory/1672-64-0x0000000000000000-mapping.dmp

Download
memory/1784-70-0x000007FEFBEA1000-0x000007FEFBEA3000-memory.dmp

Filesize
8KB

Download
memory/1784-69-0x0000000000000000-mapping.dmp

Download
memory/1792-76-0x0000000074190000-0x00000000742F8000-memory.dmp

Filesize
1.4MB

Download
memory/1792-75-0x0000000074190000-0x00000000741B1000-memory.dmp

Filesize
132KB

Download
memory/1792-80-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1792-72-0x0000000000000000-mapping.dmp

Download
memory/1928-83-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads