qakbot | 336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da

General

Target

test.test.dll
Size

833KB
MD5

97406f2cee93cdb660848c99e6d291e6
SHA1

17aa4ce85e931fdf383b864144a3c1b6e68f91e2
SHA256

336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da
SHA512

4884d65111c7da44832d30eb0cd7bcee9aceb6de24a610eb0709960d1276ad963214b8c620b14960a43319b0d77da7af3f622a5d6f1d36f31190ac2c641be4ef

Score

10^/10

qakbot tr 1632730751 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

tr

Campaign

1632730751

C2

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

972 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2680 schtasks.exe

pid	process
972	regsvr32.exe

pid	process
2680	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gaehiqqtokdbji\2b9299b6 = 79f4d77769a1f5891a97bdaadb3fcc7f367c7339fb5700e1ca0b9bdbbeca8bf88c27e0038bcfe13bbe5775945e32e17972e03b067cb44366e0a3eb8eb17037a61ae620dd9e6a37f0544cbbcea8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gaehiqqtokdbji\1e0d49f8 = a00061f577adbf04eb2a3c89461837a4250f0bbd54e5ddb1f970477cf03f51d64c9c0f096698cda0961936b36540a3df2ec01454deaabb448ac2dee0ff83d807f8776d12c958ce2f6d17a21c155e40135ec282cce52b31f43ad238b83509422517bad6c13c1494722c9f673b190110e181a8793b373a6b17b03799c6529489000d14	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gaehiqqtokdbji\a4f00ee1 = f24c6f8cdbea236fd7782fd46240fb547cd4669ae1bdd5f9364b7a8f9120b73d24f61b0e23eaf2da4055792e9b9fc83d0dec7c262b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gaehiqqtokdbji\d9f8416b = 269391a1777b6c53c2a1fcbe22e94983c35b7f45bf20a1d0ea2c060585d9a4ffc97689eabf07ba0ac1933e03413a540c8a132ec5772b47159395fd8abf10f92b10b3b3d7006c091f25	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gaehiqqtokdbji\54dbf640 = c1039c16c60f22033cf1dbfc4ea86e352fdb87d3acd40ab60aea4a2e7d22ccbdfdbfa066f5395dc7e3c63b4980135951982344a5419447d4ec9c940fba7f10ce3c47579f9f8891722ceaa48b13a043d84023fb77cb9fce9c17	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gaehiqqtokdbji\2b9299b6 = 79f4c07769a1c0770f7303e54c39b5eb1f41360434824aa1f05b86c1bd4f7be21f9695727f5f51b22c9d9bf1a49e8d80b90f1d273ece1b1bcfb4a44b106687d74f9f06a61e7da54712b33714161ef01e569551d759806362dd18cedcd030f519fb0f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gaehiqqtokdbji	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gaehiqqtokdbji\6144260e = 91bba3f616dda5c30d1d781871749d4ebe43ff29067d57893dc34a9cc8679fd6afabff9e63a2fc9c0661d353851fdcf95f1aa1118f2f28d51300d5272193a7e087fea47e6357c4bfb0d4314fc28790bd8e5709c63ef04186df774962ebf5b27d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gaehiqqtokdbji\a6b12e9d = 6a11f0d227cded9401f81a74a2abae45b37bce266c43730ddf926521f403f146ddd93972a4ff516a6e147a51f40a13374412c49c7b94f52fbb34d4d70d9a752bb09e8e5d7bf20ef2059feb20593e06822e23d0fbc38a9252053e68240709dad42653	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gaehiqqtokdbji\1c4c6984 = b9fae511d784c24c6510bd16da082ff2a7ceb474d6a2439f7eeeaaa85149cb85bcc354ed2eefe2f7e81910711f68509289a8dcf7d08b2d25d007fd1babbeb3fa3ab7d57f653145a440f75c350ca1a8	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2192 rundll32.exe
2192 rundll32.exe
972 regsvr32.exe
972 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2192 rundll32.exe
972 regsvr32.exe

pid	process
2192	rundll32.exe
2192	rundll32.exe
972	regsvr32.exe
972	regsvr32.exe

pid	process
2192	rundll32.exe
972	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2072 wrote to memory of 2192	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 2192	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 2192	2072	rundll32.exe	rundll32.exe
PID 2192 wrote to memory of 2500	2192	rundll32.exe	explorer.exe
PID 2192 wrote to memory of 2500	2192	rundll32.exe	explorer.exe
PID 2192 wrote to memory of 2500	2192	rundll32.exe	explorer.exe
PID 2192 wrote to memory of 2500	2192	rundll32.exe	explorer.exe
PID 2192 wrote to memory of 2500	2192	rundll32.exe	explorer.exe
PID 2500 wrote to memory of 2680	2500	explorer.exe	schtasks.exe
PID 2500 wrote to memory of 2680	2500	explorer.exe	schtasks.exe
PID 2500 wrote to memory of 2680	2500	explorer.exe	schtasks.exe
PID 1104 wrote to memory of 972	1104	regsvr32.exe	regsvr32.exe
PID 1104 wrote to memory of 972	1104	regsvr32.exe	regsvr32.exe
PID 1104 wrote to memory of 972	1104	regsvr32.exe	regsvr32.exe
PID 972 wrote to memory of 3564	972	regsvr32.exe	explorer.exe
PID 972 wrote to memory of 3564	972	regsvr32.exe	explorer.exe
PID 972 wrote to memory of 3564	972	regsvr32.exe	explorer.exe
PID 972 wrote to memory of 3564	972	regsvr32.exe	explorer.exe
PID 972 wrote to memory of 3564	972	regsvr32.exe	explorer.exe
PID 3564 wrote to memory of 844	3564	explorer.exe	reg.exe
PID 3564 wrote to memory of 844	3564	explorer.exe	reg.exe
PID 3564 wrote to memory of 1908	3564	explorer.exe	reg.exe
PID 3564 wrote to memory of 1908	3564	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2192

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2500

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bkuaadxv /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test.test.dll\"" /SC ONCE /Z /ST 13:13 /ET 13:25
4⤵
- Creates scheduled task(s)
PID:2680

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:972

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3564

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Muxnpibpks" /d "0"
4⤵
PID:844

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Hztooqixfr" /d "0"
4⤵
PID:1908

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test.test.dll
MD5
97406f2cee93cdb660848c99e6d291e6

SHA1
17aa4ce85e931fdf383b864144a3c1b6e68f91e2

SHA256
336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da

SHA512
4884d65111c7da44832d30eb0cd7bcee9aceb6de24a610eb0709960d1276ad963214b8c620b14960a43319b0d77da7af3f622a5d6f1d36f31190ac2c641be4ef

Download Submit
\Users\Admin\AppData\Local\Temp\test.test.dll
MD5
97406f2cee93cdb660848c99e6d291e6

SHA1
17aa4ce85e931fdf383b864144a3c1b6e68f91e2

SHA256
336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da

SHA512
4884d65111c7da44832d30eb0cd7bcee9aceb6de24a610eb0709960d1276ad963214b8c620b14960a43319b0d77da7af3f622a5d6f1d36f31190ac2c641be4ef

Download Submit
memory/844-131-0x0000000000000000-mapping.dmp

Download
memory/972-129-0x0000000000B40000-0x0000000000BEE000-memory.dmp

Filesize
696KB

Download
memory/972-125-0x0000000000000000-mapping.dmp

Download
memory/972-128-0x0000000072E90000-0x0000000072FF8000-memory.dmp

Filesize
1.4MB

Download
memory/972-127-0x0000000072E90000-0x0000000072EB1000-memory.dmp

Filesize
132KB

Download
memory/1908-132-0x0000000000000000-mapping.dmp

Download
memory/2192-118-0x0000000002A20000-0x0000000002A21000-memory.dmp

Filesize
4KB

Download
memory/2192-117-0x00000000741A0000-0x0000000074308000-memory.dmp

Filesize
1.4MB

Download
memory/2192-115-0x0000000000000000-mapping.dmp

Download
memory/2192-116-0x00000000741A0000-0x00000000741C1000-memory.dmp

Filesize
132KB

Download
memory/2500-119-0x0000000000000000-mapping.dmp

Download
memory/2500-123-0x0000000002A10000-0x0000000002A31000-memory.dmp

Filesize
132KB

Download
memory/2680-120-0x0000000000000000-mapping.dmp

Download
memory/3564-130-0x0000000000000000-mapping.dmp

Download
memory/3564-134-0x00000000031D0000-0x00000000031D1000-memory.dmp

Filesize
4KB

Download
memory/3564-135-0x0000000002EE0000-0x0000000002F01000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads