qakbot | b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7

Analysis

max time kernel
147s
max time network
121s
platform
windows7_x64
resource
win7-en-20210920
submitted
29/09/2021, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.test.dll
Size 448KB
Sample210929-nnad4aehem
SHA256 b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7
MD5 879628efe6fb566fc83cb019a4d90f5d
SHA1 b4eb4da4ed99f50c0e02b12c23b2ea65dceed706
SHA512 4c5ec0815de1112bc633afb96f50f03bc9506246ce1e4bc6aa8c5b6690941339b16a26f33f7999ba02dc5c460f846da51b4ed2a8f041a68c4bc8991fe2cd8a1c
MD5 SHA1 SHA512

Score

10^/10

qakbot tr 1632817399 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

Campaign

1632817399

105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
120.151.47.189:443
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
76.25.142.196:443
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
95.77.223.148:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
105.157.55.133:995
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
1100	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1468	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\80e7a5a8 = 89186d2ad4e72b7534c3597d039981493184b5cfc445f31445c085f9f347d6b11e7e375fd482a7ab3f5af6b0118c0259	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\45538d47 = 73e5003362edd4a88d5d5444b1f220ffcce0e13cf509216838df143e15ac2e50c0b788af0a6beba6f8e8a7678f66e327ddccc607cd175f19f56ef352d92450b6d835a93a996d63bb3143257349334931a89f84c539b3538f6c02367cee556c63a550	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\f8532ff = f4c55c6161d7ca200bd1249f64a8a10a328d423867e515dbab00ccab4f5135ed9d6dda206d2dc7c58a9e6b7d016b013ddc7ff92e1f13b4bfe2895cd288d14132931374da820c612948203682a6ff	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\f8532ff = f4c54b6161d7ff2d31b4d244bba2948911bc7abd67b4e55ce719087fae17977fc907bc9cfc4f045233da2e1ecf4c5185af5c43d09a04f91a95	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\3a1ae2b1 = edd30c108748106a1da4f9897e65739c5182e4921845b33f9c7a2b227e13167800fb0bb9f3922686010553f367e5e2d7bb6bdd12bbee04fe309345619b9f617d9a9682dae534559ae61540bf59711d5653a48fc651ff3c572e0f7228ef4ec1a248470c4bc3e11ae9b1bef1726b6ce6f1d9c63ac364f0eaf292beb2f86e69fc11dca8e9e5c112722ab4530e6e07016c98bff2c1d324ff48ffd24354545c7a2616a12093aad31468260ecf3d7f7a2053eb59f81c3774b8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\385bc2cd = b5125d23019854fc7de41e56640c9e73a4b3be7b686a4f8404e43c7ba67080877cbac089	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\70cc5d09 = 5456eda62c31974ce5318ef572b922c9394994876dbca8fa9ac29228cd2665b15dca96c096e8de90e4cb787ee0aede171a007d99306d9ec9903d0d54fe53f72be5474c2fadecb51bb34078dd395085b6790ad5369a21e1e3	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Alhlwgigbvlxnt	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\fdefea22 = 63982a3bd7d840d81a3595ac4bc530825b96d545868a0b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\82a685d4 = 80d9ef9bdbb0e69c230562b2e74eab34a5f5a502a11a22f68af2bb53a64fac	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2036	rundll32.exe
1100	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2036	rundll32.exe
1100	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2036	1740	rundll32.exe	27
PID 1740 wrote to memory of 2036	1740	rundll32.exe	27
PID 1740 wrote to memory of 2036	1740	rundll32.exe	27
PID 1740 wrote to memory of 2036	1740	rundll32.exe	27
PID 1740 wrote to memory of 2036	1740	rundll32.exe	27
PID 1740 wrote to memory of 2036	1740	rundll32.exe	27
PID 1740 wrote to memory of 2036	1740	rundll32.exe	27
PID 2036 wrote to memory of 1304	2036	rundll32.exe	28
PID 2036 wrote to memory of 1304	2036	rundll32.exe	28
PID 2036 wrote to memory of 1304	2036	rundll32.exe	28
PID 2036 wrote to memory of 1304	2036	rundll32.exe	28
PID 2036 wrote to memory of 1304	2036	rundll32.exe	28
PID 2036 wrote to memory of 1304	2036	rundll32.exe	28
PID 1304 wrote to memory of 1468	1304	explorer.exe	29
PID 1304 wrote to memory of 1468	1304	explorer.exe	29
PID 1304 wrote to memory of 1468	1304	explorer.exe	29
PID 1304 wrote to memory of 1468	1304	explorer.exe	29
PID 1244 wrote to memory of 1976	1244	taskeng.exe	34
PID 1244 wrote to memory of 1976	1244	taskeng.exe	34
PID 1244 wrote to memory of 1976	1244	taskeng.exe	34
PID 1244 wrote to memory of 1976	1244	taskeng.exe	34
PID 1244 wrote to memory of 1976	1244	taskeng.exe	34
PID 1976 wrote to memory of 1100	1976	regsvr32.exe	35
PID 1976 wrote to memory of 1100	1976	regsvr32.exe	35
PID 1976 wrote to memory of 1100	1976	regsvr32.exe	35
PID 1976 wrote to memory of 1100	1976	regsvr32.exe	35
PID 1976 wrote to memory of 1100	1976	regsvr32.exe	35
PID 1976 wrote to memory of 1100	1976	regsvr32.exe	35
PID 1976 wrote to memory of 1100	1976	regsvr32.exe	35
PID 1100 wrote to memory of 1760	1100	regsvr32.exe	36
PID 1100 wrote to memory of 1760	1100	regsvr32.exe	36
PID 1100 wrote to memory of 1760	1100	regsvr32.exe	36
PID 1100 wrote to memory of 1760	1100	regsvr32.exe	36
PID 1100 wrote to memory of 1760	1100	regsvr32.exe	36
PID 1100 wrote to memory of 1760	1100	regsvr32.exe	36
PID 1760 wrote to memory of 1872	1760	explorer.exe	37
PID 1760 wrote to memory of 1872	1760	explorer.exe	37
PID 1760 wrote to memory of 1872	1760	explorer.exe	37
PID 1760 wrote to memory of 1872	1760	explorer.exe	37
PID 1760 wrote to memory of 1076	1760	explorer.exe	39
PID 1760 wrote to memory of 1076	1760	explorer.exe	39
PID 1760 wrote to memory of 1076	1760	explorer.exe	39
PID 1760 wrote to memory of 1076	1760	explorer.exe	39

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vzalopx /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test.test.dll\"" /SC ONCE /Z /ST 11:34 /ET 11:46
      4⤵
      Creates scheduled task(s)
      PID:1468

C:\Windows\system32\taskeng.exe
taskeng.exe {86691066-81B0-4250-8192-EFCF26DC2DCD} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1760
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Kgaaen" /d "0"
        5⤵
        
        PID:1872
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Royuewjisul" /d "0"
        5⤵
        
        PID:1076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-75-0x0000000000140000-0x0000000000141000-memory.dmp

Download

memory/1100-70-0x0000000010000000-0x000000001007E000-memory.dmp

Download

memory/1304-59-0x00000000751B1000-0x00000000751B3000-memory.dmp

Download

memory/1304-62-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/1760-76-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/1976-64-0x000007FEFC461000-0x000007FEFC463000-memory.dmp

Download

memory/2036-61-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/2036-55-0x0000000010000000-0x0000000010021000-memory.dmp

Download

memory/2036-56-0x0000000010000000-0x000000001007E000-memory.dmp

Download

memory/2036-54-0x00000000765A1000-0x00000000765A3000-memory.dmp

Download