qakbot | b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7

General

Target
test.test.dll
Size 448KB
Sample210929-nnad4aehem
SHA256 b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7
MD5 879628efe6fb566fc83cb019a4d90f5d
SHA1 b4eb4da4ed99f50c0e02b12c23b2ea65dceed706
SHA512 4c5ec0815de1112bc633afb96f50f03bc9506246ce1e4bc6aa8c5b6690941339b16a26f33f7999ba02dc5c460f846da51b4ed2a8f041a68c4bc8991fe2cd8a1c
MD5 SHA1 SHA512

Score

10^/10

qakbot tr 1632817399 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1632817399

C2

105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
120.151.47.189:443
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
76.25.142.196:443
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
95.77.223.148:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
105.157.55.133:995
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
1924	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3864	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\550c72b9 = 6a524c0c9f8ae4ec322f68d5080068ff1a7b56b4d8b99773bf2f567ba271667ee70646c1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\edb015dc = 1a634982b53de5adca6fb20ded98a17ced507c0973c361b053bfb4fa68a0f5e9f0cba6de461ff27d37527c47a909c1231ac49d6377a98a4e33c214d3e45c52bbeefede1dd730f9a502ee	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\a766aa64 = fb9864db2436e53688d6ed6234abca81e9956e2b251a23835a60a1f4b7e2e6097238943946a947f95b77ee96fd9c315d1e68c0d7f3a3d4fa6174fd6eef4a7072c55d3dc076eeb4b8a508a41064c9d3763568fcfd3659e7b4235413b84b1a10f3ea067d722239460cf25b0a26df8820d8f348	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\a766aa64 = fb9873db2436d0478f09f802de0193d191b317bacd6f64064a4e2b71389581e7350a2dbca8edb5a822519b1084be0a3bb275ae9545fbdc64754115ec55fa479eb0493a1b2ede5e0cfdeff1ccef7aaa6cda9d70e524c36f695023e125d4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\92f97a2a = 3cdc49e1144eaeb99b3cdddb0d93012d26436eec0f55f29bd3efb3ed5cce0e814586b5ddd4a787c4e1deee43a7c8ffa8c0651f928855fac0af7354ea8f15c6101daf4e715e3cf322921cb530d758fa52ec5a981ebac66b22539d76fdd8ac62159ccdf98ffe95dc1fc0cc1e5f59a629d0e345a4b438ed8e86c27b85a4e0d01b320858fe50f96af4a2df745941fb48728b23db8c220ad370b347d7025712156b5b14ad54a9add5c5e6c43b31753e2d1e8169ab	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\28043d33 = 5939b4ea4e08153775e3add7f951cf7be96822c824e16e3fb19acaad6692071ce360358a0be45ca340413d08c32c764e389a875eedbff26e21ac2b167773bb87b779c4e88b268b283bec7fbfd2c44e02eef16a737a19c9a318fc0a954d3e13000d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\2a451d4f = 861e5898839edb03bbc7b54518d965bb85c13edf6909856b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\d82fc592 = e24bcad79d9fff19532ea6288b356b6078ef67ed33b3b3073093e56b11fe524dd4bcdb91966cfc2f9d666c212184264ac16c56c2c130bc9da660cf88157483929f6763dc26147d48a443ef01e561dfcfb094128419ef930ca8c0713f540dbcdfa4c39ef1c1a4	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\90b85a56 = e6e3634d7c24729ffefaa1e2a3120ea0	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3624	rundll32.exe
3624	rundll32.exe
1924	regsvr32.exe
1924	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3624	rundll32.exe
1924	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 3624	3464	rundll32.exe	70
PID 3464 wrote to memory of 3624	3464	rundll32.exe	70
PID 3464 wrote to memory of 3624	3464	rundll32.exe	70
PID 3624 wrote to memory of 3748	3624	rundll32.exe	71
PID 3624 wrote to memory of 3748	3624	rundll32.exe	71
PID 3624 wrote to memory of 3748	3624	rundll32.exe	71
PID 3624 wrote to memory of 3748	3624	rundll32.exe	71
PID 3624 wrote to memory of 3748	3624	rundll32.exe	71
PID 3748 wrote to memory of 3864	3748	explorer.exe	72
PID 3748 wrote to memory of 3864	3748	explorer.exe	72
PID 3748 wrote to memory of 3864	3748	explorer.exe	72
PID 4052 wrote to memory of 1924	4052	regsvr32.exe	77
PID 4052 wrote to memory of 1924	4052	regsvr32.exe	77
PID 4052 wrote to memory of 1924	4052	regsvr32.exe	77
PID 1924 wrote to memory of 4272	1924	regsvr32.exe	78
PID 1924 wrote to memory of 4272	1924	regsvr32.exe	78
PID 1924 wrote to memory of 4272	1924	regsvr32.exe	78
PID 1924 wrote to memory of 4272	1924	regsvr32.exe	78
PID 1924 wrote to memory of 4272	1924	regsvr32.exe	78
PID 4272 wrote to memory of 4264	4272	explorer.exe	79
PID 4272 wrote to memory of 4264	4272	explorer.exe	79
PID 4272 wrote to memory of 4468	4272	explorer.exe	82
PID 4272 wrote to memory of 4468	4272	explorer.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dhsdmtkgc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test.test.dll\"" /SC ONCE /Z /ST 11:34 /ET 11:46
      4⤵
      Creates scheduled task(s)
      PID:3864

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Idfooobflb" /d "0"
      4⤵
      PID:4264
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Iukdvyxbee" /d "0"
      4⤵
      PID:4468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-129-0x0000000003230000-0x0000000003231000-memory.dmp

Download

memory/1924-128-0x0000000010000000-0x000000001007E000-memory.dmp

Download

memory/3624-116-0x0000000010000000-0x0000000010021000-memory.dmp

Download

memory/3624-117-0x0000000010000000-0x000000001007E000-memory.dmp

Download

memory/3624-118-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/3748-123-0x00000000032B0000-0x00000000032D1000-memory.dmp

Download

memory/4272-135-0x00000000032B0000-0x00000000032D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads