qakbot | 2386996976337ff4bc0e5624822dcc7bd97d847b0e546f58068c35c1808276b0

General

Target

test.test.dll
Size

463KB
MD5

09a0006a40e28e19088a28f94cb97ac6
SHA1

00689427c38d38c5f15e809ec32b4f694a354faf
SHA256

2386996976337ff4bc0e5624822dcc7bd97d847b0e546f58068c35c1808276b0
SHA512

0dcb2c1b5842a1b77a70b42aaa54900ef5d6a978658993b3f2d8b8f96a679c0c48b03b46a0cbf5b456941630aec97db04352e62cbd43918a0fc4bcec025995c4

Score

10^/10

qakbot tr 1632817399 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1632817399

C2

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

181.118.183.94:443

120.150.218.241:995

185.250.148.74:443

95.77.223.148:443

75.66.88.33:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3980 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3168 schtasks.exe

pid	process
3980	regsvr32.exe

pid	process
3168	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Odywghmxt\a0d4deb7 = 5eb7a1194f3c1b4d67f8c8c0a69986ab6cd041ca6ab0a54001943b91a056c3e12d1ea60ab03bd969b006ed35	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Odywghmxt\52be066a = 3e05425b86e6106cbe04e88f690d4b6ba31b999230f31b35	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Odywghmxt\ea02610f = bc666954a5d413b7132878e38c8f731f38276e04bdf367c0e9afc7e4ffd975aecc477d838bad431204920bb2d440	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Odywghmxt\2df7699c = 85c1174298b4242f97598f752355fcda9c25c2c15e25f008b659663f926e85aa8312a42fc67623a34402f87a09440e983e03eea6e0649722eda0b2441d366cb59680136392a1abd154be362c9e5ef406c005c9022fd69b5ed40ae562ba1e0b68d169313c0670c57759b0f50e2c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Odywghmxt\df9db141 = 28a95854fef55dafc22049298b717cd5deb99fdb6b2ec31b2493c97232b7af60b159c53055ea945d295656032734fbc7cb13c2d001bfc77e4ac1a5b591f711efd6b27ebb80bf2c61c13e74211e1ac1c9448848279f2dd9b81bf51de65f3efdd2225f1d91b4ef81718024	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Odywghmxt	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Odywghmxt\954b0ef9 = aabc9c2a4c1d9101662d00600202cbc20101870d29705b993098d82944f755e113d94c052904f1456e76d2ce32c7f6174a7c95a130df525aae08eaad97f083ef7d5b12fcac9cf6bd927b092625f150630e50532a436b43021791d47b98d7851600c75162dffe97f27628cf471bb3dc287799ca222a98f588d4880c35a6f18990b24de9bc2cba7382d590d3c6df5a8bb82c58a482e085e9e4eaec0365b9965388e6af794015c407de39deee9c65f4ff296250	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Odywghmxt\970a2e85 = 49feadf814c48948dad01d6c1b39caf90080511d39296d843d5db95858f6f49d51a2deab60cdf20ca5edd93269999dbfc4bb9a817972b746dde81ef6b9b8e2a93bdfb0d147cae8476f1b56a48c183f6929aaf2e92bf1d4904226e6fb9d6ba5e89b9b02ba710037787ce7a2a76661	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Odywghmxt\2fb649e0 = 545a6d87c46cf2555336a13a92a6e8537cdee990419d61ae2f69723c0d0e1ff712d6d1aec32c98cc930d760055fcc8d673e3b928d6b23bff093e3bbf85d07db7ffa8bef12a76909f75750eaea428fad6a0cefb7e513d8544dc5f9881f7a9231c78978d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Odywghmxt\a0d4deb7 = 5eb7b6194f3c2e7f0a7287699a5a8701dfde168782c1dd7082981065586a25285f3e6b9063c7584d5d0ff921f620e54660747cf36fc9a5ab3d374a1e58ec1364f0	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

408 rundll32.exe
408 rundll32.exe
3980 regsvr32.exe
3980 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

408 rundll32.exe
3980 regsvr32.exe

pid	process
408	rundll32.exe
408	rundll32.exe
3980	regsvr32.exe
3980	regsvr32.exe

pid	process
408	rundll32.exe
3980	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 4060 wrote to memory of 408	4060	rundll32.exe	rundll32.exe
PID 4060 wrote to memory of 408	4060	rundll32.exe	rundll32.exe
PID 4060 wrote to memory of 408	4060	rundll32.exe	rundll32.exe
PID 408 wrote to memory of 1788	408	rundll32.exe	explorer.exe
PID 408 wrote to memory of 1788	408	rundll32.exe	explorer.exe
PID 408 wrote to memory of 1788	408	rundll32.exe	explorer.exe
PID 408 wrote to memory of 1788	408	rundll32.exe	explorer.exe
PID 408 wrote to memory of 1788	408	rundll32.exe	explorer.exe
PID 1788 wrote to memory of 3168	1788	explorer.exe	schtasks.exe
PID 1788 wrote to memory of 3168	1788	explorer.exe	schtasks.exe
PID 1788 wrote to memory of 3168	1788	explorer.exe	schtasks.exe
PID 1436 wrote to memory of 3980	1436	regsvr32.exe	regsvr32.exe
PID 1436 wrote to memory of 3980	1436	regsvr32.exe	regsvr32.exe
PID 1436 wrote to memory of 3980	1436	regsvr32.exe	regsvr32.exe
PID 3980 wrote to memory of 3628	3980	regsvr32.exe	explorer.exe
PID 3980 wrote to memory of 3628	3980	regsvr32.exe	explorer.exe
PID 3980 wrote to memory of 3628	3980	regsvr32.exe	explorer.exe
PID 3980 wrote to memory of 3628	3980	regsvr32.exe	explorer.exe
PID 3980 wrote to memory of 3628	3980	regsvr32.exe	explorer.exe
PID 3628 wrote to memory of 3840	3628	explorer.exe	reg.exe
PID 3628 wrote to memory of 3840	3628	explorer.exe	reg.exe
PID 3628 wrote to memory of 496	3628	explorer.exe	reg.exe
PID 3628 wrote to memory of 496	3628	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:408

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rigvjzqyb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test.test.dll\"" /SC ONCE /Z /ST 13:13 /ET 13:25
4⤵
- Creates scheduled task(s)
PID:3168

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3980

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3628

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Lrjbpbrt" /d "0"
4⤵
PID:3840

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Vaucwbmkrhva" /d "0"
4⤵
PID:496

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test.test.dll
MD5
09a0006a40e28e19088a28f94cb97ac6

SHA1
00689427c38d38c5f15e809ec32b4f694a354faf

SHA256
2386996976337ff4bc0e5624822dcc7bd97d847b0e546f58068c35c1808276b0

SHA512
0dcb2c1b5842a1b77a70b42aaa54900ef5d6a978658993b3f2d8b8f96a679c0c48b03b46a0cbf5b456941630aec97db04352e62cbd43918a0fc4bcec025995c4

Download Submit
\Users\Admin\AppData\Local\Temp\test.test.dll
MD5
09a0006a40e28e19088a28f94cb97ac6

SHA1
00689427c38d38c5f15e809ec32b4f694a354faf

SHA256
2386996976337ff4bc0e5624822dcc7bd97d847b0e546f58068c35c1808276b0

SHA512
0dcb2c1b5842a1b77a70b42aaa54900ef5d6a978658993b3f2d8b8f96a679c0c48b03b46a0cbf5b456941630aec97db04352e62cbd43918a0fc4bcec025995c4

Download Submit
memory/408-114-0x0000000000000000-mapping.dmp

Download
memory/408-116-0x0000000010000000-0x0000000010081000-memory.dmp

Filesize
516KB

Download
memory/408-115-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/408-117-0x0000000002E00000-0x0000000002EAE000-memory.dmp

Filesize
696KB

Download
memory/496-131-0x0000000000000000-mapping.dmp

Download
memory/1788-118-0x0000000000000000-mapping.dmp

Download
memory/1788-122-0x0000000000640000-0x0000000000661000-memory.dmp

Filesize
132KB

Download
memory/3168-119-0x0000000000000000-mapping.dmp

Download
memory/3628-129-0x0000000000000000-mapping.dmp

Download
memory/3628-134-0x0000000000B00000-0x0000000000B21000-memory.dmp

Filesize
132KB

Download
memory/3840-130-0x0000000000000000-mapping.dmp

Download
memory/3980-128-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/3980-127-0x0000000010000000-0x0000000010081000-memory.dmp

Filesize
516KB

Download
memory/3980-124-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads