qakbot | a9457a1ad7aef20eae672a7e3fb51d6904a72df826e810c5aa30dde9e1b68cb0

General

Target

a5c8870f3c8c0d933420f04e24b6bbdf.dll
Size

471KB
MD5

a5c8870f3c8c0d933420f04e24b6bbdf
SHA1

4478b0c7d641a2c67bbd040ae19a59b7a1d2b485
SHA256

a9457a1ad7aef20eae672a7e3fb51d6904a72df826e810c5aa30dde9e1b68cb0
SHA512

ed6eccf6d9ff904776114e57cf9f11fe1a54facd3189ae51f54731f467fd293efb3d7739dd99a4d21fe2e207b6f14fca1430d66022615eafd3e94fcf967d5516

Score

10^/10

qakbot tr 1632817399 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1632817399

C2

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

181.118.183.94:443

120.150.218.241:995

185.250.148.74:443

95.77.223.148:443

75.66.88.33:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1404 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

956 schtasks.exe

pid	process
1404	regsvr32.exe

pid	process
956	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\71123afa = 353112294c06f5297bcb40895b90df0f9fef5f4c4a2d166a7caf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\448deab4 = 1f81aa9a99c1eec849148c0a544de70f9f3d215cb7001468cdfb49429d6cc22b0b1ae133ea39b944cd5eb0c1955756db7ac8e70ad9541b36fee62df0807718ddeef6687fd48d1de31771181266337bc08d1f4c2600d1e705215717da3602d681c5120f7af233caa2efc4fec9ac8aa84f001f5c6a6d0b13d0083270ea4d95988e0886b221cf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\3bc48542 = ebc7bea1c59f014cac3f44a9e977106396238795bfdf281593018958d512f5eddd015abe9fdf2b61d83bc2a022b398846c8e18cefdef0c1e8f2a95eb7eeefc2ba33a9d1e3d2cc60fefe9a531b4d68b09341bd4a317840624ed	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\e5b550c = 7a7e2d60053cbe035841412bc1b67697ff1dc0feb31e34de8328	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\46cccac8 = 60c89df6d371a450c77c493d1d8023ecd333a6cff8090e7bc67486030d68c903e41a395d47	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\fe70adad = 3e18525dda4f7dae820bd9f434ac44cc9bd85120e0e1561d74a89db79325917e0d16952fc8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\8378e227 = 15f603b66facaf59444c16d42f565db1a116ecd5b42f78d38aeb6508e7f4ea354d8bf98aeea236da4a4f6ae24bfbe20d1c235d5e0863c3378e48f31ee2c4e1c20a7385e34c8294c33301	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\fc318dd1 = 31c78a22c3e2aead20d3b909d0ab56b0cfbc2ab52e70369727648a8e1ff0a26d445cc679eff7245daec4f2392f6848a46b9755de100064c5fbf7ffb94b4aada3f567ddc3a7a64b04eef945a7012a21918b0ca6b5eaf56dd0b5f721	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\71123afa = 353105294c06c07b81e4a85034bc612e0e12e62d31217be31fc2a512e1591df21c8af032481a069a3c30d185915f63	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1640 rundll32.exe
1404 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1640 rundll32.exe
1404 regsvr32.exe

pid	process
1640	rundll32.exe
1404	regsvr32.exe

pid	process
1640	rundll32.exe
1404	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1756 wrote to memory of 1640	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1640	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1640	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1640	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1640	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1640	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1640	1756	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 964	1640	rundll32.exe	explorer.exe
PID 1640 wrote to memory of 964	1640	rundll32.exe	explorer.exe
PID 1640 wrote to memory of 964	1640	rundll32.exe	explorer.exe
PID 1640 wrote to memory of 964	1640	rundll32.exe	explorer.exe
PID 1640 wrote to memory of 964	1640	rundll32.exe	explorer.exe
PID 1640 wrote to memory of 964	1640	rundll32.exe	explorer.exe
PID 964 wrote to memory of 956	964	explorer.exe	schtasks.exe
PID 964 wrote to memory of 956	964	explorer.exe	schtasks.exe
PID 964 wrote to memory of 956	964	explorer.exe	schtasks.exe
PID 964 wrote to memory of 956	964	explorer.exe	schtasks.exe
PID 784 wrote to memory of 1040	784	taskeng.exe	regsvr32.exe
PID 784 wrote to memory of 1040	784	taskeng.exe	regsvr32.exe
PID 784 wrote to memory of 1040	784	taskeng.exe	regsvr32.exe
PID 784 wrote to memory of 1040	784	taskeng.exe	regsvr32.exe
PID 784 wrote to memory of 1040	784	taskeng.exe	regsvr32.exe
PID 1040 wrote to memory of 1404	1040	regsvr32.exe	regsvr32.exe
PID 1040 wrote to memory of 1404	1040	regsvr32.exe	regsvr32.exe
PID 1040 wrote to memory of 1404	1040	regsvr32.exe	regsvr32.exe
PID 1040 wrote to memory of 1404	1040	regsvr32.exe	regsvr32.exe
PID 1040 wrote to memory of 1404	1040	regsvr32.exe	regsvr32.exe
PID 1040 wrote to memory of 1404	1040	regsvr32.exe	regsvr32.exe
PID 1040 wrote to memory of 1404	1040	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1800	1404	regsvr32.exe	explorer.exe
PID 1404 wrote to memory of 1800	1404	regsvr32.exe	explorer.exe
PID 1404 wrote to memory of 1800	1404	regsvr32.exe	explorer.exe
PID 1404 wrote to memory of 1800	1404	regsvr32.exe	explorer.exe
PID 1404 wrote to memory of 1800	1404	regsvr32.exe	explorer.exe
PID 1404 wrote to memory of 1800	1404	regsvr32.exe	explorer.exe
PID 1800 wrote to memory of 1356	1800	explorer.exe	reg.exe
PID 1800 wrote to memory of 1356	1800	explorer.exe	reg.exe
PID 1800 wrote to memory of 1356	1800	explorer.exe	reg.exe
PID 1800 wrote to memory of 1356	1800	explorer.exe	reg.exe
PID 1800 wrote to memory of 1688	1800	explorer.exe	reg.exe
PID 1800 wrote to memory of 1688	1800	explorer.exe	reg.exe
PID 1800 wrote to memory of 1688	1800	explorer.exe	reg.exe
PID 1800 wrote to memory of 1688	1800	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5c8870f3c8c0d933420f04e24b6bbdf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5c8870f3c8c0d933420f04e24b6bbdf.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn furzempnwz /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a5c8870f3c8c0d933420f04e24b6bbdf.dll\"" /SC ONCE /Z /ST 15:21 /ET 15:33
4⤵
- Creates scheduled task(s)
PID:956

C:\Windows\system32\taskeng.exe
taskeng.exe {425933E1-5F58-44E5-80FB-14513A3EA88D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a5c8870f3c8c0d933420f04e24b6bbdf.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\a5c8870f3c8c0d933420f04e24b6bbdf.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Wcxjsuyjtqp" /d "0"
5⤵
PID:1356

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Lmyynyohkgae" /d "0"
5⤵
PID:1688

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a5c8870f3c8c0d933420f04e24b6bbdf.dll
MD5
a5c8870f3c8c0d933420f04e24b6bbdf

SHA1
4478b0c7d641a2c67bbd040ae19a59b7a1d2b485

SHA256
a9457a1ad7aef20eae672a7e3fb51d6904a72df826e810c5aa30dde9e1b68cb0

SHA512
ed6eccf6d9ff904776114e57cf9f11fe1a54facd3189ae51f54731f467fd293efb3d7739dd99a4d21fe2e207b6f14fca1430d66022615eafd3e94fcf967d5516

Download Submit
\Users\Admin\AppData\Local\Temp\a5c8870f3c8c0d933420f04e24b6bbdf.dll
MD5
a5c8870f3c8c0d933420f04e24b6bbdf

SHA1
4478b0c7d641a2c67bbd040ae19a59b7a1d2b485

SHA256
a9457a1ad7aef20eae672a7e3fb51d6904a72df826e810c5aa30dde9e1b68cb0

SHA512
ed6eccf6d9ff904776114e57cf9f11fe1a54facd3189ae51f54731f467fd293efb3d7739dd99a4d21fe2e207b6f14fca1430d66022615eafd3e94fcf967d5516

Download Submit
memory/956-61-0x0000000000000000-mapping.dmp

Download
memory/964-60-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/964-62-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/964-58-0x0000000000000000-mapping.dmp

Download
memory/1040-64-0x000007FEFC271000-0x000007FEFC273000-memory.dmp

Filesize
8KB

Download
memory/1040-63-0x0000000000000000-mapping.dmp

Download
memory/1356-74-0x0000000000000000-mapping.dmp

Download
memory/1404-66-0x0000000000000000-mapping.dmp

Download
memory/1404-75-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1404-70-0x0000000010000000-0x0000000010081000-memory.dmp

Filesize
516KB

Download
memory/1640-53-0x0000000000000000-mapping.dmp

Download
memory/1640-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1640-56-0x0000000010000000-0x0000000010081000-memory.dmp

Filesize
516KB

Download
memory/1640-57-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1640-55-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1688-77-0x0000000000000000-mapping.dmp

Download
memory/1800-71-0x0000000000000000-mapping.dmp

Download
memory/1800-76-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads