qakbot | 17394b97a421b4ab7486925a3378dfc010723b1f51a993817983bcbde10872f1

General

Target

2827b5836bd6d608b09e676ab834e5fd.dll
Size

457KB
MD5

2827b5836bd6d608b09e676ab834e5fd
SHA1

bb30b4959b886447a7558853c42a8c00080d28eb
SHA256

17394b97a421b4ab7486925a3378dfc010723b1f51a993817983bcbde10872f1
SHA512

962670844b0a49edd55bf583ba7a2ab7b2da2e1482659a343860b1031cae34b456116140e7031ca994eba272c69ba0bac44ebc15afe4365360eed775014f4ef0

Score

10^/10

qakbot tr 1632817399 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1632817399

C2

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

181.118.183.94:443

120.150.218.241:995

185.250.148.74:443

95.77.223.148:443

75.66.88.33:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1340 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2692 schtasks.exe

pid	process
1340	regsvr32.exe

pid	process
2692	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eeypednhuwtvax\1ccb1f54 = ad2d33cda7494a16929f3c6782	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eeypednhuwtvax\2954cf1a = 3bdedd48b4cb97e6139713bc7d87074cac29baeb283c2b361984af9a12631c2cb43e63792b684e77fa5fe7f89336df992bf23432bfd5eaa5e71def9a14018a34e5557dc8abd53f51bf34db5493394e80ed42cfc4728af84c4d2152084dc0ce1b930557f28f2cddaaa3d894e53e223bf5ec7615e757cdd7c680df24c8ad56f2b4d0976ce26a38d01504d5e739cfc339315d2c50a42c4df33f1d0ae9b12215e60a4e489fa5a1fab8abe456b3bfc759428625872da9cdd98b42d80048656dcdea6c54d65b93bdc26e674357	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eeypednhuwtvax\2b15ef66 = 1bedcaf81cf8d9ab477354159f27c4663fdaebd06a761a5184311959736838d70a837e76aef9a11bd0e4879b1841920df64408c1e6c6fc9379f07bd83677090e1721880b80474c05e16a5f1ba751ba646dd755	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eeypednhuwtvax\93a98803 = 1ce4fcf8f60116e614818f4a42ced717f0a61f1702f31fff6f734dd7651caaeff10bb2a3babc6c8bad674dc3e389478fbae222692395	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eeypednhuwtvax\eea1c789 = bee637c7862a3ce399d21e793cc46feec6a1ab253cf44003dc3cd7e06067324779350e3d90859a68222d9e29084485c3b00499efdea0649a98be1e986714935b5cefb8b4b91cfb83308ec05d3b1a858b06653b0b49	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eeypednhuwtvax\561da0ec = 39987b0845149220c7082824f9d802ef20f318047d560d78da8ea821e32555911c399ded1df465285c9e89f27024e0c7b81285a040e8a851c92409f3531a706f42c17faccf8d585ef7b84fdf12a88307b2b66a2ebf3c9ca6286fea81ee1c82	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eeypednhuwtvax\91e8a87f = 859710b6087e9a6ac9e53d43613438feeb6b752de066948b9360e2db8dc038a6f5a46057772f07b070b85c7a4b9046c963	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eeypednhuwtvax	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eeypednhuwtvax\1ccb1f54 = ad2d24cda7497fcabda38dddf2683b3bd5dbc3a70e865b246e931959908b998ab252	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eeypednhuwtvax\638270a2 = 25f57b30db36d5a81aba528b0f55776bf6797f3d56d2db4728eb373a37def8c0de55ed9302eeef10d91b64a5b726692fbd7c6bb82acf7269f90690088ae754	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2356 rundll32.exe
2356 rundll32.exe
1340 regsvr32.exe
1340 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2356 rundll32.exe
1340 regsvr32.exe

pid	process
2356	rundll32.exe
2356	rundll32.exe
1340	regsvr32.exe
1340	regsvr32.exe

pid	process
2356	rundll32.exe
1340	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2160 wrote to memory of 2356	2160	rundll32.exe	rundll32.exe
PID 2160 wrote to memory of 2356	2160	rundll32.exe	rundll32.exe
PID 2160 wrote to memory of 2356	2160	rundll32.exe	rundll32.exe
PID 2356 wrote to memory of 2656	2356	rundll32.exe	explorer.exe
PID 2356 wrote to memory of 2656	2356	rundll32.exe	explorer.exe
PID 2356 wrote to memory of 2656	2356	rundll32.exe	explorer.exe
PID 2356 wrote to memory of 2656	2356	rundll32.exe	explorer.exe
PID 2356 wrote to memory of 2656	2356	rundll32.exe	explorer.exe
PID 2656 wrote to memory of 2692	2656	explorer.exe	schtasks.exe
PID 2656 wrote to memory of 2692	2656	explorer.exe	schtasks.exe
PID 2656 wrote to memory of 2692	2656	explorer.exe	schtasks.exe
PID 420 wrote to memory of 1340	420	regsvr32.exe	regsvr32.exe
PID 420 wrote to memory of 1340	420	regsvr32.exe	regsvr32.exe
PID 420 wrote to memory of 1340	420	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1048	1340	regsvr32.exe	explorer.exe
PID 1340 wrote to memory of 1048	1340	regsvr32.exe	explorer.exe
PID 1340 wrote to memory of 1048	1340	regsvr32.exe	explorer.exe
PID 1340 wrote to memory of 1048	1340	regsvr32.exe	explorer.exe
PID 1340 wrote to memory of 1048	1340	regsvr32.exe	explorer.exe
PID 1048 wrote to memory of 416	1048	explorer.exe	reg.exe
PID 1048 wrote to memory of 416	1048	explorer.exe	reg.exe
PID 1048 wrote to memory of 2480	1048	explorer.exe	reg.exe
PID 1048 wrote to memory of 2480	1048	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2827b5836bd6d608b09e676ab834e5fd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2827b5836bd6d608b09e676ab834e5fd.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2356

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bpledspp /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\2827b5836bd6d608b09e676ab834e5fd.dll\"" /SC ONCE /Z /ST 16:16 /ET 16:28
4⤵
- Creates scheduled task(s)
PID:2692

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\2827b5836bd6d608b09e676ab834e5fd.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:420

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\2827b5836bd6d608b09e676ab834e5fd.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Yvuiiwpdqtzf" /d "0"
4⤵
PID:416

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Peeywkgidf" /d "0"
4⤵
PID:2480

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2827b5836bd6d608b09e676ab834e5fd.dll
MD5
2827b5836bd6d608b09e676ab834e5fd

SHA1
bb30b4959b886447a7558853c42a8c00080d28eb

SHA256
17394b97a421b4ab7486925a3378dfc010723b1f51a993817983bcbde10872f1

SHA512
962670844b0a49edd55bf583ba7a2ab7b2da2e1482659a343860b1031cae34b456116140e7031ca994eba272c69ba0bac44ebc15afe4365360eed775014f4ef0

Download Submit
\Users\Admin\AppData\Local\Temp\2827b5836bd6d608b09e676ab834e5fd.dll
MD5
2827b5836bd6d608b09e676ab834e5fd

SHA1
bb30b4959b886447a7558853c42a8c00080d28eb

SHA256
17394b97a421b4ab7486925a3378dfc010723b1f51a993817983bcbde10872f1

SHA512
962670844b0a49edd55bf583ba7a2ab7b2da2e1482659a343860b1031cae34b456116140e7031ca994eba272c69ba0bac44ebc15afe4365360eed775014f4ef0

Download Submit
memory/416-131-0x0000000000000000-mapping.dmp

Download
memory/1048-135-0x00000000005C0000-0x00000000005E1000-memory.dmp

Filesize
132KB

Download
memory/1048-130-0x0000000000000000-mapping.dmp

Download
memory/1340-125-0x0000000000000000-mapping.dmp

Download
memory/1340-127-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/1340-129-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download
memory/2356-115-0x0000000000000000-mapping.dmp

Download
memory/2356-118-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/2356-117-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download
memory/2356-116-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2480-132-0x0000000000000000-mapping.dmp

Download
memory/2656-123-0x0000000002F70000-0x0000000002F91000-memory.dmp

Filesize
132KB

Download
memory/2656-119-0x0000000000000000-mapping.dmp

Download
memory/2692-120-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads