qakbot | fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36

General

Target

fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36.dll
Size

429KB
MD5

37d8f5cca1e2e57245fda59f0162318d
SHA1

c0a3f05e3d75ad3dbef330959e81899081005598
SHA256

fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36
SHA512

e15fbe407fae2a703a3da45d4431e75aefef921715cf44245a4ca6a9db2fd4571b720e6d23840b8b6b9a2b0fb54b0910895c77f07c795850d6fe6cb2d5d1b878

Score

10^/10

qakbot tr 1632817399 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1632817399

C2

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

181.118.183.94:443

120.150.218.241:995

185.250.148.74:443

95.77.223.148:443

75.66.88.33:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1792 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1868 schtasks.exe

pid	process
1792	regsvr32.exe

pid	process
1868	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pdvclgfupyekxo\906f63a7 = 5cb4893fd69de8cfe96146c659c8cb89d8eedbcfb88e4980e85cf15478b571bbc597e889be6e85bd7b624a62b0fd7040490b886b4c0b81af2bbe75126d8f8301fde7d1ecab5317475746e2e29a0b6758ad547b5526c8ae2c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pdvclgfupyekxo\1d4cd48c = fafc18da5917e22ba137150e175a94ff93fa35214301ab	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pdvclgfupyekxo\28d304c2 = ac575affd2886c54af30b8ee465944a33ff062da42fe2e3fcd2eb41ba3ad69f9a8e513e5e3fb03d6bcbbbca6d0a210cce4cd9387b337cfebdba4ed6e2984cc89c7b6c37eb1e11c99166f1ef4f4c7fe23b8244cbeb84fbbd9e4072289ffc631e48d0c6fd3b89be5088828c4ef831a3e092e612a5da958de569f0731ce751b801f8b8697f0950b030cf5c0c455165753e6b655f42575e0ebc96677da0391deb73b6ca18aa495c57b76227694373e5c0fef6ac97bc381ee8245	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pdvclgfupyekxo\922e43db = 9d49d9be1d6520f6801d0580d24975e41f9e413d07fd693f35ae781113	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pdvclgfupyekxo\579a6b34 = e0c9cf2b2c90305d781cac2990ec848e949d7404b25a71f42bb6aeb53f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pdvclgfupyekxo\1d4cd48c = fafc0fda5917d7e6d4ba3547dded569ee20e12b1045018da52eb82158a431a14bffe50968950652e1e74f82c	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pdvclgfupyekxo	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pdvclgfupyekxo\2a9224be = c3d5875e7f8b5873d938e7b7819b4315e958acd7bdb1f35f64c1d3ac57ab27718ba95bda2e89ddf8ed6b2a6e3e515adbf06f8111f847e01386d0cbf52b865dfb4bf1969fdb2cf5dddae888749429ffdcf21af6ba246b4401	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pdvclgfupyekxo\ef260c51 = 5800acf50193f5b49bc0bc023ced9a89b12287de508a10e15f564867586a7c0e8ee04810c58d9b90dd25a13b830779edb3c0e54c9ee93462edde7d983c148fd6660a0c226dcaca2240bcd703ec5296e63d4f1788a40bc1b5b1fc0cf07e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pdvclgfupyekxo\6205bb7a = 85540ad03704221c3a06473b10945fe3462ed5a00cec541de11f2b925e4e6dd1db02f88eef320e3c05e6a0a0998226a36c96d4	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

604 rundll32.exe
1792 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

604 rundll32.exe
1792 regsvr32.exe

pid	process
604	rundll32.exe
1792	regsvr32.exe

pid	process
604	rundll32.exe
1792	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1564 wrote to memory of 604	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 604	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 604	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 604	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 604	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 604	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 604	1564	rundll32.exe	rundll32.exe
PID 604 wrote to memory of 1660	604	rundll32.exe	explorer.exe
PID 604 wrote to memory of 1660	604	rundll32.exe	explorer.exe
PID 604 wrote to memory of 1660	604	rundll32.exe	explorer.exe
PID 604 wrote to memory of 1660	604	rundll32.exe	explorer.exe
PID 604 wrote to memory of 1660	604	rundll32.exe	explorer.exe
PID 604 wrote to memory of 1660	604	rundll32.exe	explorer.exe
PID 1660 wrote to memory of 1868	1660	explorer.exe	schtasks.exe
PID 1660 wrote to memory of 1868	1660	explorer.exe	schtasks.exe
PID 1660 wrote to memory of 1868	1660	explorer.exe	schtasks.exe
PID 1660 wrote to memory of 1868	1660	explorer.exe	schtasks.exe
PID 1216 wrote to memory of 1208	1216	taskeng.exe	regsvr32.exe
PID 1216 wrote to memory of 1208	1216	taskeng.exe	regsvr32.exe
PID 1216 wrote to memory of 1208	1216	taskeng.exe	regsvr32.exe
PID 1216 wrote to memory of 1208	1216	taskeng.exe	regsvr32.exe
PID 1216 wrote to memory of 1208	1216	taskeng.exe	regsvr32.exe
PID 1208 wrote to memory of 1792	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 1792	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 1792	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 1792	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 1792	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 1792	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 1792	1208	regsvr32.exe	regsvr32.exe
PID 1792 wrote to memory of 1000	1792	regsvr32.exe	explorer.exe
PID 1792 wrote to memory of 1000	1792	regsvr32.exe	explorer.exe
PID 1792 wrote to memory of 1000	1792	regsvr32.exe	explorer.exe
PID 1792 wrote to memory of 1000	1792	regsvr32.exe	explorer.exe
PID 1792 wrote to memory of 1000	1792	regsvr32.exe	explorer.exe
PID 1792 wrote to memory of 1000	1792	regsvr32.exe	explorer.exe
PID 1000 wrote to memory of 1672	1000	explorer.exe	reg.exe
PID 1000 wrote to memory of 1672	1000	explorer.exe	reg.exe
PID 1000 wrote to memory of 1672	1000	explorer.exe	reg.exe
PID 1000 wrote to memory of 1672	1000	explorer.exe	reg.exe
PID 1000 wrote to memory of 1732	1000	explorer.exe	reg.exe
PID 1000 wrote to memory of 1732	1000	explorer.exe	reg.exe
PID 1000 wrote to memory of 1732	1000	explorer.exe	reg.exe
PID 1000 wrote to memory of 1732	1000	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1564

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:604

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cwewgamsid /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36.dll\"" /SC ONCE /Z /ST 21:58 /ET 22:10
4⤵
- Creates scheduled task(s)
PID:1868

C:\Windows\system32\taskeng.exe
taskeng.exe {0289F431-2609-4311-ADF7-250A6F9C2A9C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Hgeec" /d "0"
5⤵
PID:1672

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Wyqbsk" /d "0"
5⤵
PID:1732

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36.dll
MD5
37d8f5cca1e2e57245fda59f0162318d

SHA1
c0a3f05e3d75ad3dbef330959e81899081005598

SHA256
fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36

SHA512
e15fbe407fae2a703a3da45d4431e75aefef921715cf44245a4ca6a9db2fd4571b720e6d23840b8b6b9a2b0fb54b0910895c77f07c795850d6fe6cb2d5d1b878

Download Submit
\Users\Admin\AppData\Local\Temp\fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36.dll
MD5
37d8f5cca1e2e57245fda59f0162318d

SHA1
c0a3f05e3d75ad3dbef330959e81899081005598

SHA256
fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36

SHA512
e15fbe407fae2a703a3da45d4431e75aefef921715cf44245a4ca6a9db2fd4571b720e6d23840b8b6b9a2b0fb54b0910895c77f07c795850d6fe6cb2d5d1b878

Download Submit
memory/604-59-0x0000000000000000-mapping.dmp

Download
memory/604-60-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/604-62-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download
memory/604-61-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/604-63-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1000-82-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1000-77-0x0000000000000000-mapping.dmp

Download
memory/1208-70-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

Filesize
8KB

Download
memory/1208-69-0x0000000000000000-mapping.dmp

Download
memory/1660-68-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1660-66-0x0000000074531000-0x0000000074533000-memory.dmp

Filesize
8KB

Download
memory/1660-64-0x0000000000000000-mapping.dmp

Download
memory/1672-80-0x0000000000000000-mapping.dmp

Download
memory/1732-83-0x0000000000000000-mapping.dmp

Download
memory/1792-72-0x0000000000000000-mapping.dmp

Download
memory/1792-76-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download
memory/1792-81-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1868-67-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads