qakbot | fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36

General

Target

fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36.dll
Size

429KB
MD5

37d8f5cca1e2e57245fda59f0162318d
SHA1

c0a3f05e3d75ad3dbef330959e81899081005598
SHA256

fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36
SHA512

e15fbe407fae2a703a3da45d4431e75aefef921715cf44245a4ca6a9db2fd4571b720e6d23840b8b6b9a2b0fb54b0910895c77f07c795850d6fe6cb2d5d1b878

Score

10^/10

qakbot tr 1632817399 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1632817399

C2

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

181.118.183.94:443

120.150.218.241:995

185.250.148.74:443

95.77.223.148:443

75.66.88.33:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1308 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3040 schtasks.exe

pid	process
1308	regsvr32.exe

pid	process
3040	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ahqefxxx\933ec7fd = 3b6485eb09720dfed4cd662e82bfe47f997ad75b937aa74bef8078005529da7066013fef747b584aea330e67780ad887d4a3e7c30aeb6475e6f60ef055934affb3cba88b07c2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ahqefxxx\61541f20 = c65b6bd3a064de42209b401e56ec05bf0f4e5d3ea45ede5ba71a17732ac20f30e031890c814d21d4a4eb5ffb517725864396edd876dd5e8d2416ba9cf6110a781e9019549205ada1a5ff84d8cb81488fd0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ahqefxxx\1e1d70d6 = d77ea9ca45b61e6a9301accc508cc9ffcefa75998be438e8273496fd8aa32c1968999b8a1e5bf246c5375f3435731c05619c09f0e0c43220b1c55147f0849cdf4be75c5ec378fe2d6c4c08	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ahqefxxx\1e1d70d6 = d77ebeca45b62b609170e1999122716d7c757d109b90c620ecbcf1f2c3de9a80a8e2802d49f684dd1bda3554cccf155a80cb677da210	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ahqefxxx\ec77a80b = 6ef5fa78090b409985fc986ad8663cd19d8d6c905f50c3a79cbee3ed9ac40a9864b8d147a82dd8fca86ce70481ed9d0afa9b6f98fb8de4f6d79d46de59ffcbc33b99e4d3c5136d3d7a40506a5f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ahqefxxx\54cbcf6e = 67e33e758b6f9ae363f7890d730c395ec03d80cc5c2aa2043de4f0fc222502c7cb91f3e6198725af83bf70570f8d88ae36e25251566fd4bb4079	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ahqefxxx\917fe781 = 4541519daf2452e848ec26	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ahqefxxx	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ahqefxxx\2b82a098 = f941054d0d92572f16cf7403bd10cd6fb26dcf3bbf48cbd37c3f9f2c2014a076f231d02df351a828adf11d132e748528d57fa827ff709daf1b35eaf7096bdbb9ae8f101fd178cff82cdf06a04bcb8e47fd1e94a9ae0f0a09afd883047be62f624d0e74c66f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ahqefxxx\29c380e4 = e52989a0369d61fe3a4517317609e89c885db08ee18783d0416e4edbd484ecb6d5bddb4fcd840fd68fe1144b9d78b08054d90efda0c6abef47e8013e37ee602e9e59d9b7de0d099999	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2476 rundll32.exe
2476 rundll32.exe
1308 regsvr32.exe
1308 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2476 rundll32.exe
1308 regsvr32.exe

pid	process
2476	rundll32.exe
2476	rundll32.exe
1308	regsvr32.exe
1308	regsvr32.exe

pid	process
2476	rundll32.exe
1308	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2396 wrote to memory of 2476	2396	rundll32.exe	rundll32.exe
PID 2396 wrote to memory of 2476	2396	rundll32.exe	rundll32.exe
PID 2396 wrote to memory of 2476	2396	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 2724	2476	rundll32.exe	explorer.exe
PID 2476 wrote to memory of 2724	2476	rundll32.exe	explorer.exe
PID 2476 wrote to memory of 2724	2476	rundll32.exe	explorer.exe
PID 2476 wrote to memory of 2724	2476	rundll32.exe	explorer.exe
PID 2476 wrote to memory of 2724	2476	rundll32.exe	explorer.exe
PID 2724 wrote to memory of 3040	2724	explorer.exe	schtasks.exe
PID 2724 wrote to memory of 3040	2724	explorer.exe	schtasks.exe
PID 2724 wrote to memory of 3040	2724	explorer.exe	schtasks.exe
PID 640 wrote to memory of 1308	640	regsvr32.exe	regsvr32.exe
PID 640 wrote to memory of 1308	640	regsvr32.exe	regsvr32.exe
PID 640 wrote to memory of 1308	640	regsvr32.exe	regsvr32.exe
PID 1308 wrote to memory of 1328	1308	regsvr32.exe	explorer.exe
PID 1308 wrote to memory of 1328	1308	regsvr32.exe	explorer.exe
PID 1308 wrote to memory of 1328	1308	regsvr32.exe	explorer.exe
PID 1308 wrote to memory of 1328	1308	regsvr32.exe	explorer.exe
PID 1308 wrote to memory of 1328	1308	regsvr32.exe	explorer.exe
PID 1328 wrote to memory of 3928	1328	explorer.exe	reg.exe
PID 1328 wrote to memory of 3928	1328	explorer.exe	reg.exe
PID 1328 wrote to memory of 1944	1328	explorer.exe	reg.exe
PID 1328 wrote to memory of 1944	1328	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2396

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2476

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn nbhozbbrb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36.dll\"" /SC ONCE /Z /ST 19:57 /ET 20:09
4⤵
- Creates scheduled task(s)
PID:3040

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Uijdgdbyhos" /d "0"
4⤵
PID:3928

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Gyevavbp" /d "0"
4⤵
PID:1944

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36.dll
MD5
37d8f5cca1e2e57245fda59f0162318d

SHA1
c0a3f05e3d75ad3dbef330959e81899081005598

SHA256
fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36

SHA512
e15fbe407fae2a703a3da45d4431e75aefef921715cf44245a4ca6a9db2fd4571b720e6d23840b8b6b9a2b0fb54b0910895c77f07c795850d6fe6cb2d5d1b878

Download Submit
\Users\Admin\AppData\Local\Temp\fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36.dll
MD5
37d8f5cca1e2e57245fda59f0162318d

SHA1
c0a3f05e3d75ad3dbef330959e81899081005598

SHA256
fad841e442edec9abdd91ec9c8b7515de0a8466b6ecb08da5593a0ba71caeb36

SHA512
e15fbe407fae2a703a3da45d4431e75aefef921715cf44245a4ca6a9db2fd4571b720e6d23840b8b6b9a2b0fb54b0910895c77f07c795850d6fe6cb2d5d1b878

Download Submit
memory/1308-129-0x0000000000520000-0x000000000066A000-memory.dmp

Filesize
1.3MB

Download
memory/1308-128-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download
memory/1308-125-0x0000000000000000-mapping.dmp

Download
memory/1328-130-0x0000000000000000-mapping.dmp

Download
memory/1328-135-0x0000000002D90000-0x0000000002DB1000-memory.dmp

Filesize
132KB

Download
memory/1944-132-0x0000000000000000-mapping.dmp

Download
memory/2476-118-0x0000000003410000-0x000000000355A000-memory.dmp

Filesize
1.3MB

Download
memory/2476-117-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download
memory/2476-116-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2476-115-0x0000000000000000-mapping.dmp

Download
memory/2724-123-0x0000000002D90000-0x0000000002DB1000-memory.dmp

Filesize
132KB

Download
memory/2724-119-0x0000000000000000-mapping.dmp

Download
memory/3040-120-0x0000000000000000-mapping.dmp

Download
memory/3928-131-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads