qakbot | 61238817a6f5e25030106932adf64912cd1a2e7221a193299a9aea16d93b3cd6

General

Target

alp.html.dll
Size

642KB
MD5

f4685180e8b17a8bc23f5764cb67cb43
SHA1

f7a1f3fce5e6f0f1bd28a7262f26385277a4b5a4
SHA256

61238817a6f5e25030106932adf64912cd1a2e7221a193299a9aea16d93b3cd6
SHA512

336a812f63718821c03da35139674b4b63ab7032909eea721a341cc91786e1f7aa2a919432536410a017d4b9da2e0d4b6dbb54aeaa07074bcd97975641107f56

Score

10^/10

qakbot tr 1632730751 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

tr

Campaign

1632730751

C2

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4036 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2624 schtasks.exe

pid	process
4036	regsvr32.exe

pid	process
2624	schtasks.exe

Modifies data under HKEY_USERS 18 IoCs

Processes:

regsvr32.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	regsvr32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eoolaboiazpdw\fdc81b64 = 730bd611a83d08e7adf96d8cefef9f161ede5cc34466ea1705fde9bb0c4e2c42de038d5b46f9ce4d93c7b85acf0d38a7255cc4d42c6db1775c773a569e3fb497b7d4562c	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\System	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	regsvr32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eoolaboiazpdw\fa2c3b9 = 61c8f8289fbf50a8cea1040a085ba44ce18073a151395d39050f26d863b0f3c96e02647a28de15640a1c199e5c140946c1aa8545551c17bf852f03d411226c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eoolaboiazpdw\70ebac4f = 692b864c817c47e396e7f3e669f233099c47318b6593049b1698d5014d2b99	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties	regsvr32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	regsvr32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eoolaboiazpdw\70ebac4f = 692b914c817c7245f562	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eoolaboiazpdw\45747c01 = 0be42709883ef36b3162c3ac30ca940c66bc086a4a43cc273fe89723ff26f6b9d0be114c3244bb99bffecaa9e47e06674982d4aa95360d3fc615422527413c15011412a53bc2f3f6f01a7a83bc944f168dad214699c9aab9a4152110c31506d9ebe6b1c623d9ff3a29c3239e6095ab14f9cfb35f001f02380741f440b2d1b986b21bd98eb4142d64ed603964da8e22b0a926eabb919a68ad0cc71f6a9f7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eoolaboiazpdw\ff893b18 = 5e44bcd7ff0427659e0dddb4a3b5ad2d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eoolaboiazpdw\3a3d13f7 = 51337d5f6f17eea97a3fcf69889d64034adcfed068db8aff1c78ce376c532bcf8c705a79a929622be3b855952b304c18	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eoolaboiazpdw	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eoolaboiazpdw\47355c7d = 10f74f858d22ecb575002c9e268a98511483e5780deca90aa96ed71d10c3a0a5958fecc121bcc4aef882f09249a1904e6b05acaf4a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eoolaboiazpdw\82817492 = 8839d728157a15f88f4b303fc59cd587eed53ea83f7f2d3812e0692c8597174fed667748b0096df5351a641c033114e11a118cdedd8733450369279cc2965275e5d2bd9e91a92feb75e5174c1b79f9aaeeba8fa6dff7d215e04af6c8a3722c4250d69b	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2360 regsvr32.exe
2360 regsvr32.exe
4036 regsvr32.exe
4036 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2360 regsvr32.exe
4036 regsvr32.exe

pid	process
2360	regsvr32.exe
2360	regsvr32.exe
4036	regsvr32.exe
4036	regsvr32.exe

pid	process
2360	regsvr32.exe
4036	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2064 wrote to memory of 2360	2064	regsvr32.exe	regsvr32.exe
PID 2064 wrote to memory of 2360	2064	regsvr32.exe	regsvr32.exe
PID 2064 wrote to memory of 2360	2064	regsvr32.exe	regsvr32.exe
PID 2360 wrote to memory of 2548	2360	regsvr32.exe	explorer.exe
PID 2360 wrote to memory of 2548	2360	regsvr32.exe	explorer.exe
PID 2360 wrote to memory of 2548	2360	regsvr32.exe	explorer.exe
PID 2360 wrote to memory of 2548	2360	regsvr32.exe	explorer.exe
PID 2360 wrote to memory of 2548	2360	regsvr32.exe	explorer.exe
PID 2548 wrote to memory of 2624	2548	explorer.exe	schtasks.exe
PID 2548 wrote to memory of 2624	2548	explorer.exe	schtasks.exe
PID 2548 wrote to memory of 2624	2548	explorer.exe	schtasks.exe
PID 3060 wrote to memory of 4036	3060	regsvr32.exe	regsvr32.exe
PID 3060 wrote to memory of 4036	3060	regsvr32.exe	regsvr32.exe
PID 3060 wrote to memory of 4036	3060	regsvr32.exe	regsvr32.exe
PID 4036 wrote to memory of 1312	4036	regsvr32.exe	explorer.exe
PID 4036 wrote to memory of 1312	4036	regsvr32.exe	explorer.exe
PID 4036 wrote to memory of 1312	4036	regsvr32.exe	explorer.exe
PID 4036 wrote to memory of 1312	4036	regsvr32.exe	explorer.exe
PID 4036 wrote to memory of 1312	4036	regsvr32.exe	explorer.exe
PID 1312 wrote to memory of 3144	1312	explorer.exe	reg.exe
PID 1312 wrote to memory of 3144	1312	explorer.exe	reg.exe
PID 1312 wrote to memory of 1268	1312	explorer.exe	reg.exe
PID 1312 wrote to memory of 1268	1312	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\alp.html.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2064

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\alp.html.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2360

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pcvejudao /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\alp.html.dll\"" /SC ONCE /Z /ST 14:05 /ET 14:17
4⤵
- Creates scheduled task(s)
PID:2624

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\alp.html.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\alp.html.dll"
2⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4036

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ailvefcwuw" /d "0"
4⤵
PID:3144

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Raizdpjixz" /d "0"
4⤵
PID:1268

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\alp.html.dll
MD5
f4685180e8b17a8bc23f5764cb67cb43

SHA1
f7a1f3fce5e6f0f1bd28a7262f26385277a4b5a4

SHA256
61238817a6f5e25030106932adf64912cd1a2e7221a193299a9aea16d93b3cd6

SHA512
336a812f63718821c03da35139674b4b63ab7032909eea721a341cc91786e1f7aa2a919432536410a017d4b9da2e0d4b6dbb54aeaa07074bcd97975641107f56

Download Submit
\Users\Admin\AppData\Local\Temp\alp.html.dll
MD5
f4685180e8b17a8bc23f5764cb67cb43

SHA1
f7a1f3fce5e6f0f1bd28a7262f26385277a4b5a4

SHA256
61238817a6f5e25030106932adf64912cd1a2e7221a193299a9aea16d93b3cd6

SHA512
336a812f63718821c03da35139674b4b63ab7032909eea721a341cc91786e1f7aa2a919432536410a017d4b9da2e0d4b6dbb54aeaa07074bcd97975641107f56

Download Submit
memory/1268-129-0x0000000000000000-mapping.dmp

Download
memory/1312-132-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Filesize
132KB

Download
memory/1312-127-0x0000000000000000-mapping.dmp

Download
memory/2360-116-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/2360-117-0x0000000010000000-0x0000000010175000-memory.dmp

Filesize
1.5MB

Download
memory/2360-115-0x0000000000000000-mapping.dmp

Download
memory/2548-118-0x0000000000000000-mapping.dmp

Download
memory/2548-122-0x00000000034C0000-0x00000000034E1000-memory.dmp

Filesize
132KB

Download
memory/2624-119-0x0000000000000000-mapping.dmp

Download
memory/3144-128-0x0000000000000000-mapping.dmp

Download
memory/4036-126-0x00000000038D0000-0x0000000003ADE000-memory.dmp

Filesize
2.1MB

Download
memory/4036-124-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads