qakbot | b69d373340bdd8dde8c718286c5f2bb8e1bbfc0c817f0fc7d5b1b712e4ef85ff

General

Target

test1.test.dll
Size

662KB
MD5

8538019c513379a092104fa35dfd5d76
SHA1

f524fea3b2f880359c2ed44453e5515c9f99cefe
SHA256

b69d373340bdd8dde8c718286c5f2bb8e1bbfc0c817f0fc7d5b1b712e4ef85ff
SHA512

5c3ed2a46507d7fa797a61ac54085a206dac66014a8e1b7217b134fd640f53c7d23c04e4f1f368aac27417262118dbb450bf979aa1fffa4dedd5b780b362cf1e

Score

10^/10

qakbot tr 1632730751 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

tr

Campaign

1632730751

C2

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3488 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

824 schtasks.exe

pid	process
3488	regsvr32.exe

pid	process
824	schtasks.exe

Modifies data under HKEY_USERS 18 IoCs

Processes:

explorer.exeregsvr32.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Logtfggkxwco\5e783fa5 = ddcfbbe8d05125d1424b0f2f6fcc64f0c95651dc6d3c95a98c7df7fb2a4bc9d2f731710750b121a0e7aecc9640efa009883bd635d5e48d50199b00619caa0ef56f94036fd0c0f3e8d5c6c376020f9dd5c381411ef0949838f5b99898e76879e4342e644618c9bde016a0e1ca8994d307e3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Logtfggkxwco\6be7efeb = 0666d1488c54c56120c20ab680ddd1f6fa98d8586c6f5459649527b24881ad21e533813df3697e91122b219ac02e5880a9be9cfc0b6f247ac1295100f0d181444c79bdf5203b4cf9429e1b1c13d21a99eb409d669e63a1de9046961907759c33cbff95dc53c314bb38e78a	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\System	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	regsvr32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Logtfggkxwco\e6c458c0 = a7b014359ff7faa84364eb69c5ec51f47f22e4fca8cbcbcb44723b90ffa8b1d169092ee0a443d92c856f41be37257c4010fab7fcfddc452e86c98caefac58c47443b6eb62219a1923f317a1b26c49a638edcd5cbed7f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Logtfggkxwco	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Logtfggkxwco\9bcc174a = 907bc73071385b7ecc4502228a5baca1257b120123c3e7337b3b7b76b2099baed948d408aeadf6dfa24804b10b683296b50994769f3b3de1404264053c0b87fd1ec16aee966ffa69	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Logtfggkxwco\998d3736 = 294d332c56e5d6746a21c768aa78c25e46a6f018e4ad6cd8f8d4201e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties	regsvr32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	regsvr32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Logtfggkxwco\14ae801d = 3ab36010b90a96254ab490d33ed3eb47a8460925dd41858d6d49966612d189a9721607bfd14523f65e7a919d1abe9ac48761545e7e3791e58ea0cc4ebf67767dd9c31f657fc0057fe6cb678c0c1a9776c9e15219f2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Logtfggkxwco\2370702f = ea2fab11f1e8b8a300c47a9423af9e5742c84ddb8d99380ff88283ada7cd1c5d670bf25c96330a5f5eb24a4ea69a7c00a2cb063294dca91344a8dbc1bdae55b53e8f6185c091f3a66f80f1c9e70f7404a8ed28f855edfb1b6afce2d83d8e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	regsvr32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Logtfggkxwco\21315053 = f3b014dd5b49a69849dccdf5a199289f6223c55d0a370c134e73889ce852962300bd565869120cc77b358087113f4e4709e517bd7129eb980cf50d10065ac2385947d7a50cc596dc1b37456108ba4978409353202b27015a1eb9b88a87440d2615e1c148e020699eb6e6fc8f2e490c44646d0a753ec39c9cb720f5320f68cfec17f0651135406c00ea7c6107d6b09993731e248d4e8fba07c156cc04f8bf7a4afa05028dfaae9408cf6d2274c6094fc9b6151f5394a44b2a3d48c01857a05ee4f3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Logtfggkxwco\14ae801d = 3ab37710b90aa3c27a8f4f7bf432f07b468738feaf557a8e6ad27001046025944d083b6ea7f29842946fad284f745d46f7ec1da7be9d541aba1a03deffab707618a97220dc9f53a7957944fe9df8b89ba9710c908fa4845b8e1b5a0c973bc5090eaee0d6571d9084cbc8	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

4068 regsvr32.exe
4068 regsvr32.exe
3488 regsvr32.exe
3488 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

4068 regsvr32.exe
3488 regsvr32.exe

pid	process
4068	regsvr32.exe
4068	regsvr32.exe
3488	regsvr32.exe
3488	regsvr32.exe

pid	process
4068	regsvr32.exe
3488	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 4016 wrote to memory of 4068	4016	regsvr32.exe	regsvr32.exe
PID 4016 wrote to memory of 4068	4016	regsvr32.exe	regsvr32.exe
PID 4016 wrote to memory of 4068	4016	regsvr32.exe	regsvr32.exe
PID 4068 wrote to memory of 644	4068	regsvr32.exe	explorer.exe
PID 4068 wrote to memory of 644	4068	regsvr32.exe	explorer.exe
PID 4068 wrote to memory of 644	4068	regsvr32.exe	explorer.exe
PID 4068 wrote to memory of 644	4068	regsvr32.exe	explorer.exe
PID 4068 wrote to memory of 644	4068	regsvr32.exe	explorer.exe
PID 644 wrote to memory of 824	644	explorer.exe	schtasks.exe
PID 644 wrote to memory of 824	644	explorer.exe	schtasks.exe
PID 644 wrote to memory of 824	644	explorer.exe	schtasks.exe
PID 3364 wrote to memory of 3488	3364	regsvr32.exe	regsvr32.exe
PID 3364 wrote to memory of 3488	3364	regsvr32.exe	regsvr32.exe
PID 3364 wrote to memory of 3488	3364	regsvr32.exe	regsvr32.exe
PID 3488 wrote to memory of 3856	3488	regsvr32.exe	explorer.exe
PID 3488 wrote to memory of 3856	3488	regsvr32.exe	explorer.exe
PID 3488 wrote to memory of 3856	3488	regsvr32.exe	explorer.exe
PID 3488 wrote to memory of 3856	3488	regsvr32.exe	explorer.exe
PID 3488 wrote to memory of 3856	3488	regsvr32.exe	explorer.exe
PID 3856 wrote to memory of 2004	3856	explorer.exe	reg.exe
PID 3856 wrote to memory of 2004	3856	explorer.exe	reg.exe
PID 3856 wrote to memory of 764	3856	explorer.exe	reg.exe
PID 3856 wrote to memory of 764	3856	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\test1.test.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4016

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\test1.test.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4068

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:644

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jrmdixk /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test1.test.dll\"" /SC ONCE /Z /ST 17:19 /ET 17:31
4⤵
- Creates scheduled task(s)
PID:824

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test1.test.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3364

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\test1.test.dll"
2⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3488

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3856

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ckshyr" /d "0"
4⤵
PID:2004

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Fgszwvd" /d "0"
4⤵
PID:764

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test1.test.dll
MD5
8538019c513379a092104fa35dfd5d76

SHA1
f524fea3b2f880359c2ed44453e5515c9f99cefe

SHA256
b69d373340bdd8dde8c718286c5f2bb8e1bbfc0c817f0fc7d5b1b712e4ef85ff

SHA512
5c3ed2a46507d7fa797a61ac54085a206dac66014a8e1b7217b134fd640f53c7d23c04e4f1f368aac27417262118dbb450bf979aa1fffa4dedd5b780b362cf1e

Download Submit
\Users\Admin\AppData\Local\Temp\test1.test.dll
MD5
8538019c513379a092104fa35dfd5d76

SHA1
f524fea3b2f880359c2ed44453e5515c9f99cefe

SHA256
b69d373340bdd8dde8c718286c5f2bb8e1bbfc0c817f0fc7d5b1b712e4ef85ff

SHA512
5c3ed2a46507d7fa797a61ac54085a206dac66014a8e1b7217b134fd640f53c7d23c04e4f1f368aac27417262118dbb450bf979aa1fffa4dedd5b780b362cf1e

Download Submit
memory/644-117-0x0000000000000000-mapping.dmp

Download
memory/644-121-0x0000000002F30000-0x0000000002F51000-memory.dmp

Filesize
132KB

Download
memory/764-127-0x0000000000000000-mapping.dmp

Download
memory/824-118-0x0000000000000000-mapping.dmp

Download
memory/2004-126-0x0000000000000000-mapping.dmp

Download
memory/3488-123-0x0000000000000000-mapping.dmp

Download
memory/3856-125-0x0000000000000000-mapping.dmp

Download
memory/3856-130-0x00000000032E0000-0x0000000003301000-memory.dmp

Filesize
132KB

Download
memory/4068-114-0x0000000000000000-mapping.dmp

Download
memory/4068-115-0x0000000001150000-0x0000000001151000-memory.dmp

Filesize
4KB

Download
memory/4068-116-0x0000000010000000-0x0000000010175000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads