qakbot | 1f66f20ac68d80ccdc30210ed8e8abb191aa5bfe4f65e58d3fca2eab8aaa5d49

General

Target

test2.test.dll
Size

662KB
MD5

e118e7243284e30f351ef5d971990196
SHA1

0d707a965e2e88b69fa5c920d3205f1b2e759718
SHA256

1f66f20ac68d80ccdc30210ed8e8abb191aa5bfe4f65e58d3fca2eab8aaa5d49
SHA512

89999c787c05faeafc349bdfbc012567b833020b9e10cdfc2f234f860a89d0e0c0b2c672e405164ed7c01d3e8b66cd3c9b67a1580d924504c7bcd5c85fc9502e

Score

10^/10

qakbot tr 1632730751 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

tr

Campaign

1632730751

C2

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1536 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1528 schtasks.exe

pid	process
1536	regsvr32.exe

pid	process
1528	schtasks.exe

Modifies data under HKEY_USERS 19 IoCs

Processes:

explorer.exeregsvr32.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rtphfoyzwfh\94dc924b = 882cabf886a4dbaf72db2a8f180a38e21b2510c510c118c97fbf8826b94af10ef70ddd8f911aca6d00071012c3b9eeceb0dd3027468f764c040942d239a1e1a918acd30622f7d0a837f5badb887394e6b41504c663cbe583afdbd4630258443a6a787bf3a40396df214200a6d706b31d596d48fe31f9aaa4b7eac4119a3b629af8522f8726a4b89499da2a03	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	regsvr32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rtphfoyzwfh\a1434205 = f7b21a8fcfd95eac03e26b0af3674dcb9dc640d604ee01528378d4933afe2ca177af444f9db8f8540e17aaac6c3dfc988e16c565a74bad278e5ac6c44efe583b4e825612424b877ca23cfe8d0f228f6da8104fc0a14513d848cca025f25882258f10c4d1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rtphfoyzwfh\969db237 = 2bcbf588072442ba1bca03f975d03d72e39733ace4a2a2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rtphfoyzwfh\eb95fdbd = 4ded478c9212bea8f813ee3b9cd46190a1eda68638c959c1a11f050fafba3da77cf740e9277061f031198699db750d1555a6b190a1c14ef9747e290b434d8b49a91121f058d8e5a142c3a1c08edb3150830b8ddfec2078d056edd8f3751625df4c374082b4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rtphfoyzwfh\de0a2df3 = 323ab99741aa0fab8cd53359a8532df7f8a0c968be4c513e457c7e71d7591a24b3bc4deaaa9469b510532a6c400c0ff1a137d3b76d75cc4fd5060aaa3106e4c4da5b017aed67d2	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rtphfoyzwfh	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rtphfoyzwfh\2e21d552 = eb1270b04c4494595068e64748ced8fe1937f34393a87c051395b5f247efbcf545a145d035bb61787ce94cad497ef5905b6ff0ed00ae345a169f4ea0963b1a46c76890e8b4134ed151c9148167e1b43318c2e1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rtphfoyzwfh\53299ad8 = c493042a02595876fbc0bc0c47c22394fe2ce9fd89bc5296fc907ea6bc85acd1489f3bc9b2ee463ee1d94c	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	regsvr32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rtphfoyzwfh\2c60f52e = 1b25ef593a24a59bd3d7977edf5730f6b23bf08ae4b4abd8cc30bbd3491d7e39bc6349d39c09c327a23923d4321eedd6f580b3a06d4a9e79521d421e2ddaeef168d85cc5261696becaa7c8d7a671a3c04c5dff68c3215d6fa155d441470512237e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rtphfoyzwfh\a1434205 = f7b20d8fcfd96b78e72d0f33f4c737c3c1b40a384c1d725021a9e868d3c6338149b98c9a6e632871980ade702452211f89cc7982a60afda511e46ea441f25224bd0a46eb71c0ccc2d4cbf502ee15582576a4937108a7d753600e3e9b829e0218c9d1b952f8e57e3f57150d910da2a0e4eec657cb5e92f06f14	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\System	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1852 regsvr32.exe
1536 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1852 regsvr32.exe
1536 regsvr32.exe

pid	process
1852	regsvr32.exe
1536	regsvr32.exe

pid	process
1852	regsvr32.exe
1536	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1028 wrote to memory of 1852	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1852	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1852	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1852	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1852	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1852	1028	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1852	1028	regsvr32.exe	regsvr32.exe
PID 1852 wrote to memory of 1840	1852	regsvr32.exe	explorer.exe
PID 1852 wrote to memory of 1840	1852	regsvr32.exe	explorer.exe
PID 1852 wrote to memory of 1840	1852	regsvr32.exe	explorer.exe
PID 1852 wrote to memory of 1840	1852	regsvr32.exe	explorer.exe
PID 1852 wrote to memory of 1840	1852	regsvr32.exe	explorer.exe
PID 1852 wrote to memory of 1840	1852	regsvr32.exe	explorer.exe
PID 1840 wrote to memory of 1528	1840	explorer.exe	schtasks.exe
PID 1840 wrote to memory of 1528	1840	explorer.exe	schtasks.exe
PID 1840 wrote to memory of 1528	1840	explorer.exe	schtasks.exe
PID 1840 wrote to memory of 1528	1840	explorer.exe	schtasks.exe
PID 1452 wrote to memory of 1620	1452	taskeng.exe	regsvr32.exe
PID 1452 wrote to memory of 1620	1452	taskeng.exe	regsvr32.exe
PID 1452 wrote to memory of 1620	1452	taskeng.exe	regsvr32.exe
PID 1452 wrote to memory of 1620	1452	taskeng.exe	regsvr32.exe
PID 1452 wrote to memory of 1620	1452	taskeng.exe	regsvr32.exe
PID 1620 wrote to memory of 1536	1620	regsvr32.exe	regsvr32.exe
PID 1620 wrote to memory of 1536	1620	regsvr32.exe	regsvr32.exe
PID 1620 wrote to memory of 1536	1620	regsvr32.exe	regsvr32.exe
PID 1620 wrote to memory of 1536	1620	regsvr32.exe	regsvr32.exe
PID 1620 wrote to memory of 1536	1620	regsvr32.exe	regsvr32.exe
PID 1620 wrote to memory of 1536	1620	regsvr32.exe	regsvr32.exe
PID 1620 wrote to memory of 1536	1620	regsvr32.exe	regsvr32.exe
PID 1536 wrote to memory of 456	1536	regsvr32.exe	explorer.exe
PID 1536 wrote to memory of 456	1536	regsvr32.exe	explorer.exe
PID 1536 wrote to memory of 456	1536	regsvr32.exe	explorer.exe
PID 1536 wrote to memory of 456	1536	regsvr32.exe	explorer.exe
PID 1536 wrote to memory of 456	1536	regsvr32.exe	explorer.exe
PID 1536 wrote to memory of 456	1536	regsvr32.exe	explorer.exe
PID 456 wrote to memory of 564	456	explorer.exe	reg.exe
PID 456 wrote to memory of 564	456	explorer.exe	reg.exe
PID 456 wrote to memory of 564	456	explorer.exe	reg.exe
PID 456 wrote to memory of 564	456	explorer.exe	reg.exe
PID 456 wrote to memory of 664	456	explorer.exe	reg.exe
PID 456 wrote to memory of 664	456	explorer.exe	reg.exe
PID 456 wrote to memory of 664	456	explorer.exe	reg.exe
PID 456 wrote to memory of 664	456	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\test2.test.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\test2.test.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lcyhduwl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test2.test.dll\"" /SC ONCE /Z /ST 17:19 /ET 17:31
4⤵
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\taskeng.exe
taskeng.exe {5EA8BB09-A084-4099-B17B-E0164F542345} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test2.test.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\test2.test.dll"
3⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:456

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ilzacusygk" /d "0"
5⤵
PID:564

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Piogkevfv" /d "0"
5⤵
PID:664

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test2.test.dll
MD5
e118e7243284e30f351ef5d971990196

SHA1
0d707a965e2e88b69fa5c920d3205f1b2e759718

SHA256
1f66f20ac68d80ccdc30210ed8e8abb191aa5bfe4f65e58d3fca2eab8aaa5d49

SHA512
89999c787c05faeafc349bdfbc012567b833020b9e10cdfc2f234f860a89d0e0c0b2c672e405164ed7c01d3e8b66cd3c9b67a1580d924504c7bcd5c85fc9502e

Download Submit
\Users\Admin\AppData\Local\Temp\test2.test.dll
MD5
e118e7243284e30f351ef5d971990196

SHA1
0d707a965e2e88b69fa5c920d3205f1b2e759718

SHA256
1f66f20ac68d80ccdc30210ed8e8abb191aa5bfe4f65e58d3fca2eab8aaa5d49

SHA512
89999c787c05faeafc349bdfbc012567b833020b9e10cdfc2f234f860a89d0e0c0b2c672e405164ed7c01d3e8b66cd3c9b67a1580d924504c7bcd5c85fc9502e

Download Submit
memory/456-81-0x0000000000120000-0x0000000000141000-memory.dmp

Filesize
132KB

Download
memory/456-76-0x0000000000000000-mapping.dmp

Download
memory/564-79-0x0000000000000000-mapping.dmp

Download
memory/664-80-0x0000000000000000-mapping.dmp

Download
memory/1028-60-0x000007FEFBD61000-0x000007FEFBD63000-memory.dmp

Filesize
8KB

Download
memory/1528-68-0x0000000000000000-mapping.dmp

Download
memory/1536-73-0x0000000000000000-mapping.dmp

Download
memory/1620-70-0x0000000000000000-mapping.dmp

Download
memory/1840-69-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1840-67-0x00000000744B1000-0x00000000744B3000-memory.dmp

Filesize
8KB

Download
memory/1840-65-0x0000000000000000-mapping.dmp

Download
memory/1852-64-0x0000000010000000-0x0000000010175000-memory.dmp

Filesize
1.5MB

Download
memory/1852-63-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1852-62-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1852-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads