qakbot | 1f66f20ac68d80ccdc30210ed8e8abb191aa5bfe4f65e58d3fca2eab8aaa5d49

General

Target

test2.test.dll
Size

662KB
MD5

e118e7243284e30f351ef5d971990196
SHA1

0d707a965e2e88b69fa5c920d3205f1b2e759718
SHA256

1f66f20ac68d80ccdc30210ed8e8abb191aa5bfe4f65e58d3fca2eab8aaa5d49
SHA512

89999c787c05faeafc349bdfbc012567b833020b9e10cdfc2f234f860a89d0e0c0b2c672e405164ed7c01d3e8b66cd3c9b67a1580d924504c7bcd5c85fc9502e

Score

10^/10

qakbot tr 1632730751 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

tr

Campaign

1632730751

C2

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1896 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3860 schtasks.exe

pid	process
1896	regsvr32.exe

pid	process
3860	schtasks.exe

Modifies data under HKEY_USERS 18 IoCs

Processes:

regsvr32.exeexplorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	regsvr32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwfwlmck\cf75bbf5 = 533b6daf13e45a2b610e40	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwfwlmck\faea6bbb = c7351ce6eb33b3651bbdc95701d3ec9acba5c9a11a4be49da441a1a6a7867846438ed716530a0726615e8b09e56394f8f543174e5d7c2d6b0a65516e3ddf7d2d4642ecaef60501022237d254126a0406d9740569ae4012110fe0ccff8b24fc71322906a80f89bfa3632f158166acf0865a8a65b07a57d1283c254ecac460cc33473239438d52f371a973907fcccd9f07344562694db7ae317fd255	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwfwlmck	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwfwlmck\f8ab4bc7 = cac65f90d9882ae255f4f7fb0cbb1c8f7093d167fb925acdcca4af648b9ff017acff464bb812b8724f349051096c4b264e78d707625dbc1cd6d2dd6767dcfaf9a6a1e90cd310dfc7d45b2f39534b0025f789facabbd6384387e54b6b15546cddfdb01cbec6f65ae677	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwfwlmck\42560cde = c5622e8691e47f13df57bed50d0162cb64abedbb7f2a504cd1be88ee9d59cdf1b60980465e9a8a717f072b7052f69c6314fe5074f3e2539cd939aa6c6e5d258a00c61253b30d3c19c7ab8b012d66115b2693ab75d3fab9a360d0874460b6d624916fe51b938a7c03e6d785	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwfwlmck\b03cd403 = 9c8825f5742e816e0955da7d0fdb3caac27c10eb0c41e1d3fb1b5511a782a2b29cee4561464af86ba62b85ba93789d2d4a768c8203fe39f1fafd13af60defc80bd4830	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\System	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	regsvr32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwfwlmck\40172ca2 = 3ad59ceac9a7d4d3060b4410be22a42ae4953858ae8eb2069e023433b1b3cba123cf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwfwlmck\cf75bbf5 = 533b7aaf13e46faf45288ae7766eedb5781b6e3d09e1f1441ea068e3558a03d5	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties	regsvr32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwfwlmck\3d1f6328 = 38c7ca3af512ba5a4962d0b52b6e028cd4ae2f891b9ab4cae70e5b15607a96297acdb1c9d5ebe0abdff23995758d7cda4b684d9c56530eec37c8db6d7b4f7794384847ec559f682c322168d741c3c74c6bd9b0ada647cd36c9300b4443715d4c138597163037c0f4c6c998	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ilwfwlmck\85a3044d = e30a986738e68c8f55a0b3205d0e6540e017f9d726538e0492b340e6b01fe1c69c27b2a76201c466f5db85b343dbecde81809c5a6b30c889	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2708 regsvr32.exe
2708 regsvr32.exe
1896 regsvr32.exe
1896 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2708 regsvr32.exe
1896 regsvr32.exe

pid	process
2708	regsvr32.exe
2708	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe

pid	process
2708	regsvr32.exe
1896	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2468 wrote to memory of 2708	2468	regsvr32.exe	regsvr32.exe
PID 2468 wrote to memory of 2708	2468	regsvr32.exe	regsvr32.exe
PID 2468 wrote to memory of 2708	2468	regsvr32.exe	regsvr32.exe
PID 2708 wrote to memory of 2072	2708	regsvr32.exe	explorer.exe
PID 2708 wrote to memory of 2072	2708	regsvr32.exe	explorer.exe
PID 2708 wrote to memory of 2072	2708	regsvr32.exe	explorer.exe
PID 2708 wrote to memory of 2072	2708	regsvr32.exe	explorer.exe
PID 2708 wrote to memory of 2072	2708	regsvr32.exe	explorer.exe
PID 2072 wrote to memory of 3860	2072	explorer.exe	schtasks.exe
PID 2072 wrote to memory of 3860	2072	explorer.exe	schtasks.exe
PID 2072 wrote to memory of 3860	2072	explorer.exe	schtasks.exe
PID 3244 wrote to memory of 1896	3244	regsvr32.exe	regsvr32.exe
PID 3244 wrote to memory of 1896	3244	regsvr32.exe	regsvr32.exe
PID 3244 wrote to memory of 1896	3244	regsvr32.exe	regsvr32.exe
PID 1896 wrote to memory of 1176	1896	regsvr32.exe	explorer.exe
PID 1896 wrote to memory of 1176	1896	regsvr32.exe	explorer.exe
PID 1896 wrote to memory of 1176	1896	regsvr32.exe	explorer.exe
PID 1896 wrote to memory of 1176	1896	regsvr32.exe	explorer.exe
PID 1896 wrote to memory of 1176	1896	regsvr32.exe	explorer.exe
PID 1176 wrote to memory of 1332	1176	explorer.exe	reg.exe
PID 1176 wrote to memory of 1332	1176	explorer.exe	reg.exe
PID 1176 wrote to memory of 2196	1176	explorer.exe	reg.exe
PID 1176 wrote to memory of 2196	1176	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\test2.test.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2468

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\test2.test.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2708

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kxrtuce /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test2.test.dll\"" /SC ONCE /Z /ST 15:19 /ET 15:31
4⤵
- Creates scheduled task(s)
PID:3860

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test2.test.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3244

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\test2.test.dll"
2⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ubrdvzyy" /d "0"
4⤵
PID:1332

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Luqzrmombrnv" /d "0"
4⤵
PID:2196

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test2.test.dll
MD5
e118e7243284e30f351ef5d971990196

SHA1
0d707a965e2e88b69fa5c920d3205f1b2e759718

SHA256
1f66f20ac68d80ccdc30210ed8e8abb191aa5bfe4f65e58d3fca2eab8aaa5d49

SHA512
89999c787c05faeafc349bdfbc012567b833020b9e10cdfc2f234f860a89d0e0c0b2c672e405164ed7c01d3e8b66cd3c9b67a1580d924504c7bcd5c85fc9502e

Download Submit
\Users\Admin\AppData\Local\Temp\test2.test.dll
MD5
e118e7243284e30f351ef5d971990196

SHA1
0d707a965e2e88b69fa5c920d3205f1b2e759718

SHA256
1f66f20ac68d80ccdc30210ed8e8abb191aa5bfe4f65e58d3fca2eab8aaa5d49

SHA512
89999c787c05faeafc349bdfbc012567b833020b9e10cdfc2f234f860a89d0e0c0b2c672e405164ed7c01d3e8b66cd3c9b67a1580d924504c7bcd5c85fc9502e

Download Submit
memory/1176-126-0x0000000000000000-mapping.dmp

Download
memory/1176-131-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Filesize
132KB

Download
memory/1332-127-0x0000000000000000-mapping.dmp

Download
memory/1896-124-0x0000000000000000-mapping.dmp

Download
memory/2072-118-0x0000000000000000-mapping.dmp

Download
memory/2072-122-0x0000000000B60000-0x0000000000B81000-memory.dmp

Filesize
132KB

Download
memory/2196-128-0x0000000000000000-mapping.dmp

Download
memory/2708-116-0x0000000005430000-0x0000000005431000-memory.dmp

Filesize
4KB

Download
memory/2708-117-0x0000000010000000-0x0000000010175000-memory.dmp

Filesize
1.5MB

Download
memory/2708-115-0x0000000000000000-mapping.dmp

Download
memory/3860-119-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads