qakbot | 41dd0bd719d55ba7aad212f014ab9ca3f53451d2764a4d2131ca4b56cd7e89bc

General

Target

41dd0bd719d55ba7aad212f014ab9ca3f53451d2764a4d2131ca4b56cd7e89bc.dll
Size

472KB
MD5

cafa0dc9bed83ab89331b03f575a6bc7
SHA1

79f19eda2943d515dd0c3ad80278cacac7826a05
SHA256

41dd0bd719d55ba7aad212f014ab9ca3f53451d2764a4d2131ca4b56cd7e89bc
SHA512

b9f60725b9cc30e7f6c0f934bc9a1af0b6ffa92389b171e0477f56e1674a0a2530d07c31985e9dd19b055fa35a995f22ba667e51c785ad7f77f2f3f71fc14c37

Score

10^/10

qakbot tr 1632817399 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1632817399

C2

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

181.118.183.94:443

120.150.218.241:995

185.250.148.74:443

95.77.223.148:443

75.66.88.33:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

756 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1164 schtasks.exe

pid	process
756	regsvr32.exe

pid	process
1164	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqijyhqihfyi\b061e24 = ef4accf3e90e42366c4eda5843b3d6ad407f57f463b7b55647d05f9e8757112aca9d84e5c67c8e92ae5c6287d080b93d44a4796d7e70b1dc217c5046168b2ac000639d8f1ff7e9fc556a7a7768	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqijyhqihfyi\b3ba7941 = 9c2bb2d121b59c55f70ac6099dce9a17bdd288098247b13ff4c42eb15d283c70b25663f4afb34ff93a91bb5ba56305b0078144c0ab45091f40b7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqijyhqihfyi\744f71d2 = d8c726b919b27324d009cf09965e5eee991d26bffbdfd2d4ea1a96b55e738571985a689777a216b00b533e4e4d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqijyhqihfyi\f96cc6f9 = 3a3174e03d4fc28d69e3dbe61e7d8670d8b628b310f7a8d15f8823e3c4be58bef598c01bf60e177a04767e4e9c1ea5f2bde67e7297fd5ef818d4e28aa7149cf2b1073d56f52bf25efe0e154a3ed1ba7f6680e148e01b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aqijyhqihfyi	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqijyhqihfyi\f96cc6f9 = 3a3163e03d4ff7b1a9d078bfb959143c78611d069232cd8621a8a71e2b079d2186c37ad071342a87fc99efe76d86fdc444c3e679a3d2f33ae2ef50961a2d51f8ab	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqijyhqihfyi\ccf316b7 = b0ad9dbaa81d3361480493b39db21d7b61ded0c5ea6eb76eff7390e4bdf8a0d2cce50f6fc846b7df9778b0e30d2428ad3e1264a70235e431163c8cb7fc3b375fc31702eba83dc534f291e4102905007915b38f279c08665bb56a3d1da1b61a34de4f4decb3be5e079f98676c8f14d8b43f77c5b5c1cc029f6525f660d41176c7bde308e3e0f8c4f826cfb75a3373419dedf66b51c4359a0a19af42bc71a3877ac30b2abedf36663f3d537bbebad8370f0a72ace9f833df83af6c0c972cb20d92c7c439	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqijyhqihfyi\ceb236cb = a41e1a69f75bb0c0411beb3b7795d7e0f27caf54115cd09e6b3fe7fc47ae52208214797814b60849066c1082ee	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqijyhqihfyi\760e51ae = a3ee4d23caaa83f1c7015f33cfb455d789fafec1afb88b4529e70fd79451fe71f5b647da005db918aec0eed31f74039d88d2ee6d8529c680c08c1234e528c937a29614f92b9069da138dcb759abe64b42cf94edc20bae89a076b9fbf96cb2b1b2519	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqijyhqihfyi\8625a90f = 98c969352c6fa8a73daa3a218ae28007d177c49383e48194fb1dd3ceed0cf918dfdde7	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1596 rundll32.exe
756 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1596 rundll32.exe
756 regsvr32.exe

pid	process
1596	rundll32.exe
756	regsvr32.exe

pid	process
1596	rundll32.exe
756	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1540 wrote to memory of 1596	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1596	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1596	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1596	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1596	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1596	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1596	1540	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1792	1596	rundll32.exe	explorer.exe
PID 1596 wrote to memory of 1792	1596	rundll32.exe	explorer.exe
PID 1596 wrote to memory of 1792	1596	rundll32.exe	explorer.exe
PID 1596 wrote to memory of 1792	1596	rundll32.exe	explorer.exe
PID 1596 wrote to memory of 1792	1596	rundll32.exe	explorer.exe
PID 1596 wrote to memory of 1792	1596	rundll32.exe	explorer.exe
PID 1792 wrote to memory of 1164	1792	explorer.exe	schtasks.exe
PID 1792 wrote to memory of 1164	1792	explorer.exe	schtasks.exe
PID 1792 wrote to memory of 1164	1792	explorer.exe	schtasks.exe
PID 1792 wrote to memory of 1164	1792	explorer.exe	schtasks.exe
PID 1800 wrote to memory of 1760	1800	taskeng.exe	regsvr32.exe
PID 1800 wrote to memory of 1760	1800	taskeng.exe	regsvr32.exe
PID 1800 wrote to memory of 1760	1800	taskeng.exe	regsvr32.exe
PID 1800 wrote to memory of 1760	1800	taskeng.exe	regsvr32.exe
PID 1800 wrote to memory of 1760	1800	taskeng.exe	regsvr32.exe
PID 1760 wrote to memory of 756	1760	regsvr32.exe	regsvr32.exe
PID 1760 wrote to memory of 756	1760	regsvr32.exe	regsvr32.exe
PID 1760 wrote to memory of 756	1760	regsvr32.exe	regsvr32.exe
PID 1760 wrote to memory of 756	1760	regsvr32.exe	regsvr32.exe
PID 1760 wrote to memory of 756	1760	regsvr32.exe	regsvr32.exe
PID 1760 wrote to memory of 756	1760	regsvr32.exe	regsvr32.exe
PID 1760 wrote to memory of 756	1760	regsvr32.exe	regsvr32.exe
PID 756 wrote to memory of 1936	756	regsvr32.exe	explorer.exe
PID 756 wrote to memory of 1936	756	regsvr32.exe	explorer.exe
PID 756 wrote to memory of 1936	756	regsvr32.exe	explorer.exe
PID 756 wrote to memory of 1936	756	regsvr32.exe	explorer.exe
PID 756 wrote to memory of 1936	756	regsvr32.exe	explorer.exe
PID 756 wrote to memory of 1936	756	regsvr32.exe	explorer.exe
PID 1936 wrote to memory of 1868	1936	explorer.exe	reg.exe
PID 1936 wrote to memory of 1868	1936	explorer.exe	reg.exe
PID 1936 wrote to memory of 1868	1936	explorer.exe	reg.exe
PID 1936 wrote to memory of 1868	1936	explorer.exe	reg.exe
PID 1936 wrote to memory of 1632	1936	explorer.exe	reg.exe
PID 1936 wrote to memory of 1632	1936	explorer.exe	reg.exe
PID 1936 wrote to memory of 1632	1936	explorer.exe	reg.exe
PID 1936 wrote to memory of 1632	1936	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41dd0bd719d55ba7aad212f014ab9ca3f53451d2764a4d2131ca4b56cd7e89bc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41dd0bd719d55ba7aad212f014ab9ca3f53451d2764a4d2131ca4b56cd7e89bc.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qjtbvniuyb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\41dd0bd719d55ba7aad212f014ab9ca3f53451d2764a4d2131ca4b56cd7e89bc.dll\"" /SC ONCE /Z /ST 16:41 /ET 16:53
4⤵
- Creates scheduled task(s)
PID:1164

C:\Windows\system32\taskeng.exe
taskeng.exe {6533DA62-787B-4971-A6CB-A8D4432B5734} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\41dd0bd719d55ba7aad212f014ab9ca3f53451d2764a4d2131ca4b56cd7e89bc.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\41dd0bd719d55ba7aad212f014ab9ca3f53451d2764a4d2131ca4b56cd7e89bc.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Uaakxlge" /d "0"
5⤵
PID:1868

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Nummkwt" /d "0"
5⤵
PID:1632

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\41dd0bd719d55ba7aad212f014ab9ca3f53451d2764a4d2131ca4b56cd7e89bc.dll
MD5
cafa0dc9bed83ab89331b03f575a6bc7

SHA1
79f19eda2943d515dd0c3ad80278cacac7826a05

SHA256
41dd0bd719d55ba7aad212f014ab9ca3f53451d2764a4d2131ca4b56cd7e89bc

SHA512
b9f60725b9cc30e7f6c0f934bc9a1af0b6ffa92389b171e0477f56e1674a0a2530d07c31985e9dd19b055fa35a995f22ba667e51c785ad7f77f2f3f71fc14c37

Download Submit
\Users\Admin\AppData\Local\Temp\41dd0bd719d55ba7aad212f014ab9ca3f53451d2764a4d2131ca4b56cd7e89bc.dll
MD5
cafa0dc9bed83ab89331b03f575a6bc7

SHA1
79f19eda2943d515dd0c3ad80278cacac7826a05

SHA256
41dd0bd719d55ba7aad212f014ab9ca3f53451d2764a4d2131ca4b56cd7e89bc

SHA512
b9f60725b9cc30e7f6c0f934bc9a1af0b6ffa92389b171e0477f56e1674a0a2530d07c31985e9dd19b055fa35a995f22ba667e51c785ad7f77f2f3f71fc14c37

Download Submit
memory/756-66-0x0000000000000000-mapping.dmp

Download
memory/756-71-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/756-70-0x0000000010000000-0x0000000010085000-memory.dmp

Filesize
532KB

Download
memory/1164-62-0x0000000000000000-mapping.dmp

Download
memory/1596-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/1596-56-0x0000000010000000-0x0000000010085000-memory.dmp

Filesize
532KB

Download
memory/1596-55-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1596-60-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/1596-53-0x0000000000000000-mapping.dmp

Download
memory/1632-76-0x0000000000000000-mapping.dmp

Download
memory/1760-64-0x000007FEFC391000-0x000007FEFC393000-memory.dmp

Filesize
8KB

Download
memory/1760-63-0x0000000000000000-mapping.dmp

Download
memory/1792-61-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1792-59-0x0000000074F61000-0x0000000074F63000-memory.dmp

Filesize
8KB

Download
memory/1792-57-0x0000000000000000-mapping.dmp

Download
memory/1868-75-0x0000000000000000-mapping.dmp

Download
memory/1936-72-0x0000000000000000-mapping.dmp

Download
memory/1936-77-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads