qakbot | dd8b18f31dcfa89865629c0264283f6631d38d535b077a8afb3c55d8b677075c

General

Target

noykjyxdmw.dll
Size

1.3MB
MD5

9ad3a0d8b2064d12a9098952c7ac3ee2
SHA1

bf59513b280b6a3d4fb7bf6c5c2836fa6d5ee4a2
SHA256

dd8b18f31dcfa89865629c0264283f6631d38d535b077a8afb3c55d8b677075c
SHA512

7a7e152c08889e399af1e126efa3f74638d2273ffecc8e779d752052bf75e2288b915909cd4d633045be9cb02bb84b948a82b958e1f8bdba200787320d23374e

Score

10^/10

qakbot notset 1632819510 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

notset

Campaign

1632819510

C2

196.217.156.63:995

120.150.218.241:995

95.77.223.148:443

185.250.148.74:443

181.118.183.94:443

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1188 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1556 schtasks.exe

pid	process
1188	regsvr32.exe

pid	process
1556	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ngyjueyakx	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ngyjueyakx\2245033f = 3673c14a26e30815a6a8ad9ea9ab0209e4d7cc9514b7f341842d76fbdd9357f31dd274c5ae69317755fd8954bb5008ea1dd00cb3d04898482d17818098e2ba971bf002333f327a314a3526c819407def93cb3e389b851313389bf49a8856c28e4d105dd316e72d9d28b387192354af5a9dc90f1950f89f7f8305884d6832052c9adf0d72b54ed8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ngyjueyakx\20042343 = 320077b93364e10829c3eb74c4f6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ngyjueyakx\6893bc87 = 633a107b5981d0e91818c838e4561b58c728fc4601ad648a97cd2cb81dd93fa053	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ngyjueyakx\17dad371 = 5bcd24c471a0e06d813a02a67749e6a1e13be7580de68885b0afb85d40fe330941b82f24fa766ef55c011e820cf6b90d06af41a07a7953342e1625508232e8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ngyjueyakx\17dad371 = 5bcd33c471a0d57267bdaf7ae11b901768d40e9e1c6edabda1e3eb1fcd1802914d039ae6aa81157106e8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ngyjueyakx\98b84426 = ecca2adce2f90ed6599effb3fc8f5cbd9bf39c46165b611f3ec2bb3094b4ffc631447848e7d977d0f29dfb6927b03ca5a39d2b2dd6d0015ad61ce2e0f926a44335c24ced6fd11a18b2158a700489c1ed2e699d304c5778c3a52abadef6227c21dce8018544d27b432b9cdbda673a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ngyjueyakx\e5b00bac = 78a15b68d4a4ff6c086b3ad9e18ee356606dbc3164938a86ed51f90ea2237abf38e641041e0bcf6cb11a2594ae6a2224f536d52786e6d47a94171d5ca5a29f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ngyjueyakx\5d0c6cc9 = 4e38ff5e9c80b3d522c12c3392639984074e10e0bf2d7ed9d8669dd4d31d47c2ab191f4b676d42d1ab	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ngyjueyakx\9af9645a = e45f99e340bd98cfd39dc99817bc1af6f8e9c34d5628ae84366cb0a23f815f3509a8b96cc8	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1520 rundll32.exe
1188 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1520 rundll32.exe
1188 regsvr32.exe

pid	process
1520	rundll32.exe
1188	regsvr32.exe

pid	process
1520	rundll32.exe
1188	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1464 wrote to memory of 1520	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1520	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1520	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1520	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1520	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1520	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 1520	1464	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 1584	1520	rundll32.exe	explorer.exe
PID 1520 wrote to memory of 1584	1520	rundll32.exe	explorer.exe
PID 1520 wrote to memory of 1584	1520	rundll32.exe	explorer.exe
PID 1520 wrote to memory of 1584	1520	rundll32.exe	explorer.exe
PID 1520 wrote to memory of 1584	1520	rundll32.exe	explorer.exe
PID 1520 wrote to memory of 1584	1520	rundll32.exe	explorer.exe
PID 1584 wrote to memory of 1556	1584	explorer.exe	schtasks.exe
PID 1584 wrote to memory of 1556	1584	explorer.exe	schtasks.exe
PID 1584 wrote to memory of 1556	1584	explorer.exe	schtasks.exe
PID 1584 wrote to memory of 1556	1584	explorer.exe	schtasks.exe
PID 836 wrote to memory of 1260	836	taskeng.exe	regsvr32.exe
PID 836 wrote to memory of 1260	836	taskeng.exe	regsvr32.exe
PID 836 wrote to memory of 1260	836	taskeng.exe	regsvr32.exe
PID 836 wrote to memory of 1260	836	taskeng.exe	regsvr32.exe
PID 836 wrote to memory of 1260	836	taskeng.exe	regsvr32.exe
PID 1260 wrote to memory of 1188	1260	regsvr32.exe	regsvr32.exe
PID 1260 wrote to memory of 1188	1260	regsvr32.exe	regsvr32.exe
PID 1260 wrote to memory of 1188	1260	regsvr32.exe	regsvr32.exe
PID 1260 wrote to memory of 1188	1260	regsvr32.exe	regsvr32.exe
PID 1260 wrote to memory of 1188	1260	regsvr32.exe	regsvr32.exe
PID 1260 wrote to memory of 1188	1260	regsvr32.exe	regsvr32.exe
PID 1260 wrote to memory of 1188	1260	regsvr32.exe	regsvr32.exe
PID 1188 wrote to memory of 1160	1188	regsvr32.exe	explorer.exe
PID 1188 wrote to memory of 1160	1188	regsvr32.exe	explorer.exe
PID 1188 wrote to memory of 1160	1188	regsvr32.exe	explorer.exe
PID 1188 wrote to memory of 1160	1188	regsvr32.exe	explorer.exe
PID 1188 wrote to memory of 1160	1188	regsvr32.exe	explorer.exe
PID 1188 wrote to memory of 1160	1188	regsvr32.exe	explorer.exe
PID 1160 wrote to memory of 1536	1160	explorer.exe	reg.exe
PID 1160 wrote to memory of 1536	1160	explorer.exe	reg.exe
PID 1160 wrote to memory of 1536	1160	explorer.exe	reg.exe
PID 1160 wrote to memory of 1536	1160	explorer.exe	reg.exe
PID 1160 wrote to memory of 1668	1160	explorer.exe	reg.exe
PID 1160 wrote to memory of 1668	1160	explorer.exe	reg.exe
PID 1160 wrote to memory of 1668	1160	explorer.exe	reg.exe
PID 1160 wrote to memory of 1668	1160	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\noykjyxdmw.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\noykjyxdmw.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zaqesvfqhd /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\noykjyxdmw.dll\"" /SC ONCE /Z /ST 18:22 /ET 18:34
4⤵
- Creates scheduled task(s)
PID:1556

C:\Windows\system32\taskeng.exe
taskeng.exe {672E8410-8147-4475-BCFD-740D4D499DD4} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\noykjyxdmw.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\noykjyxdmw.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1188

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Oayexuio" /d "0"
5⤵
PID:1536

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Phqcjr" /d "0"
5⤵
PID:1668

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\noykjyxdmw.dll
MD5
9ad3a0d8b2064d12a9098952c7ac3ee2

SHA1
bf59513b280b6a3d4fb7bf6c5c2836fa6d5ee4a2

SHA256
dd8b18f31dcfa89865629c0264283f6631d38d535b077a8afb3c55d8b677075c

SHA512
7a7e152c08889e399af1e126efa3f74638d2273ffecc8e779d752052bf75e2288b915909cd4d633045be9cb02bb84b948a82b958e1f8bdba200787320d23374e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\noykjyxdmw.dll
MD5
9ad3a0d8b2064d12a9098952c7ac3ee2

SHA1
bf59513b280b6a3d4fb7bf6c5c2836fa6d5ee4a2

SHA256
dd8b18f31dcfa89865629c0264283f6631d38d535b077a8afb3c55d8b677075c

SHA512
7a7e152c08889e399af1e126efa3f74638d2273ffecc8e779d752052bf75e2288b915909cd4d633045be9cb02bb84b948a82b958e1f8bdba200787320d23374e

Download Submit
memory/1160-76-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1160-71-0x0000000000000000-mapping.dmp

Download
memory/1188-74-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1188-75-0x00000000008E0000-0x0000000000901000-memory.dmp

Filesize
132KB

Download
memory/1188-70-0x00000000009E0000-0x0000000000B27000-memory.dmp

Filesize
1.3MB

Download
memory/1188-67-0x0000000000000000-mapping.dmp

Download
memory/1260-64-0x0000000000000000-mapping.dmp

Download
memory/1260-65-0x000007FEFBF91000-0x000007FEFBF93000-memory.dmp

Filesize
8KB

Download
memory/1520-55-0x0000000000850000-0x0000000000997000-memory.dmp

Filesize
1.3MB

Download
memory/1520-53-0x0000000000000000-mapping.dmp

Download
memory/1520-60-0x0000000000230000-0x0000000000251000-memory.dmp

Filesize
132KB

Download
memory/1520-61-0x00000000009A0000-0x00000000009C1000-memory.dmp

Filesize
132KB

Download
memory/1520-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/1520-56-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1536-78-0x0000000000000000-mapping.dmp

Download
memory/1556-63-0x0000000000000000-mapping.dmp

Download
memory/1584-62-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1584-57-0x0000000000000000-mapping.dmp

Download
memory/1584-59-0x0000000074A81000-0x0000000074A83000-memory.dmp

Filesize
8KB

Download
memory/1668-79-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads