qakbot | fe167b3b7c6a189f267c8bf457385add173bac089a3055bb04aaa60775e645f1

General

Target

test1.test.dll
Size

477KB
MD5

baacb3f7c4e0a1799b832765b2a9d356
SHA1

dd0001494dfb5426795dc45ed593f0677af3d5fa
SHA256

fe167b3b7c6a189f267c8bf457385add173bac089a3055bb04aaa60775e645f1
SHA512

74837fb494f50ad1600c78aee3f694d347ef04dfaf0865644527e02daaefabdf6dded9104b76e1b31dcb7272a5d7ab5f206f25cc4da1a0da94185371a0c667ca

Score

10^/10

qakbot tr 1632817399 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1632817399

C2

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

181.118.183.94:443

120.150.218.241:995

185.250.148.74:443

95.77.223.148:443

75.66.88.33:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1060 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3492 schtasks.exe

pid	process
1060	regsvr32.exe

pid	process
3492	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jigkihjbup\8fc90ab = 659ea1ca974e32208ea292ed67996e247b57d8762184db4825200b91515454bf60ea9377b964dd43f3835c339e351ecc16926202bfde9b3440633c71de297df0556e4dadf1ce426e122739f2150719338ebc1a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jigkihjbup\3d6340e5 = 2a8935f80dde9884e107f23e752502fc933d633c3f52ad7797b41616f2df8f2186d1cb3fcaf73b3eda98a92b61daece4c062c57a19e668ef684e9f58f76ffea69add8c505c124caaea683cbfe61587705201abd0d72b01de5165e1b6114d1533bb9c41aa9184137d668e123df3f0ec7730b4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jigkihjbup\fa964876 = 0ebbe717a6cc4f39b7e77d3b32114162280a5f88938be0a796820cda25db5c81873e7d1fa1df60377e95cff73d999e2aa3438841b67fe8ab96fa8ce45af82df3ce1d48b90593a35203	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jigkihjbup\422a2f13 = 126aaf2619bd07dff4640817a2a9ca13ce9a221e2ebc09afa7d58e0b21be2523c08fb3be6f4b57ab919eab4e0306f127e880d3f69d581bcaa36e0408b9d3fac5d7e67546b99be40ee082d53aa52e8b83ed12b6684c6c6027c8edf6b55c20bc8a7d84556244a2f40be34414e02c923016ae	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jigkihjbup\85df2780 = fec72da0be5e8a29c828e2f5c599f714265eb3a1cad6910bbedca44df869d8	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jigkihjbup	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jigkihjbup\3f226099 = cd92473196c22901307b277406d50872661ef5dc748b8ac4decf3cbc67b4be03cd3acc77d018dde169c5cc6098c97cb77726975e2ece8c73c87644de8bdecc815073	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jigkihjbup\879e07fc = fc69dcc520d4184d490737072b9ccc791c89b5bef3e70cbb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jigkihjbup\77b5ff5d = aa3460b67304a4da30bdb7d4e8c11332c7bdb04f3d5c43127cd92f6e5681b561e3af8bd8102dc10952ae8a6b8d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jigkihjbup\8fc90ab = 659eb6ca974e0766860b9052962d0aefc5edcb80dc53488297914bd5f09903b67bdb366349a4970cda5688c2ee411bb72c2626900f293473535a9db26cc140d9f871978f0813a69d3e2e3830824619014e467c89b05b083c4a421be1785386bdb5db51a540a47934	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2412 rundll32.exe
2412 rundll32.exe
1060 regsvr32.exe
1060 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2412 rundll32.exe
1060 regsvr32.exe

pid	process
2412	rundll32.exe
2412	rundll32.exe
1060	regsvr32.exe
1060	regsvr32.exe

pid	process
2412	rundll32.exe
1060	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2344 wrote to memory of 2412	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2412	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2412	2344	rundll32.exe	rundll32.exe
PID 2412 wrote to memory of 2748	2412	rundll32.exe	explorer.exe
PID 2412 wrote to memory of 2748	2412	rundll32.exe	explorer.exe
PID 2412 wrote to memory of 2748	2412	rundll32.exe	explorer.exe
PID 2412 wrote to memory of 2748	2412	rundll32.exe	explorer.exe
PID 2412 wrote to memory of 2748	2412	rundll32.exe	explorer.exe
PID 2748 wrote to memory of 3492	2748	explorer.exe	schtasks.exe
PID 2748 wrote to memory of 3492	2748	explorer.exe	schtasks.exe
PID 2748 wrote to memory of 3492	2748	explorer.exe	schtasks.exe
PID 1288 wrote to memory of 1060	1288	regsvr32.exe	regsvr32.exe
PID 1288 wrote to memory of 1060	1288	regsvr32.exe	regsvr32.exe
PID 1288 wrote to memory of 1060	1288	regsvr32.exe	regsvr32.exe
PID 1060 wrote to memory of 1980	1060	regsvr32.exe	explorer.exe
PID 1060 wrote to memory of 1980	1060	regsvr32.exe	explorer.exe
PID 1060 wrote to memory of 1980	1060	regsvr32.exe	explorer.exe
PID 1060 wrote to memory of 1980	1060	regsvr32.exe	explorer.exe
PID 1060 wrote to memory of 1980	1060	regsvr32.exe	explorer.exe
PID 1980 wrote to memory of 2964	1980	explorer.exe	reg.exe
PID 1980 wrote to memory of 2964	1980	explorer.exe	reg.exe
PID 1980 wrote to memory of 1032	1980	explorer.exe	reg.exe
PID 1980 wrote to memory of 1032	1980	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test1.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test1.test.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2748

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn feoyrfo /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test1.test.dll\"" /SC ONCE /Z /ST 13:21 /ET 13:33
4⤵
- Creates scheduled task(s)
PID:3492

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test1.test.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\test1.test.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Wzduyiy" /d "0"
4⤵
PID:2964

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Eulrero" /d "0"
4⤵
PID:1032

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test1.test.dll
MD5
baacb3f7c4e0a1799b832765b2a9d356

SHA1
dd0001494dfb5426795dc45ed593f0677af3d5fa

SHA256
fe167b3b7c6a189f267c8bf457385add173bac089a3055bb04aaa60775e645f1

SHA512
74837fb494f50ad1600c78aee3f694d347ef04dfaf0865644527e02daaefabdf6dded9104b76e1b31dcb7272a5d7ab5f206f25cc4da1a0da94185371a0c667ca

Download Submit
\Users\Admin\AppData\Local\Temp\test1.test.dll
MD5
baacb3f7c4e0a1799b832765b2a9d356

SHA1
dd0001494dfb5426795dc45ed593f0677af3d5fa

SHA256
fe167b3b7c6a189f267c8bf457385add173bac089a3055bb04aaa60775e645f1

SHA512
74837fb494f50ad1600c78aee3f694d347ef04dfaf0865644527e02daaefabdf6dded9104b76e1b31dcb7272a5d7ab5f206f25cc4da1a0da94185371a0c667ca

Download Submit
memory/1032-132-0x0000000000000000-mapping.dmp

Download
memory/1060-129-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Filesize
4KB

Download
memory/1060-128-0x0000000010000000-0x0000000010085000-memory.dmp

Filesize
532KB

Download
memory/1060-125-0x0000000000000000-mapping.dmp

Download
memory/1980-130-0x0000000000000000-mapping.dmp

Download
memory/1980-135-0x0000000000710000-0x0000000000731000-memory.dmp

Filesize
132KB

Download
memory/2412-118-0x0000000000C00000-0x0000000000D4A000-memory.dmp

Filesize
1.3MB

Download
memory/2412-117-0x0000000010000000-0x0000000010085000-memory.dmp

Filesize
532KB

Download
memory/2412-115-0x0000000000000000-mapping.dmp

Download
memory/2412-116-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2748-123-0x0000000000A00000-0x0000000000A21000-memory.dmp

Filesize
132KB

Download
memory/2748-119-0x0000000000000000-mapping.dmp

Download
memory/2964-131-0x0000000000000000-mapping.dmp

Download
memory/3492-120-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads