qakbot | f1263a039c93f88f4e308f6e17d7863ceb9b48a939357726c152937503dc5b69

General

Target

test2.test.dll
Size

1.0MB
MD5

02f53c52811ab112fc110e817a772c1c
SHA1

f4c9cc40472799c03f80069b97ac0485f76e72c1
SHA256

f1263a039c93f88f4e308f6e17d7863ceb9b48a939357726c152937503dc5b69
SHA512

f195e0ea64b0c09148e0009a4bd60ba53dc777e00fce9790afc8b5236e036a19092265314ac6aaec858312c6744a8397fcfc8bbc50e173e76229528af6aa540f

Score

10^/10

qakbot tr 1633334141 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633334141

C2

75.75.179.226:443

185.250.148.74:443

122.11.220.212:2222

120.150.218.241:995

103.148.120.144:443

140.82.49.12:443

40.131.140.155:995

206.47.134.234:2222

73.230.205.91:443

190.198.206.189:2222

103.157.122.198:995

81.250.153.227:2222

167.248.100.227:443

96.57.188.174:2078

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

136.232.34.70:443

68.186.192.69:443

167.248.111.245:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

520 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1796 schtasks.exe

pid	process
520	regsvr32.exe

pid	process
1796	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pxaabsi\17a60efa = 1a9cce146092c455d911870dc03aea2e44ef9722e03233758bad8cc9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pxaabsi\af1a699f = ca76fb23e4bd64767753a1386adecaccdd715492a9ee7bfb9387729a11dfbda970a7eaf80f2a74a96e11a97b4c6ee34d4d448c8890a8a716efd65fee456f5619a799687eacf4bc191bfd4a7f93aece3509e42ded97279e42f316bd6b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pxaabsi\68ef610c = e0bd0e0e9d8f923eac058f434ccd63f6c2ecedaf4a867524a3385944a02fedd359689c1cd91fcd5d90e2a74759	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pxaabsi\9a85b9d1 = 52165db8d347536e66c81f360da143a28c98ffdd2d3a7551ce2ed564c1a3cf60191a12b4f4ae9b94d8126b1d46b587585fe51eea943eba3b220f3959ce126f823507dcefb83f8786a7b8c98ec1f6c33f1ebbf238330948b21225893c9e4f51	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pxaabsi\e5ccd627 = cf7df875e710465b9912428ea281775e55d9c9fa49fa30ca52be62bdf67558fe312d10c614fbb9268d68acc05afa135fe4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pxaabsi\6aae4170 = 3d816a7ec71e9e6eb09e04d8f50eb72539dee691442233154b28920d27cd05218408a0ca378959558bda379f3f639b18503da7968959f5ad2d8582	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pxaabsi\d2122615 = d67d41206335c8025178a2d231416539a92e969f434cefb8f771de7da1b6ece30c41563edae241993c9b45f8049a3ada31623d3e6f9afdfb91597ff53cdc916b59d6524c0d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pxaabsi\e5ccd627 = cf7def75e71073a665a0e5d596f0522b0f2d1d78192a87cbc84952cb14ffb46091801d1934e524d25fdbacc4a3397880b0738ca8177de9f9db6da5e838b6dc41650954fea21c	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pxaabsi	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pxaabsi\d0530669 = 0b87671c752b930233b89c0b4fb0646c0c966cb35d66b7e7adce845e4028444c9294cf65fec5cfa1461b80a95eef7089d0b2694707a76f4fb430e6739967cf6163cfc3c5b51255f63899ae3494a95207c0fc57a3c08317d07618a017a9779b47ac6445a3c4adb2276622e359033b00531fad5887189c4e24841c7e035476f97e49b23692778523104f4be559ad66cc909280e0a084217a	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1060 rundll32.exe
520 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1060 rundll32.exe
520 regsvr32.exe

pid	process
1060	rundll32.exe
520	regsvr32.exe

pid	process
1060	rundll32.exe
520	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1092 wrote to memory of 1060	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1060	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1060	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1060	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1060	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1060	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1060	1092	rundll32.exe	rundll32.exe
PID 1060 wrote to memory of 2012	1060	rundll32.exe	explorer.exe
PID 1060 wrote to memory of 2012	1060	rundll32.exe	explorer.exe
PID 1060 wrote to memory of 2012	1060	rundll32.exe	explorer.exe
PID 1060 wrote to memory of 2012	1060	rundll32.exe	explorer.exe
PID 1060 wrote to memory of 2012	1060	rundll32.exe	explorer.exe
PID 1060 wrote to memory of 2012	1060	rundll32.exe	explorer.exe
PID 2012 wrote to memory of 1796	2012	explorer.exe	schtasks.exe
PID 2012 wrote to memory of 1796	2012	explorer.exe	schtasks.exe
PID 2012 wrote to memory of 1796	2012	explorer.exe	schtasks.exe
PID 2012 wrote to memory of 1796	2012	explorer.exe	schtasks.exe
PID 1364 wrote to memory of 1224	1364	taskeng.exe	regsvr32.exe
PID 1364 wrote to memory of 1224	1364	taskeng.exe	regsvr32.exe
PID 1364 wrote to memory of 1224	1364	taskeng.exe	regsvr32.exe
PID 1364 wrote to memory of 1224	1364	taskeng.exe	regsvr32.exe
PID 1364 wrote to memory of 1224	1364	taskeng.exe	regsvr32.exe
PID 1224 wrote to memory of 520	1224	regsvr32.exe	regsvr32.exe
PID 1224 wrote to memory of 520	1224	regsvr32.exe	regsvr32.exe
PID 1224 wrote to memory of 520	1224	regsvr32.exe	regsvr32.exe
PID 1224 wrote to memory of 520	1224	regsvr32.exe	regsvr32.exe
PID 1224 wrote to memory of 520	1224	regsvr32.exe	regsvr32.exe
PID 1224 wrote to memory of 520	1224	regsvr32.exe	regsvr32.exe
PID 1224 wrote to memory of 520	1224	regsvr32.exe	regsvr32.exe
PID 520 wrote to memory of 800	520	regsvr32.exe	explorer.exe
PID 520 wrote to memory of 800	520	regsvr32.exe	explorer.exe
PID 520 wrote to memory of 800	520	regsvr32.exe	explorer.exe
PID 520 wrote to memory of 800	520	regsvr32.exe	explorer.exe
PID 520 wrote to memory of 800	520	regsvr32.exe	explorer.exe
PID 520 wrote to memory of 800	520	regsvr32.exe	explorer.exe
PID 800 wrote to memory of 112	800	explorer.exe	reg.exe
PID 800 wrote to memory of 112	800	explorer.exe	reg.exe
PID 800 wrote to memory of 112	800	explorer.exe	reg.exe
PID 800 wrote to memory of 112	800	explorer.exe	reg.exe
PID 800 wrote to memory of 1584	800	explorer.exe	reg.exe
PID 800 wrote to memory of 1584	800	explorer.exe	reg.exe
PID 800 wrote to memory of 1584	800	explorer.exe	reg.exe
PID 800 wrote to memory of 1584	800	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test2.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test2.test.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn oamrtsu /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test2.test.dll\"" /SC ONCE /Z /ST 16:00 /ET 16:12
4⤵
- Creates scheduled task(s)
PID:1796

C:\Windows\system32\taskeng.exe
taskeng.exe {F5D861AE-D910-46B6-A3D3-8351D76BF471} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test2.test.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1224

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\test2.test.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:520

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Zhsejsqioh" /d "0"
5⤵
PID:112

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Pqovdkwddv" /d "0"
5⤵
PID:1584

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test2.test.dll
MD5
02f53c52811ab112fc110e817a772c1c

SHA1
f4c9cc40472799c03f80069b97ac0485f76e72c1

SHA256
f1263a039c93f88f4e308f6e17d7863ceb9b48a939357726c152937503dc5b69

SHA512
f195e0ea64b0c09148e0009a4bd60ba53dc777e00fce9790afc8b5236e036a19092265314ac6aaec858312c6744a8397fcfc8bbc50e173e76229528af6aa540f

Download Submit
\Users\Admin\AppData\Local\Temp\test2.test.dll
MD5
02f53c52811ab112fc110e817a772c1c

SHA1
f4c9cc40472799c03f80069b97ac0485f76e72c1

SHA256
f1263a039c93f88f4e308f6e17d7863ceb9b48a939357726c152937503dc5b69

SHA512
f195e0ea64b0c09148e0009a4bd60ba53dc777e00fce9790afc8b5236e036a19092265314ac6aaec858312c6744a8397fcfc8bbc50e173e76229528af6aa540f

Download Submit
memory/112-82-0x0000000000000000-mapping.dmp

Download
memory/520-77-0x00000000724B0000-0x0000000072EBC000-memory.dmp

Filesize
10.0MB

Download
memory/520-78-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/520-76-0x00000000724B0000-0x00000000724D1000-memory.dmp

Filesize
132KB

Download
memory/520-73-0x0000000000000000-mapping.dmp

Download
memory/800-84-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/800-79-0x0000000000000000-mapping.dmp

Download
memory/1060-64-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/1060-63-0x0000000072EC0000-0x00000000738CC000-memory.dmp

Filesize
10.0MB

Download
memory/1060-60-0x0000000000000000-mapping.dmp

Download
memory/1060-62-0x0000000072EC0000-0x0000000072EE1000-memory.dmp

Filesize
132KB

Download
memory/1060-61-0x0000000075AF1000-0x0000000075AF3000-memory.dmp

Filesize
8KB

Download
memory/1224-71-0x000007FEFBAA1000-0x000007FEFBAA3000-memory.dmp

Filesize
8KB

Download
memory/1224-70-0x0000000000000000-mapping.dmp

Download
memory/1584-83-0x0000000000000000-mapping.dmp

Download
memory/1796-68-0x0000000000000000-mapping.dmp

Download
memory/2012-69-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2012-67-0x00000000748E1000-0x00000000748E3000-memory.dmp

Filesize
8KB

Download
memory/2012-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads