qakbot | acc31f97c3124a317f2939944777e103311f4b0c51788d2e562c24a08e2afe27

General

Target

test1.test.dll
Size

611KB
MD5

650393a4720518176d8bc503cf686cf6
SHA1

ea2a8f0aab617f00a532a68a91ee96be427ce372
SHA256

acc31f97c3124a317f2939944777e103311f4b0c51788d2e562c24a08e2afe27
SHA512

5b889d3c5a918f8c5f971ecb3a2ff5518974250ad7ddbc536b596933fd81ba90db5cb63fc9be7d70b94257de45980ff3979d1eb9cb5ff8868d699c5bfa8f2f37

Score

10^/10

qakbot tr 1633597816 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633597816

C2

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

456 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1092 schtasks.exe

pid	process
456	regsvr32.exe

pid	process
1092	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ptmlfmcttzbb\2b83bb95 = c0277d3412b2c4f8055d0c81ff59bbaa8c7d1b2ea61b719c434c6bcf32	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ptmlfmcttzbb\ee37937a = da11715e63dce79efc7c820ebb303fcb17c5a7bd8922b955715591a0b0ed8bfb13bb4eb1cec526a09b2eedbb2e98042caae787518d0ca356e6dc65e8ac56b562d2f58f4ac9ee0161	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ptmlfmcttzbb\a4e12cc2 = b90bfde71b208f824b1067bb21066018d21c7a966402cae602610c71e3b7	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ptmlfmcttzbb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ptmlfmcttzbb\a4e12cc2 = b90beae71b20ba242c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ptmlfmcttzbb\917efc8c = 1ec4995295f4a36c232008408efca584aa0a33014b22987aa095b53c75a2f2aee8a9792645da24c5a29fd85ec52ff165b6c50fbc74a5ee22ff7134165143134d091161ee5f3ff4cb247ea22e35cc1a559b2c60abff40f764192ff6a48a0fecc618d46a29fa93f60d98e3acca49463c55eb3a1c5d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ptmlfmcttzbb\933fdcf0 = d16bee32800a8d2ca1e4f04282ae5542	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ptmlfmcttzbb\568bf41f = c321905c397c874a649417eca451a0b77d6eb71fa2ce6d2330b499f0b824228017a7b4e6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ptmlfmcttzbb\29c29be9 = b58765d8f36e123ca45c5166cb581e2290e39916a84905d6a375255a506c67966e56737f614ec5f91dbfa0003d15f9d73c0076	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ptmlfmcttzbb\dba84334 = ba3f88a68e2af2e78b0beb361301002a4c9771977d24fcc9a8a9621d82e9d85e4a5308bf2488ebc4b5f2dd1ac818482e15d21fe2374e4f37ba87f6e6429a9b9dfac101d41d407d97294ca53db9ee7a65a1ac9babf8393895b14a5ed646a80c93809e6f5fb5408aab5df1dc894d91c789	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1524 rundll32.exe
456 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1524 rundll32.exe
456 regsvr32.exe

pid	process
1524	rundll32.exe
456	regsvr32.exe

pid	process
1524	rundll32.exe
456	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1804 wrote to memory of 1524	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 1524	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 1524	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 1524	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 1524	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 1524	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 1524	1804	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2040	1524	rundll32.exe	explorer.exe
PID 1524 wrote to memory of 2040	1524	rundll32.exe	explorer.exe
PID 1524 wrote to memory of 2040	1524	rundll32.exe	explorer.exe
PID 1524 wrote to memory of 2040	1524	rundll32.exe	explorer.exe
PID 1524 wrote to memory of 2040	1524	rundll32.exe	explorer.exe
PID 1524 wrote to memory of 2040	1524	rundll32.exe	explorer.exe
PID 2040 wrote to memory of 1092	2040	explorer.exe	schtasks.exe
PID 2040 wrote to memory of 1092	2040	explorer.exe	schtasks.exe
PID 2040 wrote to memory of 1092	2040	explorer.exe	schtasks.exe
PID 2040 wrote to memory of 1092	2040	explorer.exe	schtasks.exe
PID 1620 wrote to memory of 1624	1620	taskeng.exe	regsvr32.exe
PID 1620 wrote to memory of 1624	1620	taskeng.exe	regsvr32.exe
PID 1620 wrote to memory of 1624	1620	taskeng.exe	regsvr32.exe
PID 1620 wrote to memory of 1624	1620	taskeng.exe	regsvr32.exe
PID 1620 wrote to memory of 1624	1620	taskeng.exe	regsvr32.exe
PID 1624 wrote to memory of 456	1624	regsvr32.exe	regsvr32.exe
PID 1624 wrote to memory of 456	1624	regsvr32.exe	regsvr32.exe
PID 1624 wrote to memory of 456	1624	regsvr32.exe	regsvr32.exe
PID 1624 wrote to memory of 456	1624	regsvr32.exe	regsvr32.exe
PID 1624 wrote to memory of 456	1624	regsvr32.exe	regsvr32.exe
PID 1624 wrote to memory of 456	1624	regsvr32.exe	regsvr32.exe
PID 1624 wrote to memory of 456	1624	regsvr32.exe	regsvr32.exe
PID 456 wrote to memory of 892	456	regsvr32.exe	explorer.exe
PID 456 wrote to memory of 892	456	regsvr32.exe	explorer.exe
PID 456 wrote to memory of 892	456	regsvr32.exe	explorer.exe
PID 456 wrote to memory of 892	456	regsvr32.exe	explorer.exe
PID 456 wrote to memory of 892	456	regsvr32.exe	explorer.exe
PID 456 wrote to memory of 892	456	regsvr32.exe	explorer.exe
PID 892 wrote to memory of 568	892	explorer.exe	reg.exe
PID 892 wrote to memory of 568	892	explorer.exe	reg.exe
PID 892 wrote to memory of 568	892	explorer.exe	reg.exe
PID 892 wrote to memory of 568	892	explorer.exe	reg.exe
PID 892 wrote to memory of 1848	892	explorer.exe	reg.exe
PID 892 wrote to memory of 1848	892	explorer.exe	reg.exe
PID 892 wrote to memory of 1848	892	explorer.exe	reg.exe
PID 892 wrote to memory of 1848	892	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test1.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test1.test.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rvgdnyptlt /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test1.test.dll\"" /SC ONCE /Z /ST 13:49 /ET 14:01
4⤵
- Creates scheduled task(s)
PID:1092

C:\Windows\system32\taskeng.exe
taskeng.exe {4D262D03-A96A-4AD0-8B29-42C0578D793F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test1.test.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\test1.test.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:456

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Nooymvqnq" /d "0"
5⤵
PID:568

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Hnafaarbfuyu" /d "0"
5⤵
PID:1848

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test1.test.dll
MD5
650393a4720518176d8bc503cf686cf6

SHA1
ea2a8f0aab617f00a532a68a91ee96be427ce372

SHA256
acc31f97c3124a317f2939944777e103311f4b0c51788d2e562c24a08e2afe27

SHA512
5b889d3c5a918f8c5f971ecb3a2ff5518974250ad7ddbc536b596933fd81ba90db5cb63fc9be7d70b94257de45980ff3979d1eb9cb5ff8868d699c5bfa8f2f37

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\test1.test.dll
MD5
650393a4720518176d8bc503cf686cf6

SHA1
ea2a8f0aab617f00a532a68a91ee96be427ce372

SHA256
acc31f97c3124a317f2939944777e103311f4b0c51788d2e562c24a08e2afe27

SHA512
5b889d3c5a918f8c5f971ecb3a2ff5518974250ad7ddbc536b596933fd81ba90db5cb63fc9be7d70b94257de45980ff3979d1eb9cb5ff8868d699c5bfa8f2f37

Download Submit
memory/456-79-0x00000000004F0000-0x0000000000511000-memory.dmp

Filesize
132KB

Download
memory/456-78-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/456-77-0x0000000000170000-0x000000000020C000-memory.dmp

Filesize
624KB

Download
memory/456-74-0x0000000000000000-mapping.dmp

Download
memory/568-84-0x0000000000000000-mapping.dmp

Download
memory/892-86-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/892-80-0x0000000000000000-mapping.dmp

Download
memory/1092-69-0x0000000000000000-mapping.dmp

Download
memory/1524-65-0x0000000000820000-0x0000000000841000-memory.dmp

Filesize
132KB

Download
memory/1524-60-0x0000000000000000-mapping.dmp

Download
memory/1524-63-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/1524-64-0x00000000007F0000-0x0000000000811000-memory.dmp

Filesize
132KB

Download
memory/1524-62-0x0000000000750000-0x00000000007EC000-memory.dmp

Filesize
624KB

Download
memory/1524-61-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1624-72-0x000007FEFBD61000-0x000007FEFBD63000-memory.dmp

Filesize
8KB

Download
memory/1624-71-0x0000000000000000-mapping.dmp

Download
memory/1848-85-0x0000000000000000-mapping.dmp

Download
memory/2040-70-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2040-68-0x0000000074981000-0x0000000074983000-memory.dmp

Filesize
8KB

Download
memory/2040-66-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads