qakbot | b6d65b22a0051227b29f30dd4833753925332ff3727e392ed6d2223b36f1cc1d

General

Target

test.test.dll
Size

820KB
MD5

398b4b11bd10b155bead7267c48fc869
SHA1

8c9338c72a4cbe4fe6929a2f16d506e171663a62
SHA256

b6d65b22a0051227b29f30dd4833753925332ff3727e392ed6d2223b36f1cc1d
SHA512

47fa82af74952ebc0424d087bfe7d3ba31713568f83b261e0d8ff75adee42458b471c79ac1172b25aa484f8b507f3ea90b55d51987df93540470e04a06c4a92f

Score

10^/10

qakbot tr 1633597626 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633597626

C2

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1300 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1840 schtasks.exe

pid	process
1300	regsvr32.exe

pid	process
1840	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wkazenvdzu\ff7ee8e2 = c9abdb339b9a1f1aa7ae98d6430ff5ff835ae564c6418621ff3aad6c45084c9efaa1d29a5c293335592025f74ddeea6be5a352db5fd6432afa2a13aade361ff290e71a4c09ca385b5b19f3abd2ab8638609efa137693c02ad831384e26a06a9971ad	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wkazenvdzu\80378714 = 8ff94936819a304c544442f6e69d6cd8684728689d2e4650b0de4ca471	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wkazenvdzu	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wkazenvdzu\cae138ac = a181f4ee109319104eb656c1aa113712077640b89107844f11a849f6cb99b142417fafae206f9e3fa9931467c389d68ec79f3c57f09830cc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wkazenvdzu\fd3fc89e = 29e09d1c3271425809980f4d19abc7d07a2c5b1006d93386d9b3aab7ec0ed71026f17b604e39a900b387e49901600a973fb0dbf0a77a6e71949dc0aaef23	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wkazenvdzu\4583affb = 1562064e48b5d1a98bcb22d6885b6f0c35b47806b000354461c41036ea0390a282197784cb18f3d2542bcb0a57e40f3b70d371a60d45ed540e82796203778f1b4b78c1218603c8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wkazenvdzu\388be071 = 5ed61fea8435a100bac424b2ced40c66b732082980079023557f38a8a5e72c79f82bd4c88cb30d107bd4efc3336495d58cafa152ad5cf0071d1e708513921326454b4ed52bc546ca76cc9bc40fa8f287a27e471b324e3ffef5f475b7437beb8f72662117a46df5acce9d6336acb74c0b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wkazenvdzu\47c28f87 = 471f308ba9d62d0eefafcb886bb4d5fec386f7d6af11139d19f1773753c2a3a925f65dc074a3adcbcf97d88646e9679cbfc28ec454fe40729656a221dd563170ab0f89c8019d10b97086eae3d2d84a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wkazenvdzu\b5a8575a = b0af8e11560e98bce69667fd2fe7d65bdf572757e6631a1ae66b8bd8206f0021a85cc4b4c39d3fdf361d9a929a3240c88be0c8c668	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wkazenvdzu\cae138ac = a181e3ee10932c43d97b9dd6a1a136f5413dcb139ad0026153a750a8d2490ac7fae7a380662f98de447cec16d88f27c6e981afa0f65de82c4b8ddadcf7ef6768e5cf487e217de2484c49df0e81	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1992 rundll32.exe
1300 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1992 rundll32.exe
1300 regsvr32.exe

pid	process
1992	rundll32.exe
1300	regsvr32.exe

pid	process
1992	rundll32.exe
1300	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1820 wrote to memory of 1992	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1992	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1992	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1992	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1992	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1992	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1992	1820	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1972	1992	rundll32.exe	explorer.exe
PID 1992 wrote to memory of 1972	1992	rundll32.exe	explorer.exe
PID 1992 wrote to memory of 1972	1992	rundll32.exe	explorer.exe
PID 1992 wrote to memory of 1972	1992	rundll32.exe	explorer.exe
PID 1992 wrote to memory of 1972	1992	rundll32.exe	explorer.exe
PID 1992 wrote to memory of 1972	1992	rundll32.exe	explorer.exe
PID 1972 wrote to memory of 1840	1972	explorer.exe	schtasks.exe
PID 1972 wrote to memory of 1840	1972	explorer.exe	schtasks.exe
PID 1972 wrote to memory of 1840	1972	explorer.exe	schtasks.exe
PID 1972 wrote to memory of 1840	1972	explorer.exe	schtasks.exe
PID 1156 wrote to memory of 1872	1156	taskeng.exe	regsvr32.exe
PID 1156 wrote to memory of 1872	1156	taskeng.exe	regsvr32.exe
PID 1156 wrote to memory of 1872	1156	taskeng.exe	regsvr32.exe
PID 1156 wrote to memory of 1872	1156	taskeng.exe	regsvr32.exe
PID 1156 wrote to memory of 1872	1156	taskeng.exe	regsvr32.exe
PID 1872 wrote to memory of 1300	1872	regsvr32.exe	regsvr32.exe
PID 1872 wrote to memory of 1300	1872	regsvr32.exe	regsvr32.exe
PID 1872 wrote to memory of 1300	1872	regsvr32.exe	regsvr32.exe
PID 1872 wrote to memory of 1300	1872	regsvr32.exe	regsvr32.exe
PID 1872 wrote to memory of 1300	1872	regsvr32.exe	regsvr32.exe
PID 1872 wrote to memory of 1300	1872	regsvr32.exe	regsvr32.exe
PID 1872 wrote to memory of 1300	1872	regsvr32.exe	regsvr32.exe
PID 1300 wrote to memory of 812	1300	regsvr32.exe	explorer.exe
PID 1300 wrote to memory of 812	1300	regsvr32.exe	explorer.exe
PID 1300 wrote to memory of 812	1300	regsvr32.exe	explorer.exe
PID 1300 wrote to memory of 812	1300	regsvr32.exe	explorer.exe
PID 1300 wrote to memory of 812	1300	regsvr32.exe	explorer.exe
PID 1300 wrote to memory of 812	1300	regsvr32.exe	explorer.exe
PID 812 wrote to memory of 724	812	explorer.exe	reg.exe
PID 812 wrote to memory of 724	812	explorer.exe	reg.exe
PID 812 wrote to memory of 724	812	explorer.exe	reg.exe
PID 812 wrote to memory of 724	812	explorer.exe	reg.exe
PID 812 wrote to memory of 1276	812	explorer.exe	reg.exe
PID 812 wrote to memory of 1276	812	explorer.exe	reg.exe
PID 812 wrote to memory of 1276	812	explorer.exe	reg.exe
PID 812 wrote to memory of 1276	812	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ybmscxclw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test.test.dll\"" /SC ONCE /Z /ST 16:10 /ET 16:22
4⤵
- Creates scheduled task(s)
PID:1840

C:\Windows\system32\taskeng.exe
taskeng.exe {7B603999-D4D0-474B-B778-3A22C3935BEC} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:812

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Giajmgiez" /d "0"
5⤵
PID:724

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ccowdjiid" /d "0"
5⤵
PID:1276

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test.test.dll
MD5
398b4b11bd10b155bead7267c48fc869

SHA1
8c9338c72a4cbe4fe6929a2f16d506e171663a62

SHA256
b6d65b22a0051227b29f30dd4833753925332ff3727e392ed6d2223b36f1cc1d

SHA512
47fa82af74952ebc0424d087bfe7d3ba31713568f83b261e0d8ff75adee42458b471c79ac1172b25aa484f8b507f3ea90b55d51987df93540470e04a06c4a92f

Download Submit
\Users\Admin\AppData\Local\Temp\test.test.dll
MD5
398b4b11bd10b155bead7267c48fc869

SHA1
8c9338c72a4cbe4fe6929a2f16d506e171663a62

SHA256
b6d65b22a0051227b29f30dd4833753925332ff3727e392ed6d2223b36f1cc1d

SHA512
47fa82af74952ebc0424d087bfe7d3ba31713568f83b261e0d8ff75adee42458b471c79ac1172b25aa484f8b507f3ea90b55d51987df93540470e04a06c4a92f

Download Submit
memory/724-85-0x0000000000000000-mapping.dmp

Download
memory/812-88-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/812-82-0x0000000000000000-mapping.dmp

Download
memory/1276-86-0x0000000000000000-mapping.dmp

Download
memory/1300-87-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/1300-80-0x0000000074050000-0x00000000741C1000-memory.dmp

Filesize
1.4MB

Download
memory/1300-79-0x0000000074050000-0x0000000074071000-memory.dmp

Filesize
132KB

Download
memory/1300-78-0x0000000074050000-0x00000000741C1000-memory.dmp

Filesize
1.4MB

Download
memory/1300-75-0x0000000000000000-mapping.dmp

Download
memory/1840-69-0x0000000000000000-mapping.dmp

Download
memory/1872-73-0x000007FEFBED1000-0x000007FEFBED3000-memory.dmp

Filesize
8KB

Download
memory/1872-72-0x0000000000000000-mapping.dmp

Download
memory/1972-71-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1972-68-0x0000000074961000-0x0000000074963000-memory.dmp

Filesize
8KB

Download
memory/1972-66-0x0000000000000000-mapping.dmp

Download
memory/1972-65-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/1992-60-0x0000000000000000-mapping.dmp

Download
memory/1992-70-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1992-64-0x0000000074AD0000-0x0000000074C41000-memory.dmp

Filesize
1.4MB

Download
memory/1992-63-0x0000000074AD0000-0x0000000074AF1000-memory.dmp

Filesize
132KB

Download
memory/1992-62-0x0000000074AD0000-0x0000000074C41000-memory.dmp

Filesize
1.4MB

Download
memory/1992-61-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads