qakbot | 60752aec0aacef946678c9cd53d5d17af70e764438435fd62b2a28792f7e2c53

General

Target

test2.test.dll
Size

546KB
MD5

0d6fec2902107153fcd82b55cbcb7fc6
SHA1

611d40a2b2494a987addcb742e104ef25a0d9b13
SHA256

60752aec0aacef946678c9cd53d5d17af70e764438435fd62b2a28792f7e2c53
SHA512

8332b3819554320ec7f4caa7f984c6e7a0b7fc6e1491ea04d846de37f0239af5979abdb4760db986ccb6adc738f685d83911714019c92b31572c15431bbdf768

Score

10^/10

qakbot tr 1633597626 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633597626

C2

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1052 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

540 schtasks.exe

pid	process
1052	regsvr32.exe

pid	process
540	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\2bebe412 = fecd5970d84df92b163bb42c56f7b786dab6e5cd9933220ec649147a5d87379f64da4fbfc1a95e1508e6a61300299366a77046a17c973e3128328983f5924e33727374de175ab919393c187f5f0ba9fa199850184ce96bd750859080174ce729f1857097547ccef446bcfd6675def8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\56e3ab98 = 8bd3211a5c89108e283262d56acaa8343fd3f7bc2abb450a4f7834c1462a8a68f865d111c062053ff839254f833e65e489098176c47a4731987fa4df90649ec5ca9ed25255dedb0f83e91daff709d83d9856f0ffa79fa7ae1902e51f8d08ddd8809bbf336c88512f7e4436b67a538746f8ea	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\9116a30b = 128a772e6c88ddd455dbdc11a8fe732d8d39b7b3d7d1240f7af36d14cc58849f978253cbecb948d280f5072d7eeba2d5b31577b7d029163a6ceeade7cfbc44e797f9bc06326f2bf3aa3e85f7ae415ab56cbbe2e43859d9e30ddb17e1835dba515c364df8eb14ee13554e457d87	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\637c7bd6 = db6073d89e98964cf7e5ef4cf2c34c7ac07369221c281191c1b36b65054c785d3864be8759f68e13ad8227830e9dbe9ac60292cbd63aa1bbdabfc7df24ee7b04a063	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\29aac46e = aa66ad1407960cfcb79db1fc753e4bb2227bbe61ac9e1e2ea738ebb663170bf351352e2517e52a9485c553470608033825b10c90e46acaafd6e81f00fe1aaecab9ba1cb33ce7d085d1d69fdb33aa3e1dbc9dfa0b36664b24b47c6b431865e0b4762862536e1b5f3d18c4a59d8e7946a9d9bd154bb9ec2d47d2b8b2cab528f13843ef811ad1b23c5d190b854dc6b51d0db17b8e5777e95e2a92e3b9ba898b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\ee5fccfd = b302bd9f812b78025ecd987b9a55215b0ad2e4c9f63da2d89d9db83f5de445	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\1c351420 = 62c33740e38ed96e907f675e8978d9e27ec4c4211f256645af337c729a89ec89c7b0347cab029d99adb6bf6f761affc0de8ccc22927b7e0b5f277da0e56d1fe7a96eb7a337cd65228432917a546ffabe5397874907c2c7b811ff120fc4a51af101cbf3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\1c351420 = 62c32040e38eeca17a2ae121d89495e993db13584d1f2af6bfa494a9c042c028f7041e1be2ee783d4fd8ad71372faca2b6bc597b108b76897ed5295d7afec3bcaf866b51af7c7e8319bd45cdd6fc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kcmmibuot\93578377 = cf5b31f2b6411d0cdb1a9b220cbac1d037201bf4127144ce51f41879a9492d26919e48a7b0c4b0e503b392301a70d5e47c06ff7fefea33ddad0682fcc0e7a1d7d1cffdb3123bb2	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1124 rundll32.exe
1052 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1124 rundll32.exe
1052 regsvr32.exe

pid	process
1124	rundll32.exe
1052	regsvr32.exe

pid	process
1124	rundll32.exe
1052	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1144 wrote to memory of 1124	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1124	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1124	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1124	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1124	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1124	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1124	1144	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 2012	1124	rundll32.exe	explorer.exe
PID 1124 wrote to memory of 2012	1124	rundll32.exe	explorer.exe
PID 1124 wrote to memory of 2012	1124	rundll32.exe	explorer.exe
PID 1124 wrote to memory of 2012	1124	rundll32.exe	explorer.exe
PID 1124 wrote to memory of 2012	1124	rundll32.exe	explorer.exe
PID 1124 wrote to memory of 2012	1124	rundll32.exe	explorer.exe
PID 2012 wrote to memory of 540	2012	explorer.exe	schtasks.exe
PID 2012 wrote to memory of 540	2012	explorer.exe	schtasks.exe
PID 2012 wrote to memory of 540	2012	explorer.exe	schtasks.exe
PID 2012 wrote to memory of 540	2012	explorer.exe	schtasks.exe
PID 1260 wrote to memory of 836	1260	taskeng.exe	regsvr32.exe
PID 1260 wrote to memory of 836	1260	taskeng.exe	regsvr32.exe
PID 1260 wrote to memory of 836	1260	taskeng.exe	regsvr32.exe
PID 1260 wrote to memory of 836	1260	taskeng.exe	regsvr32.exe
PID 1260 wrote to memory of 836	1260	taskeng.exe	regsvr32.exe
PID 836 wrote to memory of 1052	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1052	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1052	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1052	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1052	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1052	836	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 1052	836	regsvr32.exe	regsvr32.exe
PID 1052 wrote to memory of 456	1052	regsvr32.exe	explorer.exe
PID 1052 wrote to memory of 456	1052	regsvr32.exe	explorer.exe
PID 1052 wrote to memory of 456	1052	regsvr32.exe	explorer.exe
PID 1052 wrote to memory of 456	1052	regsvr32.exe	explorer.exe
PID 1052 wrote to memory of 456	1052	regsvr32.exe	explorer.exe
PID 1052 wrote to memory of 456	1052	regsvr32.exe	explorer.exe
PID 456 wrote to memory of 1708	456	explorer.exe	reg.exe
PID 456 wrote to memory of 1708	456	explorer.exe	reg.exe
PID 456 wrote to memory of 1708	456	explorer.exe	reg.exe
PID 456 wrote to memory of 1708	456	explorer.exe	reg.exe
PID 456 wrote to memory of 1056	456	explorer.exe	reg.exe
PID 456 wrote to memory of 1056	456	explorer.exe	reg.exe
PID 456 wrote to memory of 1056	456	explorer.exe	reg.exe
PID 456 wrote to memory of 1056	456	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test2.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test2.test.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn iohvfgws /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test2.test.dll\"" /SC ONCE /Z /ST 14:10 /ET 14:22
4⤵
- Creates scheduled task(s)
PID:540

C:\Windows\system32\taskeng.exe
taskeng.exe {114F67DA-00C3-4EC9-8FCA-E6EAA7B8AE8B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test2.test.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\test2.test.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:456

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Tuxxzejueuu" /d "0"
5⤵
PID:1708

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Nryngceudyam" /d "0"
5⤵
PID:1056

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test2.test.dll
MD5
0d6fec2902107153fcd82b55cbcb7fc6

SHA1
611d40a2b2494a987addcb742e104ef25a0d9b13

SHA256
60752aec0aacef946678c9cd53d5d17af70e764438435fd62b2a28792f7e2c53

SHA512
8332b3819554320ec7f4caa7f984c6e7a0b7fc6e1491ea04d846de37f0239af5979abdb4760db986ccb6adc738f685d83911714019c92b31572c15431bbdf768

Download Submit
\Users\Admin\AppData\Local\Temp\test2.test.dll
MD5
0d6fec2902107153fcd82b55cbcb7fc6

SHA1
611d40a2b2494a987addcb742e104ef25a0d9b13

SHA256
60752aec0aacef946678c9cd53d5d17af70e764438435fd62b2a28792f7e2c53

SHA512
8332b3819554320ec7f4caa7f984c6e7a0b7fc6e1491ea04d846de37f0239af5979abdb4760db986ccb6adc738f685d83911714019c92b31572c15431bbdf768

Download Submit
memory/456-75-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/456-72-0x0000000000000000-mapping.dmp

Download
memory/540-62-0x0000000000000000-mapping.dmp

Download
memory/836-64-0x000007FEFBC91000-0x000007FEFBC93000-memory.dmp

Filesize
8KB

Download
memory/836-63-0x0000000000000000-mapping.dmp

Download
memory/1052-70-0x0000000010000000-0x000000001530B000-memory.dmp

Filesize
83.0MB

Download
memory/1052-66-0x0000000000000000-mapping.dmp

Download
memory/1052-69-0x0000000000B10000-0x0000000005DC4000-memory.dmp

Filesize
82.7MB

Download
memory/1056-77-0x0000000000000000-mapping.dmp

Download
memory/1124-55-0x0000000001E80000-0x0000000007134000-memory.dmp

Filesize
82.7MB

Download
memory/1124-53-0x0000000000000000-mapping.dmp

Download
memory/1124-56-0x0000000010000000-0x000000001530B000-memory.dmp

Filesize
83.0MB

Download
memory/1124-54-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download
memory/1708-76-0x0000000000000000-mapping.dmp

Download
memory/2012-61-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2012-60-0x00000000749B1000-0x00000000749B3000-memory.dmp

Filesize
8KB

Download
memory/2012-58-0x0000000000000000-mapping.dmp

Download
memory/2012-57-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads