qakbot | 60752aec0aacef946678c9cd53d5d17af70e764438435fd62b2a28792f7e2c53

General

Target

test2.test.dll
Size

546KB
MD5

0d6fec2902107153fcd82b55cbcb7fc6
SHA1

611d40a2b2494a987addcb742e104ef25a0d9b13
SHA256

60752aec0aacef946678c9cd53d5d17af70e764438435fd62b2a28792f7e2c53
SHA512

8332b3819554320ec7f4caa7f984c6e7a0b7fc6e1491ea04d846de37f0239af5979abdb4760db986ccb6adc738f685d83911714019c92b31572c15431bbdf768

Score

10^/10

qakbot tr 1633597626 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633597626

C2

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2892 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

296 schtasks.exe

pid	process
2892	regsvr32.exe

pid	process
296	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eiiaxou	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eiiaxou\946c8308 = 015ffc33539d1268c9f209e78f6b7001cd15789bc41a7c72d9ac0f2f26bc40512395606935b9a6120ac3fc6e8b86901f2da8441698a8a2d4e4dc98ae646938b03e47e96fdae69ed657af5127ad4e4736f0502f733ba7cb28834b595908bb7bedf3103e73d5c55c87b19a2d7ba411167b538a493e4c347ab838f6a8ee62fd6a1ae0c5c4624a1267e3eebc956271defd997cc56c7e5fca3feda0b76aad0cc71edee55c1e1e80983cebe4b0ccf821	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eiiaxou\eb25ecfe = ddc3561619a86b09e559674b0ecc12933a59ef98cb092d432959c11d687ff0460c661a53683430c04c4101921555a902e0ddb1692794dd72b3d19e502d861105ca24534ae973532978b05268da91ea383e65	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eiiaxou\2cd0e46d = c9785ef1746fc29b671f19c8afd7899e51e525300a757a0afc6f24a99917104ed5a0f6aeefb5cb088b8acb35cca5b1c0334bb166d180cdbd8d7bdae1b65437909b408d99daa2d41cbd756e4600de535b6e3f37193b0ed8402f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eiiaxou\deba3cb0 = db77733060ecb7c44de62f7e316ee9122c8819af595a3ebc01b20ed4534f689c6048e9fa	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eiiaxou\a1f35346 = fee7538d9e46bb23192bf9903961117c1433982e7a1141094bd8a8cf88c2f9c2b447fa0983d1d02e0b2b3ace07fca48baf8d77b5c4563e8585f567681fc31a7cffec292d7f3b7cead52731d1f3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eiiaxou\962da374 = 4c476c9480ee327e272e0e705edf21891d93c33c2c2bf83e9b2875f8c264c13c4ae9eed34926cfd4491917dc1ad62175ea69c9e8efc5300da1b538f47fc9c661ba0ec8f116f556573e07	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eiiaxou\2e91c411 = 00dd690e36f20a127c3595c550ddc0935fd73683572d3d7a73e02b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eiiaxou\53998b9b = cff07dd8f921b7528428128f3f10d3216fe9321aac53d5115ba6acf63aec3e68df69427b371697e6e5bf2ce112fa921595aa73d43d3b409806b3ec3250fd830a86a23d86dbca250c090381c498	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eiiaxou\a1f35346 = fee7448d9e468e5b0df4e51b9d510306bb17ae841ef9de08e8bfce10a07b08795ba554d2908f9f3054dba6469be9e3d4d9455f22a5348f58c0bb23cb89d7bf954c9342469a40ad70f9306578f0cd18a1758b113739e61bafbfb07f6a9ea6294a2fab	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3952 rundll32.exe
3952 rundll32.exe
2892 regsvr32.exe
2892 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3952 rundll32.exe
2892 regsvr32.exe

pid	process
3952	rundll32.exe
3952	rundll32.exe
2892	regsvr32.exe
2892	regsvr32.exe

pid	process
3952	rundll32.exe
2892	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1440 wrote to memory of 3952	1440	rundll32.exe	rundll32.exe
PID 1440 wrote to memory of 3952	1440	rundll32.exe	rundll32.exe
PID 1440 wrote to memory of 3952	1440	rundll32.exe	rundll32.exe
PID 3952 wrote to memory of 3580	3952	rundll32.exe	explorer.exe
PID 3952 wrote to memory of 3580	3952	rundll32.exe	explorer.exe
PID 3952 wrote to memory of 3580	3952	rundll32.exe	explorer.exe
PID 3952 wrote to memory of 3580	3952	rundll32.exe	explorer.exe
PID 3952 wrote to memory of 3580	3952	rundll32.exe	explorer.exe
PID 3580 wrote to memory of 296	3580	explorer.exe	schtasks.exe
PID 3580 wrote to memory of 296	3580	explorer.exe	schtasks.exe
PID 3580 wrote to memory of 296	3580	explorer.exe	schtasks.exe
PID 844 wrote to memory of 2892	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 2892	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 2892	844	regsvr32.exe	regsvr32.exe
PID 2892 wrote to memory of 2612	2892	regsvr32.exe	explorer.exe
PID 2892 wrote to memory of 2612	2892	regsvr32.exe	explorer.exe
PID 2892 wrote to memory of 2612	2892	regsvr32.exe	explorer.exe
PID 2892 wrote to memory of 2612	2892	regsvr32.exe	explorer.exe
PID 2892 wrote to memory of 2612	2892	regsvr32.exe	explorer.exe
PID 2612 wrote to memory of 2936	2612	explorer.exe	reg.exe
PID 2612 wrote to memory of 2936	2612	explorer.exe	reg.exe
PID 2612 wrote to memory of 2456	2612	explorer.exe	reg.exe
PID 2612 wrote to memory of 2456	2612	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test2.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test2.test.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3952

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3580

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qqqgffkj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test2.test.dll\"" /SC ONCE /Z /ST 20:04 /ET 20:16
4⤵
- Creates scheduled task(s)
PID:296

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test2.test.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\test2.test.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2892

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Yesfvahcjmw" /d "0"
4⤵
PID:2936

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Aztwdwsxdzfq" /d "0"
4⤵
PID:2456

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test2.test.dll
MD5
0d6fec2902107153fcd82b55cbcb7fc6

SHA1
611d40a2b2494a987addcb742e104ef25a0d9b13

SHA256
60752aec0aacef946678c9cd53d5d17af70e764438435fd62b2a28792f7e2c53

SHA512
8332b3819554320ec7f4caa7f984c6e7a0b7fc6e1491ea04d846de37f0239af5979abdb4760db986ccb6adc738f685d83911714019c92b31572c15431bbdf768

Download Submit
\Users\Admin\AppData\Local\Temp\test2.test.dll
MD5
0d6fec2902107153fcd82b55cbcb7fc6

SHA1
611d40a2b2494a987addcb742e104ef25a0d9b13

SHA256
60752aec0aacef946678c9cd53d5d17af70e764438435fd62b2a28792f7e2c53

SHA512
8332b3819554320ec7f4caa7f984c6e7a0b7fc6e1491ea04d846de37f0239af5979abdb4760db986ccb6adc738f685d83911714019c92b31572c15431bbdf768

Download Submit
memory/296-118-0x0000000000000000-mapping.dmp

Download
memory/2456-129-0x0000000000000000-mapping.dmp

Download
memory/2612-126-0x0000000000000000-mapping.dmp

Download
memory/2612-131-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/2612-130-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/2612-127-0x0000000000120000-0x0000000000141000-memory.dmp

Filesize
132KB

Download
memory/2892-123-0x0000000000000000-mapping.dmp

Download
memory/2892-125-0x0000000002BA0000-0x0000000007E54000-memory.dmp

Filesize
82.7MB

Download
memory/2936-128-0x0000000000000000-mapping.dmp

Download
memory/3580-117-0x0000000000000000-mapping.dmp

Download
memory/3580-121-0x0000000000180000-0x00000000001A1000-memory.dmp

Filesize
132KB

Download
memory/3580-120-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/3580-119-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/3952-115-0x0000000004B70000-0x0000000009E24000-memory.dmp

Filesize
82.7MB

Download
memory/3952-116-0x0000000010000000-0x000000001530B000-memory.dmp

Filesize
83.0MB

Download
memory/3952-114-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads