qakbot | ecd8bef42e95c6569eba5e866f74a7e97ae2d64445042d26f731158722b05070

General

Target

test1.test.dll
Size

833KB
MD5

3ddb39b2274cac8767d7b30330b5e392
SHA1

e7c29e9b9109056647293df1b0bb040937352726
SHA256

ecd8bef42e95c6569eba5e866f74a7e97ae2d64445042d26f731158722b05070
SHA512

102ebb5fd26743dae06d7e74d5ab1d216147004361e9fe654bf4333b4fa5551205a3429453684ba04d7a79385d23c5290999e3a77afbf8b6d053df83641923c7

Score

10^/10

qakbot tr 1633597626 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633597626

C2

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1764 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1280 schtasks.exe

pid	process
1764	regsvr32.exe

pid	process
1280	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yogavaq\cb62d75e = 765ff454a88fbe26a5e3539d0c4c88f51861836cc3812dc387b67608633d123c645d967c0dab0a17ceb344950cce14ed5cc580	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yogavaq\ed6ffb1 = 4c43e5492d13ed1be79a06ce95ac2774220145f142578dc905a71d6dfdbbe8cc18f6f4c6c8a9cbf8c2334ba70b5acfb7d46f1abc9c8564	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yogavaq\44004009 = 91f568e634991be7d771b82fe664136ca0968d57faabd8485937ddd24bacc8ef4309592de7420cc647e726	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yogavaq\44004009 = 91f57fe634992e686d9e548166896e2e50dcb599cbdf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yogavaq\719f9047 = d53bc346f46ea367d27cfbd7e5c10acf0ee5f1d3034393c81b945ffa870f80a66aeddbcfbc499456c3926a659686cb335d0f96da11acc8cd8c5bb201c9d0b6dd5e214ed5c99eb6dd49c021e1d4b471a5b7d4b314b03dd2cc4f2b9a8b917dc55591b332ec19d0ddce637ae0c08f6e985ec680a51697a38e39dbb7d23a21b9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yogavaq\b66a98d4 = 7ada5b5f40f59aac16cbf8a883f2294e571077d64b89005252c4c61db90033a65df38c76f5869fc9bc931fd87c7fe16660d747e3cee883a2c1fb7cc00a9243a41f8ae69b9bad3abd7f502aa045b4c7f5b46da978aa3cbf9babdbed102891c7f080c909658a5edc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yogavaq\c923f722 = be93929a870745fe9f5f75b305a3901e35687cab86f8ea899304f0c77a6befe9e6c692	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yogavaq\3b492fff = eb9363f241f5f540e16d734140541c2756e9d9e7c1c1a15e62a9af313746fbedaab96a059ce9dff97b7aefd92b50d3d650ab74c253ff3799c3a855f6aa6571735dfdb36a40954d01e0e93555b2e5726fe3900c86c2cbfc7464ef	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yogavaq	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yogavaq\73deb03b = 6f8cc2bf391394f4e0d81a7c08b28dc5c7a6f2f4c3887ee61678e73af290251d50c03a3184024dd79e2359aae02eef5d7ed071b30a15c35cb15ea83824c2d41f126e	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2184 rundll32.exe
2184 rundll32.exe
1764 regsvr32.exe
1764 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2184 rundll32.exe
1764 regsvr32.exe

pid	process
2184	rundll32.exe
2184	rundll32.exe
1764	regsvr32.exe
1764	regsvr32.exe

pid	process
2184	rundll32.exe
1764	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2160 wrote to memory of 2184	2160	rundll32.exe	rundll32.exe
PID 2160 wrote to memory of 2184	2160	rundll32.exe	rundll32.exe
PID 2160 wrote to memory of 2184	2160	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 3648	2184	rundll32.exe	explorer.exe
PID 2184 wrote to memory of 3648	2184	rundll32.exe	explorer.exe
PID 2184 wrote to memory of 3648	2184	rundll32.exe	explorer.exe
PID 2184 wrote to memory of 3648	2184	rundll32.exe	explorer.exe
PID 2184 wrote to memory of 3648	2184	rundll32.exe	explorer.exe
PID 3648 wrote to memory of 1280	3648	explorer.exe	schtasks.exe
PID 3648 wrote to memory of 1280	3648	explorer.exe	schtasks.exe
PID 3648 wrote to memory of 1280	3648	explorer.exe	schtasks.exe
PID 356 wrote to memory of 1764	356	regsvr32.exe	regsvr32.exe
PID 356 wrote to memory of 1764	356	regsvr32.exe	regsvr32.exe
PID 356 wrote to memory of 1764	356	regsvr32.exe	regsvr32.exe
PID 1764 wrote to memory of 1516	1764	regsvr32.exe	explorer.exe
PID 1764 wrote to memory of 1516	1764	regsvr32.exe	explorer.exe
PID 1764 wrote to memory of 1516	1764	regsvr32.exe	explorer.exe
PID 1764 wrote to memory of 1516	1764	regsvr32.exe	explorer.exe
PID 1764 wrote to memory of 1516	1764	regsvr32.exe	explorer.exe
PID 1516 wrote to memory of 4024	1516	explorer.exe	reg.exe
PID 1516 wrote to memory of 4024	1516	explorer.exe	reg.exe
PID 1516 wrote to memory of 952	1516	explorer.exe	reg.exe
PID 1516 wrote to memory of 952	1516	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test1.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test1.test.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3648

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn nmjjbqq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test1.test.dll\"" /SC ONCE /Z /ST 18:57 /ET 19:09
4⤵
- Creates scheduled task(s)
PID:1280

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test1.test.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:356

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\test1.test.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Anrfkf" /d "0"
4⤵
PID:4024

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Btjbbwwgcegb" /d "0"
4⤵
PID:952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test1.test.dll
MD5
3ddb39b2274cac8767d7b30330b5e392

SHA1
e7c29e9b9109056647293df1b0bb040937352726

SHA256
ecd8bef42e95c6569eba5e866f74a7e97ae2d64445042d26f731158722b05070

SHA512
102ebb5fd26743dae06d7e74d5ab1d216147004361e9fe654bf4333b4fa5551205a3429453684ba04d7a79385d23c5290999e3a77afbf8b6d053df83641923c7

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\test1.test.dll
MD5
3ddb39b2274cac8767d7b30330b5e392

SHA1
e7c29e9b9109056647293df1b0bb040937352726

SHA256
ecd8bef42e95c6569eba5e866f74a7e97ae2d64445042d26f731158722b05070

SHA512
102ebb5fd26743dae06d7e74d5ab1d216147004361e9fe654bf4333b4fa5551205a3429453684ba04d7a79385d23c5290999e3a77afbf8b6d053df83641923c7

Download Submit
memory/952-135-0x0000000000000000-mapping.dmp

Download
memory/1280-122-0x0000000000000000-mapping.dmp

Download
memory/1516-136-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1516-137-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1516-132-0x0000000000000000-mapping.dmp

Download
memory/1516-138-0x0000000000990000-0x00000000009B1000-memory.dmp

Filesize
132KB

Download
memory/1764-130-0x0000000073000000-0x0000000073171000-memory.dmp

Filesize
1.4MB

Download
memory/1764-128-0x0000000073000000-0x0000000073171000-memory.dmp

Filesize
1.4MB

Download
memory/1764-129-0x0000000073000000-0x0000000073021000-memory.dmp

Filesize
132KB

Download
memory/1764-126-0x0000000000000000-mapping.dmp

Download
memory/1764-131-0x0000000002710000-0x0000000002711000-memory.dmp

Filesize
4KB

Download
memory/2184-119-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/2184-117-0x00000000742A0000-0x00000000742C1000-memory.dmp

Filesize
132KB

Download
memory/2184-118-0x00000000742A0000-0x0000000074411000-memory.dmp

Filesize
1.4MB

Download
memory/2184-116-0x00000000742A0000-0x0000000074411000-memory.dmp

Filesize
1.4MB

Download
memory/2184-115-0x0000000000000000-mapping.dmp

Download
memory/3648-124-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/3648-123-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/3648-121-0x00000000004F0000-0x0000000000511000-memory.dmp

Filesize
132KB

Download
memory/3648-120-0x0000000000000000-mapping.dmp

Download
memory/4024-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads