qakbot | 1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe

General

Target

94128f783ebffa5f5203389d3dc26a0e.dll
Size

890KB
MD5

94128f783ebffa5f5203389d3dc26a0e
SHA1

577840a380a9b4f7aeddd00fa21b15a4926755be
SHA256

1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe
SHA512

94afeb12874513354fbf0d23cd7589b962e88efc45a669f01f3f04bde31562b304cd80cdf5d47e75925d4d37292bbe563c0d2f2999e8758520d1858dc4e1765b

Score

10^/10

qakbot biden54 1634810637 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden54

Campaign

1634810637

C2

136.143.11.232:443

63.143.92.99:995

182.176.180.73:443

136.232.34.70:443

123.252.190.14:443

216.201.162.158:443

37.208.181.198:61200

140.82.49.12:443

197.89.144.102:443

89.137.52.44:443

109.12.111.14:443

78.191.24.189:995

105.198.236.99:995

196.207.140.40:995

41.235.69.115:443

2.222.167.138:443

117.198.156.56:443

24.231.209.2:6881

27.223.92.142:995

96.246.158.154:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1448 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

272 schtasks.exe

pid	process
1448	regsvr32.exe

pid	process
272	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaiaukezfqimk\97d057bf = f72beb1bc69367503baa472bca0fb6261552785661e35baec71daf1e236218278c237a13f24aafb74fc968b03c5190f6001e484bbed4d8dcbfc7be37fe59dfe40f93cf61e012f2cef4ac9ed98078ec734116b7a10146479283e7847a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaiaukezfqimk\65ba8f62 = 51b49938a7401b267cb4ef31497513686b056a85fe520e284151b956039bfd5ce3d71bf53b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaiaukezfqimk\2d2d10a6 = 13da0a23993e0a3bebe1e25e0afa0d8432c1c7e61351befcc13fcefef00715f1f921e055fc8c7b443f6bfb51cbb9efc27b5068d39f5949ee6117b8264877ef296e0dcc1a2c62b4c49b202a060cc293214f47fe39867d43c42275f46337bc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaiaukezfqimk\959177c3 = 012bf80da864874da82f5b3e8e7be25088a4696a4bbe6dbc4cc20c9caf6902c2a9b4ee	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaiaukezfqimk\e8993849 = 1fcf7ad1bb843fdc481e57dd130f399559752f07f4327093412e432174f0ff3ff884ac61e5c088c604bf35d79021ae33d84cdacb9440991e8e223b2792612da0b869456a7f984c4a6584c20e8b21a1ccf8e368f89a0bba22b2abc4e8e9bdf84dd699ce2f30bd10a318ecbf7c86e5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaiaukezfqimk\50255f2c = 99fe6adb2dbaadc1c0fc788a8a3e3cf149f66687dc2dce6ca70f95df67e710156ec6bcb5a9c40417	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaiaukezfqimk\1af3e094 = d126cee3a836b38ba60a73037b3142a8854f27807626e454002dcae6aba6b977e5ca8e28fd0d9bb08e1470f41fb62114ab756b4b44f6827e913bcae451142b64cb6d122b57df77e89142fa062578996f78ce2a66ff7657c9d70f8abd4fd7575cff0e60cc25457e283e2d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaiaukezfqimk	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaiaukezfqimk\1af3e094 = d126d9e3a836863794f6c08df3e53f176896dc35524bfb5a9eef93bc77c4e2626d3722f05a0ce642eced43eff6552e4429fc1ea21756eef454010d0bf94a78454a51218aa525b4c91f4d5058d204f3cfc482e8104b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oaiaukezfqimk\2f6c30da = 226f7bd292de65573c391a355b7ffb32544ae0ffc5a910e55b36c0f2573fb74a1d5d6e8589724b9eff13362da1d1dda1d9ce4567e71d543d41b896dfaef2bdfda29853b99c208413bed55858fc9b06f9e99228c39c76094574ce4f992286bb6ac0444e702559a8d15eac6306bd	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1060 rundll32.exe
1448 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1060 rundll32.exe
1448 regsvr32.exe

pid	process
1060	rundll32.exe
1448	regsvr32.exe

pid	process
1060	rundll32.exe
1448	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 472 wrote to memory of 1060	472	rundll32.exe	rundll32.exe
PID 472 wrote to memory of 1060	472	rundll32.exe	rundll32.exe
PID 472 wrote to memory of 1060	472	rundll32.exe	rundll32.exe
PID 472 wrote to memory of 1060	472	rundll32.exe	rundll32.exe
PID 472 wrote to memory of 1060	472	rundll32.exe	rundll32.exe
PID 472 wrote to memory of 1060	472	rundll32.exe	rundll32.exe
PID 472 wrote to memory of 1060	472	rundll32.exe	rundll32.exe
PID 1060 wrote to memory of 1876	1060	rundll32.exe	explorer.exe
PID 1060 wrote to memory of 1876	1060	rundll32.exe	explorer.exe
PID 1060 wrote to memory of 1876	1060	rundll32.exe	explorer.exe
PID 1060 wrote to memory of 1876	1060	rundll32.exe	explorer.exe
PID 1060 wrote to memory of 1876	1060	rundll32.exe	explorer.exe
PID 1060 wrote to memory of 1876	1060	rundll32.exe	explorer.exe
PID 1876 wrote to memory of 272	1876	explorer.exe	schtasks.exe
PID 1876 wrote to memory of 272	1876	explorer.exe	schtasks.exe
PID 1876 wrote to memory of 272	1876	explorer.exe	schtasks.exe
PID 1876 wrote to memory of 272	1876	explorer.exe	schtasks.exe
PID 1032 wrote to memory of 1660	1032	taskeng.exe	regsvr32.exe
PID 1032 wrote to memory of 1660	1032	taskeng.exe	regsvr32.exe
PID 1032 wrote to memory of 1660	1032	taskeng.exe	regsvr32.exe
PID 1032 wrote to memory of 1660	1032	taskeng.exe	regsvr32.exe
PID 1032 wrote to memory of 1660	1032	taskeng.exe	regsvr32.exe
PID 1660 wrote to memory of 1448	1660	regsvr32.exe	regsvr32.exe
PID 1660 wrote to memory of 1448	1660	regsvr32.exe	regsvr32.exe
PID 1660 wrote to memory of 1448	1660	regsvr32.exe	regsvr32.exe
PID 1660 wrote to memory of 1448	1660	regsvr32.exe	regsvr32.exe
PID 1660 wrote to memory of 1448	1660	regsvr32.exe	regsvr32.exe
PID 1660 wrote to memory of 1448	1660	regsvr32.exe	regsvr32.exe
PID 1660 wrote to memory of 1448	1660	regsvr32.exe	regsvr32.exe
PID 1448 wrote to memory of 1884	1448	regsvr32.exe	explorer.exe
PID 1448 wrote to memory of 1884	1448	regsvr32.exe	explorer.exe
PID 1448 wrote to memory of 1884	1448	regsvr32.exe	explorer.exe
PID 1448 wrote to memory of 1884	1448	regsvr32.exe	explorer.exe
PID 1448 wrote to memory of 1884	1448	regsvr32.exe	explorer.exe
PID 1448 wrote to memory of 1884	1448	regsvr32.exe	explorer.exe
PID 1884 wrote to memory of 1652	1884	explorer.exe	reg.exe
PID 1884 wrote to memory of 1652	1884	explorer.exe	reg.exe
PID 1884 wrote to memory of 1652	1884	explorer.exe	reg.exe
PID 1884 wrote to memory of 1652	1884	explorer.exe	reg.exe
PID 1884 wrote to memory of 840	1884	explorer.exe	reg.exe
PID 1884 wrote to memory of 840	1884	explorer.exe	reg.exe
PID 1884 wrote to memory of 840	1884	explorer.exe	reg.exe
PID 1884 wrote to memory of 840	1884	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\94128f783ebffa5f5203389d3dc26a0e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:472

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\94128f783ebffa5f5203389d3dc26a0e.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dsrnqntmfd /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\94128f783ebffa5f5203389d3dc26a0e.dll\"" /SC ONCE /Z /ST 12:21 /ET 12:33
4⤵
- Creates scheduled task(s)
PID:272

C:\Windows\system32\taskeng.exe
taskeng.exe {7CAFC69A-A8C6-4A6D-A4A0-E05709F6B745} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\94128f783ebffa5f5203389d3dc26a0e.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\94128f783ebffa5f5203389d3dc26a0e.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Symlhyxrdy" /d "0"
5⤵
PID:1652

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Bdaydzjxixaa" /d "0"
5⤵
PID:840

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\94128f783ebffa5f5203389d3dc26a0e.dll
MD5
94128f783ebffa5f5203389d3dc26a0e

SHA1
577840a380a9b4f7aeddd00fa21b15a4926755be

SHA256
1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe

SHA512
94afeb12874513354fbf0d23cd7589b962e88efc45a669f01f3f04bde31562b304cd80cdf5d47e75925d4d37292bbe563c0d2f2999e8758520d1858dc4e1765b

Download Submit
\Users\Admin\AppData\Local\Temp\94128f783ebffa5f5203389d3dc26a0e.dll
MD5
94128f783ebffa5f5203389d3dc26a0e

SHA1
577840a380a9b4f7aeddd00fa21b15a4926755be

SHA256
1a8c6286a51023a2c737ea6e18eaeb044d726c4d9f1ed64dd70d9b80d8998cfe

SHA512
94afeb12874513354fbf0d23cd7589b962e88efc45a669f01f3f04bde31562b304cd80cdf5d47e75925d4d37292bbe563c0d2f2999e8758520d1858dc4e1765b

Download Submit
memory/272-65-0x0000000000000000-mapping.dmp

Download
memory/840-82-0x0000000000000000-mapping.dmp

Download
memory/1060-54-0x0000000000000000-mapping.dmp

Download
memory/1060-59-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1060-58-0x0000000074D70000-0x0000000074E63000-memory.dmp

Filesize
972KB

Download
memory/1060-57-0x0000000074D70000-0x0000000074D91000-memory.dmp

Filesize
132KB

Download
memory/1060-56-0x0000000074D70000-0x0000000074E63000-memory.dmp

Filesize
972KB

Download
memory/1060-55-0x00000000768C1000-0x00000000768C3000-memory.dmp

Filesize
8KB

Download
memory/1448-75-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1448-73-0x0000000074470000-0x0000000074491000-memory.dmp

Filesize
132KB

Download
memory/1448-74-0x0000000074470000-0x0000000074563000-memory.dmp

Filesize
972KB

Download
memory/1448-72-0x0000000074470000-0x0000000074563000-memory.dmp

Filesize
972KB

Download
memory/1448-69-0x0000000000000000-mapping.dmp

Download
memory/1652-81-0x0000000000000000-mapping.dmp

Download
memory/1660-67-0x000007FEFBFD1000-0x000007FEFBFD3000-memory.dmp

Filesize
8KB

Download
memory/1660-66-0x0000000000000000-mapping.dmp

Download
memory/1876-64-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1876-63-0x0000000074961000-0x0000000074963000-memory.dmp

Filesize
8KB

Download
memory/1876-61-0x0000000000000000-mapping.dmp

Download
memory/1876-60-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/1884-77-0x0000000000000000-mapping.dmp

Download
memory/1884-80-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads