qakbot | 10bd9f37368e1f0e034f9a289dcf29b500e9a77f9e05621ca9e4e21c56d838c8

General

Target

10bd9f37368e1f0e034f9a289dcf29b500e9a77f9e05621ca9e4e21c56d838c8.dll
Size

1.6MB
MD5

45c23bf7827e99d6d80e4a6341861399
SHA1

50d163a0862d47831e48beeede3115e579536cdf
SHA256

10bd9f37368e1f0e034f9a289dcf29b500e9a77f9e05621ca9e4e21c56d838c8
SHA512

c0cd2a1f68a49927d7ee01f61344fece00c5c15c759819b28fb03222a78e1ed72fd51ad229166d34390aa8a61d3d616407935c69346674589c093fe77a5383ff

Score

10^/10

qakbot tr 1634541613 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2436 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3172 schtasks.exe

pid	process
2436	regsvr32.exe

pid	process
3172	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ytvhtatwk\81861de1 = 5ff15de91170f113bcc17f0febb15837cbd1062e74f050260e5bc8bd2c3a0401d0ce54b7e0a6d3dae5fe0035b755b4804dea58efce	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ytvhtatwk\ee48ab6 = 9ee2b9153726d479a3b1eef89ee9df10a1d15bb08eab28979e931005	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ytvhtatwk\73ecc53c = 40a967d4400878f706dffc5dbfc91be1c7396f1a57354e53745db3cb80cd6b33ce4d572f34a3500e9dd1ddff1784c7c5cbda530c88525c0b9bae5ae991dc3072ba99d30207a4f8b08a73cff7df	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ytvhtatwk\ca5aaca = 25faf25e9ae16f341e1e7a9ae0b6b50a36715dcf9bc4fa73b64ab4bd0529666b8e2d0a9b97108d090cd6a6cd949eaad75ff8c509153672ee17b7b93f77e2acb0dd5d4351785c11e45aff	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ytvhtatwk\fecf7217 = 38e0b40e91fe29bdad2507bba0ba167147309ca461e256e4a0622229478fc58865c2813016269553f1639d5a6778caacaaf3af6e6b517f819ee46cace73a2dfcd7a0a5081193acb21b2ccc2848f934cd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ytvhtatwk\81861de1 = 5ff14ae91170c43e1d157fa0b6437a81a1d6b11eb7c51f694aeae38fcb58d4734e8772c5cf28c9e61c80ad5038ae2e79f4987f6985b7bbf781696ed63415cb903aa85ae7f2af0ea3e02d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ytvhtatwk	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ytvhtatwk\b419cdaf = 65f1656eb2774f696a6a081f0da7c4974ef977b064052aa4892bb096466721b48fbac377f4a02212a0cd3c09f5235eccc56be21bb88d209caa17f9778c555b208b3e4cb096d30f01b8f26a119f86f8b79a9e8f2fc3ecf42907fda8976b225b102e2f71bbd2d79faf843e6bfe851b6dc50c03ded6a02a3657200a0a892d878ed7c0cb92dfab26fd1fa9a8d08bfe314859b63600bfef	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ytvhtatwk\b658edd3 = 95f5ba4356999aead7d5e65b1775	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ytvhtatwk\cb50a259 = 001a9239378769f5d6ce3f2bd2e017cbffbe29ed44dc8951	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2972 rundll32.exe
2972 rundll32.exe
2436 regsvr32.exe
2436 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2972 rundll32.exe
2436 regsvr32.exe

pid	process
2972	rundll32.exe
2972	rundll32.exe
2436	regsvr32.exe
2436	regsvr32.exe

pid	process
2972	rundll32.exe
2436	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2704 wrote to memory of 2972	2704	rundll32.exe	rundll32.exe
PID 2704 wrote to memory of 2972	2704	rundll32.exe	rundll32.exe
PID 2704 wrote to memory of 2972	2704	rundll32.exe	rundll32.exe
PID 2972 wrote to memory of 3612	2972	rundll32.exe	explorer.exe
PID 2972 wrote to memory of 3612	2972	rundll32.exe	explorer.exe
PID 2972 wrote to memory of 3612	2972	rundll32.exe	explorer.exe
PID 2972 wrote to memory of 3612	2972	rundll32.exe	explorer.exe
PID 2972 wrote to memory of 3612	2972	rundll32.exe	explorer.exe
PID 3612 wrote to memory of 3172	3612	explorer.exe	schtasks.exe
PID 3612 wrote to memory of 3172	3612	explorer.exe	schtasks.exe
PID 3612 wrote to memory of 3172	3612	explorer.exe	schtasks.exe
PID 1036 wrote to memory of 2436	1036	regsvr32.exe	regsvr32.exe
PID 1036 wrote to memory of 2436	1036	regsvr32.exe	regsvr32.exe
PID 1036 wrote to memory of 2436	1036	regsvr32.exe	regsvr32.exe
PID 2436 wrote to memory of 3472	2436	regsvr32.exe	explorer.exe
PID 2436 wrote to memory of 3472	2436	regsvr32.exe	explorer.exe
PID 2436 wrote to memory of 3472	2436	regsvr32.exe	explorer.exe
PID 2436 wrote to memory of 3472	2436	regsvr32.exe	explorer.exe
PID 2436 wrote to memory of 3472	2436	regsvr32.exe	explorer.exe
PID 3472 wrote to memory of 1860	3472	explorer.exe	reg.exe
PID 3472 wrote to memory of 1860	3472	explorer.exe	reg.exe
PID 3472 wrote to memory of 828	3472	explorer.exe	reg.exe
PID 3472 wrote to memory of 828	3472	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10bd9f37368e1f0e034f9a289dcf29b500e9a77f9e05621ca9e4e21c56d838c8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2704

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10bd9f37368e1f0e034f9a289dcf29b500e9a77f9e05621ca9e4e21c56d838c8.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2972

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3612

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn saghyiyscf /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\10bd9f37368e1f0e034f9a289dcf29b500e9a77f9e05621ca9e4e21c56d838c8.dll\"" /SC ONCE /Z /ST 12:41 /ET 12:53
4⤵
- Creates scheduled task(s)
PID:3172

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\10bd9f37368e1f0e034f9a289dcf29b500e9a77f9e05621ca9e4e21c56d838c8.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\10bd9f37368e1f0e034f9a289dcf29b500e9a77f9e05621ca9e4e21c56d838c8.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2436

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3472

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Mibzuelby" /d "0"
4⤵
PID:1860

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Yjegya" /d "0"
4⤵
PID:828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\10bd9f37368e1f0e034f9a289dcf29b500e9a77f9e05621ca9e4e21c56d838c8.dll
MD5
45c23bf7827e99d6d80e4a6341861399

SHA1
50d163a0862d47831e48beeede3115e579536cdf

SHA256
10bd9f37368e1f0e034f9a289dcf29b500e9a77f9e05621ca9e4e21c56d838c8

SHA512
c0cd2a1f68a49927d7ee01f61344fece00c5c15c759819b28fb03222a78e1ed72fd51ad229166d34390aa8a61d3d616407935c69346674589c093fe77a5383ff

Download Submit
\Users\Admin\AppData\Local\Temp\10bd9f37368e1f0e034f9a289dcf29b500e9a77f9e05621ca9e4e21c56d838c8.dll
MD5
45c23bf7827e99d6d80e4a6341861399

SHA1
50d163a0862d47831e48beeede3115e579536cdf

SHA256
10bd9f37368e1f0e034f9a289dcf29b500e9a77f9e05621ca9e4e21c56d838c8

SHA512
c0cd2a1f68a49927d7ee01f61344fece00c5c15c759819b28fb03222a78e1ed72fd51ad229166d34390aa8a61d3d616407935c69346674589c093fe77a5383ff

Download Submit
memory/828-134-0x0000000000000000-mapping.dmp

Download
memory/1860-133-0x0000000000000000-mapping.dmp

Download
memory/2436-130-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2436-125-0x0000000000000000-mapping.dmp

Download
memory/2436-129-0x0000000072E80000-0x000000007302B000-memory.dmp

Filesize
1.7MB

Download
memory/2436-128-0x0000000072E80000-0x0000000072EA1000-memory.dmp

Filesize
132KB

Download
memory/2436-127-0x0000000072E80000-0x000000007302B000-memory.dmp

Filesize
1.7MB

Download
memory/2972-119-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/2972-117-0x0000000074140000-0x0000000074161000-memory.dmp

Filesize
132KB

Download
memory/2972-115-0x0000000000000000-mapping.dmp

Download
memory/2972-118-0x0000000074140000-0x00000000742EB000-memory.dmp

Filesize
1.7MB

Download
memory/2972-116-0x0000000074140000-0x00000000742EB000-memory.dmp

Filesize
1.7MB

Download
memory/3172-122-0x0000000000000000-mapping.dmp

Download
memory/3472-131-0x0000000000000000-mapping.dmp

Download
memory/3472-132-0x0000000000F40000-0x0000000000F61000-memory.dmp

Filesize
132KB

Download
memory/3472-136-0x0000000003A30000-0x0000000003A31000-memory.dmp

Filesize
4KB

Download
memory/3472-135-0x0000000003A30000-0x0000000003A31000-memory.dmp

Filesize
4KB

Download
memory/3612-120-0x0000000000000000-mapping.dmp

Download
memory/3612-123-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/3612-121-0x00000000007C0000-0x00000000007E1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads