qakbot | 9fd2f36653216c8e653de84e5f247e3c9c379fc98f2644fd20ccde41bba501bf

General

Target

9d0548b0495518b448154aee4726aa5c.dll
Size

890KB
MD5

9d0548b0495518b448154aee4726aa5c
SHA1

839cecb1e45d0dd5af4397754ee3564f0848eb1b
SHA256

9fd2f36653216c8e653de84e5f247e3c9c379fc98f2644fd20ccde41bba501bf
SHA512

9ca2401fb0b821969540c2e2e32d9625c2400d504bf23399a94c6335ca5c24bfa333610e9b70899e7236a040d301f0b95baeffe234925c5de5ca749c0a059019

Score

10^/10

qakbot biden54 1634810637 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden54

Campaign

1634810637

C2

136.143.11.232:443

63.143.92.99:995

182.176.180.73:443

136.232.34.70:443

123.252.190.14:443

216.201.162.158:443

37.208.181.198:61200

140.82.49.12:443

197.89.144.102:443

89.137.52.44:443

109.12.111.14:443

78.191.24.189:995

105.198.236.99:995

196.207.140.40:995

41.235.69.115:443

2.222.167.138:443

117.198.156.56:443

24.231.209.2:6881

27.223.92.142:995

96.246.158.154:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1552 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1984 schtasks.exe

pid	process
1552	regsvr32.exe

pid	process
1984	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dsdienagiloey\feff2c01 = 2c08ce53ffde35fc61300fa4f11ab9c948c24e1ae0fe6ab340b4f745365fed8df5e1d963eda06a932d273cef7309487a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dsdienagiloey\cb60fc4f = 6cc262ad3adbcc1f58dd75edcf0cb23c9c839912211f1775ca2ff4136d0fb5c32aa123b75c772943cd71ca9dd786f5b31b124a16c6ea29d43da9589cc8bd3f304a3600104a788e96ba289cccc92aa365fb39764a3403ec0843dac94fd06d9e114286a443e8d04c2a7d9e6d562ab45f15249271e33749f04224598b428feb4c564c054604b437a9660b4346beaaec411efd9ee2401b9901ce2497619b86c4eb1ac09bb5b185937711910c7cb4cbbebc896e877e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dsdienagiloey\719dbb56 = 3d86fa0e8d0c437fe47d75a19ba8535b20b922a7277756f81ecd6cf565f90622bfb9f8cf00a1a5e10b36f6b92eb2074aad8787c056ed68a45bcbb0b2f386e71b0f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dsdienagiloey\b42993b9 = 16d6eec68d57ede765b47346b3dd0d920a5724cf0abca02ba8f8fa091ed5b803ab7343f0583b81bbbe8d21dfe90a3b16fa94	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dsdienagiloey\73dc9b2a = b1ffa2643a1f84cd2aae7a18b623949c77337025a6a8d17452f1c2b4eeed7bf28c57d77337c2376f7c71d09b1da16d09b14a6f9b490961edae272ebc5cae482337b770bd197f9e4e955368273ab436d7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dsdienagiloey\81b643f7 = 1c45f8b10f5163f78aa75dd3b154eac8fe0c6e7bd02b99b4d1bb73f4cfb55a0491b6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dsdienagiloey\feff2c01 = 2c08d953ffde00f4a31d77105f6beac41cbffc72e7f3def943d14c25c8763a5c9ff0fd1842b24716182f0c4d1dca0cd6290dad85fcda63507ca38f99243cebe894e1cd16fc	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dsdienagiloey	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dsdienagiloey\c921dc33 = d9dc383762b2b4f3f8a0d2ce6a9968b68c4ce33fc7bd19c8cf5c8d0120322a63a6fbd2b2358d6c41dad01b2a16a738c63b9b2f9bf8ddff9d148672	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dsdienagiloey\c95f4dc = 917a9c15d5392ce862c0ad481fa5a481da9f7269573b827514	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

568 rundll32.exe
1552 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

568 rundll32.exe
1552 regsvr32.exe

pid	process
568	rundll32.exe
1552	regsvr32.exe

pid	process
568	rundll32.exe
1552	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1444 wrote to memory of 568	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 568	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 568	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 568	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 568	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 568	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 568	1444	rundll32.exe	rundll32.exe
PID 568 wrote to memory of 872	568	rundll32.exe	explorer.exe
PID 568 wrote to memory of 872	568	rundll32.exe	explorer.exe
PID 568 wrote to memory of 872	568	rundll32.exe	explorer.exe
PID 568 wrote to memory of 872	568	rundll32.exe	explorer.exe
PID 568 wrote to memory of 872	568	rundll32.exe	explorer.exe
PID 568 wrote to memory of 872	568	rundll32.exe	explorer.exe
PID 872 wrote to memory of 1984	872	explorer.exe	schtasks.exe
PID 872 wrote to memory of 1984	872	explorer.exe	schtasks.exe
PID 872 wrote to memory of 1984	872	explorer.exe	schtasks.exe
PID 872 wrote to memory of 1984	872	explorer.exe	schtasks.exe
PID 1060 wrote to memory of 1752	1060	taskeng.exe	regsvr32.exe
PID 1060 wrote to memory of 1752	1060	taskeng.exe	regsvr32.exe
PID 1060 wrote to memory of 1752	1060	taskeng.exe	regsvr32.exe
PID 1060 wrote to memory of 1752	1060	taskeng.exe	regsvr32.exe
PID 1060 wrote to memory of 1752	1060	taskeng.exe	regsvr32.exe
PID 1752 wrote to memory of 1552	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1552	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1552	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1552	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1552	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1552	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1552	1752	regsvr32.exe	regsvr32.exe
PID 1552 wrote to memory of 108	1552	regsvr32.exe	explorer.exe
PID 1552 wrote to memory of 108	1552	regsvr32.exe	explorer.exe
PID 1552 wrote to memory of 108	1552	regsvr32.exe	explorer.exe
PID 1552 wrote to memory of 108	1552	regsvr32.exe	explorer.exe
PID 1552 wrote to memory of 108	1552	regsvr32.exe	explorer.exe
PID 1552 wrote to memory of 108	1552	regsvr32.exe	explorer.exe
PID 108 wrote to memory of 1892	108	explorer.exe	reg.exe
PID 108 wrote to memory of 1892	108	explorer.exe	reg.exe
PID 108 wrote to memory of 1892	108	explorer.exe	reg.exe
PID 108 wrote to memory of 1892	108	explorer.exe	reg.exe
PID 108 wrote to memory of 1268	108	explorer.exe	reg.exe
PID 108 wrote to memory of 1268	108	explorer.exe	reg.exe
PID 108 wrote to memory of 1268	108	explorer.exe	reg.exe
PID 108 wrote to memory of 1268	108	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d0548b0495518b448154aee4726aa5c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d0548b0495518b448154aee4726aa5c.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:872

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn axtwcjuan /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9d0548b0495518b448154aee4726aa5c.dll\"" /SC ONCE /Z /ST 19:18 /ET 19:30
4⤵
- Creates scheduled task(s)
PID:1984

C:\Windows\system32\taskeng.exe
taskeng.exe {B4131AFC-9D6C-465B-A98D-0E78724F1AD0} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9d0548b0495518b448154aee4726aa5c.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\9d0548b0495518b448154aee4726aa5c.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:108

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Lvcrlc" /d "0"
5⤵
PID:1892

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Liafdw" /d "0"
5⤵
PID:1268

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9d0548b0495518b448154aee4726aa5c.dll
MD5
9d0548b0495518b448154aee4726aa5c

SHA1
839cecb1e45d0dd5af4397754ee3564f0848eb1b

SHA256
9fd2f36653216c8e653de84e5f247e3c9c379fc98f2644fd20ccde41bba501bf

SHA512
9ca2401fb0b821969540c2e2e32d9625c2400d504bf23399a94c6335ca5c24bfa333610e9b70899e7236a040d301f0b95baeffe234925c5de5ca749c0a059019

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\9d0548b0495518b448154aee4726aa5c.dll
MD5
9d0548b0495518b448154aee4726aa5c

SHA1
839cecb1e45d0dd5af4397754ee3564f0848eb1b

SHA256
9fd2f36653216c8e653de84e5f247e3c9c379fc98f2644fd20ccde41bba501bf

SHA512
9ca2401fb0b821969540c2e2e32d9625c2400d504bf23399a94c6335ca5c24bfa333610e9b70899e7236a040d301f0b95baeffe234925c5de5ca749c0a059019

Download Submit
memory/108-83-0x0000000000110000-0x0000000000131000-memory.dmp

Filesize
132KB

Download
memory/108-77-0x0000000000000000-mapping.dmp

Download
memory/568-58-0x00000000746C0000-0x00000000747B3000-memory.dmp

Filesize
972KB

Download
memory/568-59-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/568-54-0x0000000000000000-mapping.dmp

Download
memory/568-57-0x00000000746C0000-0x00000000746E1000-memory.dmp

Filesize
132KB

Download
memory/568-56-0x00000000746C0000-0x00000000747B3000-memory.dmp

Filesize
972KB

Download
memory/568-55-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download
memory/872-60-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/872-61-0x0000000000000000-mapping.dmp

Download
memory/872-63-0x00000000742E1000-0x00000000742E3000-memory.dmp

Filesize
8KB

Download
memory/872-64-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1268-82-0x0000000000000000-mapping.dmp

Download
memory/1552-74-0x0000000074520000-0x0000000074613000-memory.dmp

Filesize
972KB

Download
memory/1552-73-0x0000000074520000-0x0000000074541000-memory.dmp

Filesize
132KB

Download
memory/1552-72-0x0000000074520000-0x0000000074613000-memory.dmp

Filesize
972KB

Download
memory/1552-75-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1552-69-0x0000000000000000-mapping.dmp

Download
memory/1752-67-0x000007FEFB951000-0x000007FEFB953000-memory.dmp

Filesize
8KB

Download
memory/1752-66-0x0000000000000000-mapping.dmp

Download
memory/1892-81-0x0000000000000000-mapping.dmp

Download
memory/1984-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads