qakbot | 4fe4c604339c619c4ccac70698a13b833351713ef03e72ed89e542964327346f

General

Target

1.dll
Size

742KB
MD5

a2cd7a6da2ad08288c215beb8e904147
SHA1

b78c5c3f4867eb0b390a5386483f8d9e3d2da182
SHA256

4fe4c604339c619c4ccac70698a13b833351713ef03e72ed89e542964327346f
SHA512

96e97cc450fc34983e08836e7139f4393b04bf0db21a8e7d9999fbba6fa9cd3be49a59f5587886d377229aef9d1bffb078b497e7a99ab0dacd43c41d038b9073

Score

10^/10

qakbot tr 1634541613 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1896 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1680 schtasks.exe

pid	process
1896	regsvr32.exe

pid	process
1680	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ysfllafec\e707ae14 = 23a29ebda50d5e160a1b8548358e05d6866a697cc6eabe03cb081034538cd92dbaf144cd2f1a06051801c1fd94c1bd427ae64257e113f341aa53f1711ac79a15e4de40fb460a9cd7735683c4193375ed7b6e6d362d81b2c39b94c0f05f4573d7dfa53344a2c0d4b3d415ec37d74d5c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ysfllafec\22b386fb = 7e65269a99128d3e7708a51dbeba94fca58cf6530e74d0ea51c76c426a6bd1c982fc6b661f3628d2c62c1281c14e5d0fe6752ac4f5dd18d5e4a3e7cc6c30838a9c112461	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ysfllafec	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ysfllafec\d0d95e26 = 3bc79fc69e076c393c494ba1739e25dfc19c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ysfllafec\9a0fe19e = 75f2902431ebb8f8cfe0f3a184b5cbbfd2f5f81d35345fe0185928dbdc4253ea3060d4b7c2c08918070e16c8d0255f4942de6e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ysfllafec\5dfae90d = 92580d3affb980d5d755ffe7e71330909912285b802858676159a0a1ac7af1fd71e128a7a8323a7b2cdde3da8b5c599abf75c58e58cedcfa6ddc89b552c1b14ad7685e592f6f0d90	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ysfllafec\af9031d0 = 005f5fc94836742f45f0d01ee9964199ec6c638ca2b9ab2086bbd7a2790c0321b05a57395012fd2de7d2995ed52626f1545ebca75ff153cf2e7f28f9701fe68dc4f19222e4fe084f36d289b4c81675ef3eceedd100195d23f60dae46f125211c12f9027b8d6a4e6a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ysfllafec\d0d95e26 = 3bc788c69e0759f5c09535ada40d8c4533840dc211c82c814e72d5a8452327f6868829b1e12f5b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ysfllafec\e5468e68 = 2b36cf1a58b19d1c1933d1108dcf36f6604044d7fc1671f2bcf5118deefdc7e23e7af287e8e5233d218ff8a88509457b8d785351b66df2ecbd538771c77a4b936fbdd4c3e4677a8bb3a28c2bb9c05177295d853690ab2da5a7542b2e937d86c1a64f73bab0256b8ecfe452e7936bdf77cac52ef9ea277bd0b818ee2023fbde69240b874cba33dca86f2446ba	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ysfllafec\5fbbc971 = 679a7d73f23f7dbf86f15920e727895151691ddae5e10c9e2e71f2b1d912eb91	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1372 rundll32.exe
1896 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1372 rundll32.exe
1896 regsvr32.exe

pid	process
1372	rundll32.exe
1896	regsvr32.exe

pid	process
1372	rundll32.exe
1896	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 740 wrote to memory of 1372	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1372	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1372	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1372	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1372	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1372	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1372	740	rundll32.exe	rundll32.exe
PID 1372 wrote to memory of 568	1372	rundll32.exe	explorer.exe
PID 1372 wrote to memory of 568	1372	rundll32.exe	explorer.exe
PID 1372 wrote to memory of 568	1372	rundll32.exe	explorer.exe
PID 1372 wrote to memory of 568	1372	rundll32.exe	explorer.exe
PID 1372 wrote to memory of 568	1372	rundll32.exe	explorer.exe
PID 1372 wrote to memory of 568	1372	rundll32.exe	explorer.exe
PID 568 wrote to memory of 1680	568	explorer.exe	schtasks.exe
PID 568 wrote to memory of 1680	568	explorer.exe	schtasks.exe
PID 568 wrote to memory of 1680	568	explorer.exe	schtasks.exe
PID 568 wrote to memory of 1680	568	explorer.exe	schtasks.exe
PID 1628 wrote to memory of 1452	1628	taskeng.exe	regsvr32.exe
PID 1628 wrote to memory of 1452	1628	taskeng.exe	regsvr32.exe
PID 1628 wrote to memory of 1452	1628	taskeng.exe	regsvr32.exe
PID 1628 wrote to memory of 1452	1628	taskeng.exe	regsvr32.exe
PID 1628 wrote to memory of 1452	1628	taskeng.exe	regsvr32.exe
PID 1452 wrote to memory of 1896	1452	regsvr32.exe	regsvr32.exe
PID 1452 wrote to memory of 1896	1452	regsvr32.exe	regsvr32.exe
PID 1452 wrote to memory of 1896	1452	regsvr32.exe	regsvr32.exe
PID 1452 wrote to memory of 1896	1452	regsvr32.exe	regsvr32.exe
PID 1452 wrote to memory of 1896	1452	regsvr32.exe	regsvr32.exe
PID 1452 wrote to memory of 1896	1452	regsvr32.exe	regsvr32.exe
PID 1452 wrote to memory of 1896	1452	regsvr32.exe	regsvr32.exe
PID 1896 wrote to memory of 1180	1896	regsvr32.exe	explorer.exe
PID 1896 wrote to memory of 1180	1896	regsvr32.exe	explorer.exe
PID 1896 wrote to memory of 1180	1896	regsvr32.exe	explorer.exe
PID 1896 wrote to memory of 1180	1896	regsvr32.exe	explorer.exe
PID 1896 wrote to memory of 1180	1896	regsvr32.exe	explorer.exe
PID 1896 wrote to memory of 1180	1896	regsvr32.exe	explorer.exe
PID 1180 wrote to memory of 1892	1180	explorer.exe	reg.exe
PID 1180 wrote to memory of 1892	1180	explorer.exe	reg.exe
PID 1180 wrote to memory of 1892	1180	explorer.exe	reg.exe
PID 1180 wrote to memory of 1892	1180	explorer.exe	reg.exe
PID 1180 wrote to memory of 2012	1180	explorer.exe	reg.exe
PID 1180 wrote to memory of 2012	1180	explorer.exe	reg.exe
PID 1180 wrote to memory of 2012	1180	explorer.exe	reg.exe
PID 1180 wrote to memory of 2012	1180	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn axdaaxxemy /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\1.dll\"" /SC ONCE /Z /ST 07:11 /ET 07:23
4⤵
- Creates scheduled task(s)
PID:1680

C:\Windows\system32\taskeng.exe
taskeng.exe {AB9EA0BB-FE33-4B08-81D4-E0584A70F069} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\1.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\1.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Myepxzz" /d "0"
5⤵
PID:1892

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ttyoqofrnduh" /d "0"
5⤵
PID:2012

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.dll
MD5
a2cd7a6da2ad08288c215beb8e904147

SHA1
b78c5c3f4867eb0b390a5386483f8d9e3d2da182

SHA256
4fe4c604339c619c4ccac70698a13b833351713ef03e72ed89e542964327346f

SHA512
96e97cc450fc34983e08836e7139f4393b04bf0db21a8e7d9999fbba6fa9cd3be49a59f5587886d377229aef9d1bffb078b497e7a99ab0dacd43c41d038b9073

Download Submit
\Users\Admin\AppData\Local\Temp\1.dll
MD5
a2cd7a6da2ad08288c215beb8e904147

SHA1
b78c5c3f4867eb0b390a5386483f8d9e3d2da182

SHA256
4fe4c604339c619c4ccac70698a13b833351713ef03e72ed89e542964327346f

SHA512
96e97cc450fc34983e08836e7139f4393b04bf0db21a8e7d9999fbba6fa9cd3be49a59f5587886d377229aef9d1bffb078b497e7a99ab0dacd43c41d038b9073

Download Submit
memory/568-64-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/568-60-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/568-61-0x0000000000000000-mapping.dmp

Download
memory/568-63-0x00000000749D1000-0x00000000749D3000-memory.dmp

Filesize
8KB

Download
memory/1180-82-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1180-77-0x0000000000000000-mapping.dmp

Download
memory/1372-57-0x0000000074E10000-0x0000000074E31000-memory.dmp

Filesize
132KB

Download
memory/1372-58-0x0000000074E10000-0x0000000074EE5000-memory.dmp

Filesize
852KB

Download
memory/1372-59-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/1372-56-0x0000000074E10000-0x0000000074EE5000-memory.dmp

Filesize
852KB

Download
memory/1372-54-0x0000000000000000-mapping.dmp

Download
memory/1372-55-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/1452-67-0x000007FEFBFC1000-0x000007FEFBFC3000-memory.dmp

Filesize
8KB

Download
memory/1452-66-0x0000000000000000-mapping.dmp

Download
memory/1680-65-0x0000000000000000-mapping.dmp

Download
memory/1892-80-0x0000000000000000-mapping.dmp

Download
memory/1896-69-0x0000000000000000-mapping.dmp

Download
memory/1896-72-0x0000000074C70000-0x0000000074D45000-memory.dmp

Filesize
852KB

Download
memory/1896-73-0x0000000074C70000-0x0000000074C91000-memory.dmp

Filesize
132KB

Download
memory/1896-74-0x0000000074C70000-0x0000000074D45000-memory.dmp

Filesize
852KB

Download
memory/1896-75-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2012-81-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads