qakbot | 4fe4c604339c619c4ccac70698a13b833351713ef03e72ed89e542964327346f

General

Target

1.dll
Size

742KB
MD5

a2cd7a6da2ad08288c215beb8e904147
SHA1

b78c5c3f4867eb0b390a5386483f8d9e3d2da182
SHA256

4fe4c604339c619c4ccac70698a13b833351713ef03e72ed89e542964327346f
SHA512

96e97cc450fc34983e08836e7139f4393b04bf0db21a8e7d9999fbba6fa9cd3be49a59f5587886d377229aef9d1bffb078b497e7a99ab0dacd43c41d038b9073

Score

10^/10

qakbot tr 1634541613 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

404 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4644 schtasks.exe

pid	process
404	regsvr32.exe

pid	process
4644	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dnbtiooxdcula\20061a1b = 0f318d9a7308c6bf62088cd0edb2d731f63214a3d37d35965663217aca19a7b25071738448c6e76b7e8e1cb4a1687d2ea51e312f363be316a9e4c1526c79949506a7fe6620fdb3d8d5c8fa98f3be5839503879f00b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dnbtiooxdcula\5d0e5591 = 9b5ff7c8824a12655089b3935513104d9384dbbfca91985ebd04c1d3995990cdfbf16e11ada17551aabb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dnbtiooxdcula\d02de2ba = 70e4b5513a9e2704b74542617ad10278aec196fdbfbaa2125fa2c77ed6e81c2a6d67b807a2d814e324fd4272b16784f380721c9d72d8fc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dnbtiooxdcula\af648d4c = 4084d9e8850643c473fde01685c5979ddf762a1388b205f5f862c3da9e79db8f1d461f10	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dnbtiooxdcula\9afb5d02 = cf78c4da2864b9f4d5176c69d419ffe795ce285c54b675aec0ffe6aad8376bbd670f6a54c96e25a84c42e947293820f4c16b1099162e58af12b9ba7f9e253ddcd88dd0334c9d5a7f30c8a8851b15996f242a0ac7d7e76d79d3ad2c9346eef20bd011c18f358318676a435437ed26e55c6d81b28db062a82d511893a6cd6f93e4a889cc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dnbtiooxdcula\e5b232f4 = f9cf66c0ed95fb16b5a4540cfefd7ae5486a43bd3f4a10058af24b5212cd443d237490f215d9ab9c00ffafa7334d0253bf619c0f952282c22413b32cbe2d06ea49b0b25a80753a0ed361039d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dnbtiooxdcula\22473a67 = 7520350d858bb6e5391d7693ce6517a7113f4e34b7ac93cd6ad75c8d653a55cf7b2af51d94be99a2e08617769721b6c14c8763475335cfc32a451dad2e3b3e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dnbtiooxdcula\af648d4c = 4084cee8850676e5ad3bb506e0d3ef272da2247992eb267d70b0c558201b7aac1dec53911986bae0830bb4bf465c5f65e26d06d72a0932a193	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dnbtiooxdcula	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dnbtiooxdcula\98ba7d7e = 19a5750f6838e4d1d5415802944590929cf589abb048a6da49f7513ee34c7b3d1f8fc1e1ec3b4e176d895a24d9366cbc54da94b19c18fc7e1490ab1eccac4b56ae0cf810bf63f7a250d8a13928f14ff52f5eb419b2805db63c58c82c833335e6265dae251ad758	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

4372 rundll32.exe
4372 rundll32.exe
404 regsvr32.exe
404 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

4372 rundll32.exe
404 regsvr32.exe

pid	process
4372	rundll32.exe
4372	rundll32.exe
404	regsvr32.exe
404	regsvr32.exe

pid	process
4372	rundll32.exe
404	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 4352 wrote to memory of 4372	4352	rundll32.exe	rundll32.exe
PID 4352 wrote to memory of 4372	4352	rundll32.exe	rundll32.exe
PID 4352 wrote to memory of 4372	4352	rundll32.exe	rundll32.exe
PID 4372 wrote to memory of 4580	4372	rundll32.exe	explorer.exe
PID 4372 wrote to memory of 4580	4372	rundll32.exe	explorer.exe
PID 4372 wrote to memory of 4580	4372	rundll32.exe	explorer.exe
PID 4372 wrote to memory of 4580	4372	rundll32.exe	explorer.exe
PID 4372 wrote to memory of 4580	4372	rundll32.exe	explorer.exe
PID 4580 wrote to memory of 4644	4580	explorer.exe	schtasks.exe
PID 4580 wrote to memory of 4644	4580	explorer.exe	schtasks.exe
PID 4580 wrote to memory of 4644	4580	explorer.exe	schtasks.exe
PID 1012 wrote to memory of 404	1012	regsvr32.exe	regsvr32.exe
PID 1012 wrote to memory of 404	1012	regsvr32.exe	regsvr32.exe
PID 1012 wrote to memory of 404	1012	regsvr32.exe	regsvr32.exe
PID 404 wrote to memory of 1200	404	regsvr32.exe	explorer.exe
PID 404 wrote to memory of 1200	404	regsvr32.exe	explorer.exe
PID 404 wrote to memory of 1200	404	regsvr32.exe	explorer.exe
PID 404 wrote to memory of 1200	404	regsvr32.exe	explorer.exe
PID 404 wrote to memory of 1200	404	regsvr32.exe	explorer.exe
PID 1200 wrote to memory of 1420	1200	explorer.exe	reg.exe
PID 1200 wrote to memory of 1420	1200	explorer.exe	reg.exe
PID 1200 wrote to memory of 1604	1200	explorer.exe	reg.exe
PID 1200 wrote to memory of 1604	1200	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4352

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4372

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4580

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn tmlylkqkrg /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\1.dll\"" /SC ONCE /Z /ST 23:33 /ET 23:45
4⤵
- Creates scheduled task(s)
PID:4644

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\1.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1012

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\1.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:404

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Sppowzkxxafs" /d "0"
4⤵
PID:1420

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Fujtnjhigg" /d "0"
4⤵
PID:1604

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.dll
MD5
a2cd7a6da2ad08288c215beb8e904147

SHA1
b78c5c3f4867eb0b390a5386483f8d9e3d2da182

SHA256
4fe4c604339c619c4ccac70698a13b833351713ef03e72ed89e542964327346f

SHA512
96e97cc450fc34983e08836e7139f4393b04bf0db21a8e7d9999fbba6fa9cd3be49a59f5587886d377229aef9d1bffb078b497e7a99ab0dacd43c41d038b9073

Download Submit
\Users\Admin\AppData\Local\Temp\1.dll
MD5
a2cd7a6da2ad08288c215beb8e904147

SHA1
b78c5c3f4867eb0b390a5386483f8d9e3d2da182

SHA256
4fe4c604339c619c4ccac70698a13b833351713ef03e72ed89e542964327346f

SHA512
96e97cc450fc34983e08836e7139f4393b04bf0db21a8e7d9999fbba6fa9cd3be49a59f5587886d377229aef9d1bffb078b497e7a99ab0dacd43c41d038b9073

Download Submit
memory/404-130-0x0000000072540000-0x0000000072615000-memory.dmp

Filesize
852KB

Download
memory/404-126-0x0000000000000000-mapping.dmp

Download
memory/404-131-0x0000000000430000-0x00000000004DE000-memory.dmp

Filesize
696KB

Download
memory/404-129-0x0000000072540000-0x0000000072561000-memory.dmp

Filesize
132KB

Download
memory/404-128-0x0000000072540000-0x0000000072615000-memory.dmp

Filesize
852KB

Download
memory/1200-133-0x0000000003070000-0x0000000003091000-memory.dmp

Filesize
132KB

Download
memory/1200-137-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/1200-136-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/1200-132-0x0000000000000000-mapping.dmp

Download
memory/1420-134-0x0000000000000000-mapping.dmp

Download
memory/1604-135-0x0000000000000000-mapping.dmp

Download
memory/4372-118-0x0000000073840000-0x0000000073915000-memory.dmp

Filesize
852KB

Download
memory/4372-117-0x0000000073840000-0x0000000073861000-memory.dmp

Filesize
132KB

Download
memory/4372-116-0x0000000073840000-0x0000000073915000-memory.dmp

Filesize
852KB

Download
memory/4372-115-0x0000000000000000-mapping.dmp

Download
memory/4372-119-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Filesize
4KB

Download
memory/4580-120-0x0000000000000000-mapping.dmp

Download
memory/4580-123-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/4580-122-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/4580-124-0x0000000000210000-0x0000000000231000-memory.dmp

Filesize
132KB

Download
memory/4644-121-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads