qakbot | 33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80

General

Target

33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80.dll
Size

741KB
MD5

f717e2f6f48ae6ee4875ef740cd4067e
SHA1

cef662e43bded5848e499b5f3b506bb3829948ff
SHA256

33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80
SHA512

387c67166b12bb0dfa49234ffa29dda1ad08d1aefe6d67ea6cfddc184f841ed2523d8994209262af92680d7357bb1d5eca787174556184549c70efa765767990

Score

10^/10

qakbot tr 1634541613 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1316 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3584 schtasks.exe

pid	process
1316	regsvr32.exe

pid	process
3584	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owdarafz\27d0c141 = 78438e8537553632048f3e84265ebfd134e913321ad63532a5fd5888bce0da3aebd01f14009131e0b27462da3b75d49b6cd06b502bb4f91f01e6bf1b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owdarafz\124f110f = 9f72e44b82e7274c9450b779ecf506e12b3f3eeabaf684f22b2d299c1ec77f2b7b42069730a8db8f671a9312596c746622fc0dd87f92b7c1d90ee440baf69d344e51701de39c241edd7f94ced48a6d4ea315152da0d74db9f66de3a812ed20f0c9718dca1217cb64cc7614b525d5a5471288645de005c09be8e81b3018c3899766ecda20ac9e3455a34c31d8c86401dc4a225d937b336a164769c4b417441183	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owdarafz\aaf3766a = 7fcb8b4d655a58981365549905a5a545acab1f2c29d699bc6a3b80b6c409d590fa2b842cfad371d0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owdarafz\5899aeb7 = 16ee6e9c20dea4d344e0c5125b6c78186518f10ba430ed80a9d83b448f0ee62527d38b8bb373f237f9aa0c917f75f2ef	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owdarafz\6d067ef9 = c4959b6bb82827d4479d3234ff00d704224341442ef4df269a51a59fb3793bf9cf17f37950ff2a318adf125833391d35cf6b731ef4321921f34d70b06dfef43ca5ee53da880bf06cab45aef214c943a3f18419b6d92423feeeba99c618b839c1b0582d7e41d2934de9a54ba1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owdarafz\27d0c141 = 78439985375503b3637a12904cffae7f74b89fcbf42ba24c1537a8588585021c71d1945103894f26087ba95bd46da29bb3fd2617b3250905dcef7047e1e440172db18b2b888f67ae8eb3ac103a842ff080	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owdarafz	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owdarafz\100e3173 = cc417fa1c77fd90d2f92e28789c0debdd30ab4855413ecc72a70529769ba2efa749bdf008e1cad03d9f2714d0e33897eb51f52fc4c9d38fd42c0aadddab6cf17774eff6a3c29a248135879f4d38bf05f3d4623c11e4684f30e74495fc7a09f9164f1dd2bbba6e4fda15983703ddf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owdarafz\a8b25616 = 1b2fc1ecac2610f57b91b65e3ede5f1831e9c98b14ae7ad8ed6772d8e768dc6d87826c8eaae1f0ce034335f3310a2706d1b8e85003add716d11b3f4be253f46380	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owdarafz\d5ba199c = 3a7f4df8124e67ecf7c8c8be66c9dc1f7129194e430320fe70a394529d8dd01e58d0b50ed0b27c8d25df23fa5b3b37a94efff1c52ccb380f6e862530140173566dcc956fe5480e	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2704 rundll32.exe
2704 rundll32.exe
1316 regsvr32.exe
1316 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2704 rundll32.exe
1316 regsvr32.exe

pid	process
2704	rundll32.exe
2704	rundll32.exe
1316	regsvr32.exe
1316	regsvr32.exe

pid	process
2704	rundll32.exe
1316	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2676 wrote to memory of 2704	2676	rundll32.exe	rundll32.exe
PID 2676 wrote to memory of 2704	2676	rundll32.exe	rundll32.exe
PID 2676 wrote to memory of 2704	2676	rundll32.exe	rundll32.exe
PID 2704 wrote to memory of 3608	2704	rundll32.exe	explorer.exe
PID 2704 wrote to memory of 3608	2704	rundll32.exe	explorer.exe
PID 2704 wrote to memory of 3608	2704	rundll32.exe	explorer.exe
PID 2704 wrote to memory of 3608	2704	rundll32.exe	explorer.exe
PID 2704 wrote to memory of 3608	2704	rundll32.exe	explorer.exe
PID 3608 wrote to memory of 3584	3608	explorer.exe	schtasks.exe
PID 3608 wrote to memory of 3584	3608	explorer.exe	schtasks.exe
PID 3608 wrote to memory of 3584	3608	explorer.exe	schtasks.exe
PID 3516 wrote to memory of 1316	3516	regsvr32.exe	regsvr32.exe
PID 3516 wrote to memory of 1316	3516	regsvr32.exe	regsvr32.exe
PID 3516 wrote to memory of 1316	3516	regsvr32.exe	regsvr32.exe
PID 1316 wrote to memory of 1156	1316	regsvr32.exe	explorer.exe
PID 1316 wrote to memory of 1156	1316	regsvr32.exe	explorer.exe
PID 1316 wrote to memory of 1156	1316	regsvr32.exe	explorer.exe
PID 1316 wrote to memory of 1156	1316	regsvr32.exe	explorer.exe
PID 1316 wrote to memory of 1156	1316	regsvr32.exe	explorer.exe
PID 1156 wrote to memory of 2340	1156	explorer.exe	reg.exe
PID 1156 wrote to memory of 2340	1156	explorer.exe	reg.exe
PID 1156 wrote to memory of 1208	1156	explorer.exe	reg.exe
PID 1156 wrote to memory of 1208	1156	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2676

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2704

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3608

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kumsdidp /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80.dll\"" /SC ONCE /Z /ST 15:48 /ET 16:00
4⤵
- Creates scheduled task(s)
PID:3584

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3516

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Nemsaqwti" /d "0"
4⤵
PID:2340

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Uwhwaalo" /d "0"
4⤵
PID:1208

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80.dll
MD5
f717e2f6f48ae6ee4875ef740cd4067e

SHA1
cef662e43bded5848e499b5f3b506bb3829948ff

SHA256
33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80

SHA512
387c67166b12bb0dfa49234ffa29dda1ad08d1aefe6d67ea6cfddc184f841ed2523d8994209262af92680d7357bb1d5eca787174556184549c70efa765767990

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80.dll
MD5
f717e2f6f48ae6ee4875ef740cd4067e

SHA1
cef662e43bded5848e499b5f3b506bb3829948ff

SHA256
33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80

SHA512
387c67166b12bb0dfa49234ffa29dda1ad08d1aefe6d67ea6cfddc184f841ed2523d8994209262af92680d7357bb1d5eca787174556184549c70efa765767990

Download Submit
memory/1156-137-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/1156-136-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/1156-132-0x0000000000000000-mapping.dmp

Download
memory/1156-138-0x0000000000910000-0x0000000000931000-memory.dmp

Filesize
132KB

Download
memory/1208-135-0x0000000000000000-mapping.dmp

Download
memory/1316-130-0x0000000072890000-0x0000000072965000-memory.dmp

Filesize
852KB

Download
memory/1316-128-0x0000000072890000-0x0000000072965000-memory.dmp

Filesize
852KB

Download
memory/1316-129-0x0000000072890000-0x00000000728B1000-memory.dmp

Filesize
132KB

Download
memory/1316-126-0x0000000000000000-mapping.dmp

Download
memory/1316-131-0x0000000003340000-0x0000000003341000-memory.dmp

Filesize
4KB

Download
memory/2340-134-0x0000000000000000-mapping.dmp

Download
memory/2704-116-0x0000000073B90000-0x0000000073C65000-memory.dmp

Filesize
852KB

Download
memory/2704-117-0x0000000073B90000-0x0000000073BB1000-memory.dmp

Filesize
132KB

Download
memory/2704-119-0x0000000002D60000-0x0000000002D61000-memory.dmp

Filesize
4KB

Download
memory/2704-118-0x0000000073B90000-0x0000000073C65000-memory.dmp

Filesize
852KB

Download
memory/2704-115-0x0000000000000000-mapping.dmp

Download
memory/3584-122-0x0000000000000000-mapping.dmp

Download
memory/3608-124-0x0000000003760000-0x0000000003761000-memory.dmp

Filesize
4KB

Download
memory/3608-123-0x0000000003760000-0x0000000003761000-memory.dmp

Filesize
4KB

Download
memory/3608-121-0x0000000003470000-0x0000000003491000-memory.dmp

Filesize
132KB

Download
memory/3608-120-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads