qakbot | b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529

General

Target

b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll
Size

1.6MB
MD5

4f7a4448b2e7d0618b86ee1eb62469e9
SHA1

c5854232e23a72caa5a719dfb1badb58a98cac3a
SHA256

b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529
SHA512

40ca8de592e8cb4ff50e3fd5a82dc1a6695cc137efee27883e20f560dd47ed0b59c2fdb7a5c6fe71f94088abce3c69760b17bba9f480aa3b5fac44bdba6d49fc

Score

10^/10

qakbot tr 1634541613 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1308 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1152 schtasks.exe

pid	process
1308	regsvr32.exe

pid	process
1152	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lpdfplsimoylat\ecc2520a = a8d63899e086040c2f3cf93b021139c24f46c7b800db19d8e836011186dbfa725b19ee79601416c8a5d93b5a3c93576903640af2f9b667335b37723ed323f097ee7ab683a0d2bd52f64ed23f98c20c5b4a9e61fd6a052d73c95f3ec03d82603c43677b09cf30bdf59c59	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lpdfplsimoylat\d95d8244 = 1c27a53827f9a7b602cdcab1ac9cde09b4c789287fb04a3c83629610a4b65408671ea251c77b5751737aab1927c762d3002e6337e2f6a32213999f30573f2c1ebdb808b3abea3247040a8479a03c9869854be8e67baaa70fc582e1c63b634e1f06ba5c8362d8417c9c36f7d78d282775321b9183cbeb2ec272dd26	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lpdfplsimoylat\61e1e521 = d14c61d8cbd3ea7f6bbf30bc449c20694d3197b2cb5600aa8707ce22dcc423b01f3301ccb78bb3ab77163410447a1490d0942449365388320595e610d05533597fa256a3c211de3feecdbe28b47321c08f282628c0f30437c1b7f8ed996eb884e67b14eff82cb434542f843b90	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lpdfplsimoylat\938b3dfc = 61faa450b770d883b195f9d2ac4b4ba65175768af5f1dd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lpdfplsimoylat\ecc2520a = a8d62f99e08631271670f88ac69b765ae0758024e038312c8941db0ee98438728c54392b084fb652199366827af2c3aa0985ed60a3fa26a068eab45356fa3b9ba31f9c2dce2038ea29a94438c260b5d51d46e0d664316df0c1f672c3a52d8e2d3d7154fc4b00e6a27f26a55caa82eaca85ca4129c7926b0a60ab0ba78cec24	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lpdfplsimoylat	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lpdfplsimoylat\db1ca238 = b4a690b99beb611cd6bff8b1bd5e4688ee4b9c3d522f527603d1b214d9b60d09d5fb44	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lpdfplsimoylat\63a0c55d = 7b97636d0eaf8d8a2e253fb2169de316b7d2349c26d7ccdb9604d6c17afe1c399e20279e92406f4e67a722fd52	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lpdfplsimoylat\1ea88ad7 = 11d631cd6dc18c7616bceb0426a67551bf10e0b31a204012e012942b6f7d5df846613dc0a91777506e3fdc2a3d72e34159e3608d3e7aa0f88c61098344104a8ca26f85a1994997269b4f2155b475ca18	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lpdfplsimoylat\a614edb2 = 9e76f5e82eb50701191c7fc078578459dc80b08d8abd697ec17316667726fb17866216ff123e4f16eb42d2c7942e35bbc6e6	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1228 rundll32.exe
1308 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1228 rundll32.exe
1308 regsvr32.exe

pid	process
1228	rundll32.exe
1308	regsvr32.exe

pid	process
1228	rundll32.exe
1308	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 524 wrote to memory of 1228	524	rundll32.exe	rundll32.exe
PID 524 wrote to memory of 1228	524	rundll32.exe	rundll32.exe
PID 524 wrote to memory of 1228	524	rundll32.exe	rundll32.exe
PID 524 wrote to memory of 1228	524	rundll32.exe	rundll32.exe
PID 524 wrote to memory of 1228	524	rundll32.exe	rundll32.exe
PID 524 wrote to memory of 1228	524	rundll32.exe	rundll32.exe
PID 524 wrote to memory of 1228	524	rundll32.exe	rundll32.exe
PID 1228 wrote to memory of 676	1228	rundll32.exe	explorer.exe
PID 1228 wrote to memory of 676	1228	rundll32.exe	explorer.exe
PID 1228 wrote to memory of 676	1228	rundll32.exe	explorer.exe
PID 1228 wrote to memory of 676	1228	rundll32.exe	explorer.exe
PID 1228 wrote to memory of 676	1228	rundll32.exe	explorer.exe
PID 1228 wrote to memory of 676	1228	rundll32.exe	explorer.exe
PID 676 wrote to memory of 1152	676	explorer.exe	schtasks.exe
PID 676 wrote to memory of 1152	676	explorer.exe	schtasks.exe
PID 676 wrote to memory of 1152	676	explorer.exe	schtasks.exe
PID 676 wrote to memory of 1152	676	explorer.exe	schtasks.exe
PID 1728 wrote to memory of 1280	1728	taskeng.exe	regsvr32.exe
PID 1728 wrote to memory of 1280	1728	taskeng.exe	regsvr32.exe
PID 1728 wrote to memory of 1280	1728	taskeng.exe	regsvr32.exe
PID 1728 wrote to memory of 1280	1728	taskeng.exe	regsvr32.exe
PID 1728 wrote to memory of 1280	1728	taskeng.exe	regsvr32.exe
PID 1280 wrote to memory of 1308	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1308	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1308	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1308	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1308	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1308	1280	regsvr32.exe	regsvr32.exe
PID 1280 wrote to memory of 1308	1280	regsvr32.exe	regsvr32.exe
PID 1308 wrote to memory of 1844	1308	regsvr32.exe	explorer.exe
PID 1308 wrote to memory of 1844	1308	regsvr32.exe	explorer.exe
PID 1308 wrote to memory of 1844	1308	regsvr32.exe	explorer.exe
PID 1308 wrote to memory of 1844	1308	regsvr32.exe	explorer.exe
PID 1308 wrote to memory of 1844	1308	regsvr32.exe	explorer.exe
PID 1308 wrote to memory of 1844	1308	regsvr32.exe	explorer.exe
PID 1844 wrote to memory of 1552	1844	explorer.exe	reg.exe
PID 1844 wrote to memory of 1552	1844	explorer.exe	reg.exe
PID 1844 wrote to memory of 1552	1844	explorer.exe	reg.exe
PID 1844 wrote to memory of 1552	1844	explorer.exe	reg.exe
PID 1844 wrote to memory of 1768	1844	explorer.exe	reg.exe
PID 1844 wrote to memory of 1768	1844	explorer.exe	reg.exe
PID 1844 wrote to memory of 1768	1844	explorer.exe	reg.exe
PID 1844 wrote to memory of 1768	1844	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:676

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn prsugmd /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll\"" /SC ONCE /Z /ST 15:59 /ET 16:11
4⤵
- Creates scheduled task(s)
PID:1152

C:\Windows\system32\taskeng.exe
taskeng.exe {165B0764-79EF-48A8-BE43-DD14E5820219} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Yiaylogst" /d "0"
5⤵
PID:1552

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Kxdqlocvhto" /d "0"
5⤵
PID:1768

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll
MD5
4f7a4448b2e7d0618b86ee1eb62469e9

SHA1
c5854232e23a72caa5a719dfb1badb58a98cac3a

SHA256
b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529

SHA512
40ca8de592e8cb4ff50e3fd5a82dc1a6695cc137efee27883e20f560dd47ed0b59c2fdb7a5c6fe71f94088abce3c69760b17bba9f480aa3b5fac44bdba6d49fc

Download Submit
\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll
MD5
4f7a4448b2e7d0618b86ee1eb62469e9

SHA1
c5854232e23a72caa5a719dfb1badb58a98cac3a

SHA256
b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529

SHA512
40ca8de592e8cb4ff50e3fd5a82dc1a6695cc137efee27883e20f560dd47ed0b59c2fdb7a5c6fe71f94088abce3c69760b17bba9f480aa3b5fac44bdba6d49fc

Download Submit
memory/676-64-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/676-60-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/676-61-0x0000000000000000-mapping.dmp

Download
memory/676-63-0x00000000744E1000-0x00000000744E3000-memory.dmp

Filesize
8KB

Download
memory/1152-65-0x0000000000000000-mapping.dmp

Download
memory/1228-58-0x0000000074650000-0x00000000747FB000-memory.dmp

Filesize
1.7MB

Download
memory/1228-57-0x0000000074650000-0x0000000074671000-memory.dmp

Filesize
132KB

Download
memory/1228-59-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1228-56-0x0000000074650000-0x00000000747FB000-memory.dmp

Filesize
1.7MB

Download
memory/1228-55-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/1228-54-0x0000000000000000-mapping.dmp

Download
memory/1280-67-0x000007FEFBB51000-0x000007FEFBB53000-memory.dmp

Filesize
8KB

Download
memory/1280-66-0x0000000000000000-mapping.dmp

Download
memory/1308-69-0x0000000000000000-mapping.dmp

Download
memory/1308-72-0x0000000073DA0000-0x0000000073F4B000-memory.dmp

Filesize
1.7MB

Download
memory/1308-73-0x0000000073DA0000-0x0000000073DC1000-memory.dmp

Filesize
132KB

Download
memory/1308-74-0x0000000073DA0000-0x0000000073F4B000-memory.dmp

Filesize
1.7MB

Download
memory/1308-75-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/1552-80-0x0000000000000000-mapping.dmp

Download
memory/1768-82-0x0000000000000000-mapping.dmp

Download
memory/1844-77-0x0000000000000000-mapping.dmp

Download
memory/1844-81-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads