qakbot | b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529

General

Target

b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll
Size

1.6MB
MD5

4f7a4448b2e7d0618b86ee1eb62469e9
SHA1

c5854232e23a72caa5a719dfb1badb58a98cac3a
SHA256

b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529
SHA512

40ca8de592e8cb4ff50e3fd5a82dc1a6695cc137efee27883e20f560dd47ed0b59c2fdb7a5c6fe71f94088abce3c69760b17bba9f480aa3b5fac44bdba6d49fc

Score

10^/10

qakbot tr 1634541613 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1384 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1908 schtasks.exe

pid	process
1384	regsvr32.exe

pid	process
1908	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pfcrmruqsymg\f35ccedb = e41c872d366bcd6a5bc52013dab9bdc27c27943144bae9d18f9826d11ad6ec0dacff39049eb222090810f71aad7a96b803e6d6eeb419227aa47526b6e269ac991ddcd17be00e25acf5ee8de9ce18d6c2516a35351b9c1ed7f23a36484de4476a670998	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pfcrmruqsymg	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pfcrmruqsymg\7c3e598c = 5e23708241a4149105abbf3a6599cad9a2d13abccae091488e7333887bd5c423de492a5357658a24cb990400073e93cf4c9e45d323aedb414460	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pfcrmruqsymg\b98a7163 = 2fdc6b4e8bfa1a39f52d1aebce81c0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pfcrmruqsymg\7e7f79f0 = b366f16754c2cd633ebab4def5b492bd62f493d787f24d07b783ba47161723e1e7d146ce9a34d056a5e62e43bb372af54a819131c1bec6bf568a20c90f80	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pfcrmruqsymg\8c15a12d = 882c0dc4325a8b3a45dd71fc2b66cd481a4f9e1981ba4f23ec7f6e8dcabf17dc81cb65cb93cc23ae4286ad4c5f3099868d3d22c3555f5f1330310a4c7adda2f17a97826945d0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pfcrmruqsymg\f35ccedb = e41c902d366bf8cab2d6bca13a64c495bc3f38dcbaf1af43b4128f542627a34f72294012feb029cf7a9046c5620e1621025d2d95203ac6d2eada8e3aee0e090489ea4db88644ea7a9c474bbe70b0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pfcrmruqsymg\c6c31e95 = 66b508d80ef5c490e5aa531bce48149bd9a7faba22329b21ab0b77dec4f8e9476d60c481479d4106be783ca118a4a6dc599aafe1365a558f14d96f3a5c18f5c8670cfcd49349e8d97fc779a76def699a3192468a99e8d0a86de6b2ce2e2e425d9405822a653c9b6a018ed6c3d181bf29a34100cb51b4ee1c28c8b1852d0111c868fe8327ea48f0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pfcrmruqsymg\c4823ee9 = 78a1eb63b9d780ed3da17a1eef1c963d293dabb8cb9894dd3ca205cd188bd1ab6d5c39043ca25fbb73106511247a44ede0874414dd594f557f606831958c0044963ae718fec62fe58894ab959b4d36d9d534fedc4dce5b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pfcrmruqsymg\1361606 = 6a9cac78e3050a2da208464d73b6f6b3b6b61410dc9d672a8823740f2d54ce161df9f5a9b7c69bb24456a63f1a882e0fea6865	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

552 rundll32.exe
1384 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

552 rundll32.exe
1384 regsvr32.exe

pid	process
552	rundll32.exe
1384	regsvr32.exe

pid	process
552	rundll32.exe
1384	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1096 wrote to memory of 552	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 552	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 552	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 552	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 552	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 552	1096	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 552	1096	rundll32.exe	rundll32.exe
PID 552 wrote to memory of 572	552	rundll32.exe	explorer.exe
PID 552 wrote to memory of 572	552	rundll32.exe	explorer.exe
PID 552 wrote to memory of 572	552	rundll32.exe	explorer.exe
PID 552 wrote to memory of 572	552	rundll32.exe	explorer.exe
PID 552 wrote to memory of 572	552	rundll32.exe	explorer.exe
PID 552 wrote to memory of 572	552	rundll32.exe	explorer.exe
PID 572 wrote to memory of 1908	572	explorer.exe	schtasks.exe
PID 572 wrote to memory of 1908	572	explorer.exe	schtasks.exe
PID 572 wrote to memory of 1908	572	explorer.exe	schtasks.exe
PID 572 wrote to memory of 1908	572	explorer.exe	schtasks.exe
PID 592 wrote to memory of 1336	592	taskeng.exe	regsvr32.exe
PID 592 wrote to memory of 1336	592	taskeng.exe	regsvr32.exe
PID 592 wrote to memory of 1336	592	taskeng.exe	regsvr32.exe
PID 592 wrote to memory of 1336	592	taskeng.exe	regsvr32.exe
PID 592 wrote to memory of 1336	592	taskeng.exe	regsvr32.exe
PID 1336 wrote to memory of 1384	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1384	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1384	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1384	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1384	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1384	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1384	1336	regsvr32.exe	regsvr32.exe
PID 1384 wrote to memory of 1316	1384	regsvr32.exe	explorer.exe
PID 1384 wrote to memory of 1316	1384	regsvr32.exe	explorer.exe
PID 1384 wrote to memory of 1316	1384	regsvr32.exe	explorer.exe
PID 1384 wrote to memory of 1316	1384	regsvr32.exe	explorer.exe
PID 1384 wrote to memory of 1316	1384	regsvr32.exe	explorer.exe
PID 1384 wrote to memory of 1316	1384	regsvr32.exe	explorer.exe
PID 1316 wrote to memory of 1836	1316	explorer.exe	reg.exe
PID 1316 wrote to memory of 1836	1316	explorer.exe	reg.exe
PID 1316 wrote to memory of 1836	1316	explorer.exe	reg.exe
PID 1316 wrote to memory of 1836	1316	explorer.exe	reg.exe
PID 1316 wrote to memory of 1268	1316	explorer.exe	reg.exe
PID 1316 wrote to memory of 1268	1316	explorer.exe	reg.exe
PID 1316 wrote to memory of 1268	1316	explorer.exe	reg.exe
PID 1316 wrote to memory of 1268	1316	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rrghbqaah /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll\"" /SC ONCE /Z /ST 09:07 /ET 09:19
4⤵
- Creates scheduled task(s)
PID:1908

C:\Windows\system32\taskeng.exe
taskeng.exe {74FCE60B-A4BB-4B3B-B95C-354A6B1CEBC8} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1384

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Bpuwdix" /d "0"
5⤵
PID:1836

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Yitvpqn" /d "0"
5⤵
PID:1268

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll
MD5
4f7a4448b2e7d0618b86ee1eb62469e9

SHA1
c5854232e23a72caa5a719dfb1badb58a98cac3a

SHA256
b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529

SHA512
40ca8de592e8cb4ff50e3fd5a82dc1a6695cc137efee27883e20f560dd47ed0b59c2fdb7a5c6fe71f94088abce3c69760b17bba9f480aa3b5fac44bdba6d49fc

Download Submit
\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll
MD5
4f7a4448b2e7d0618b86ee1eb62469e9

SHA1
c5854232e23a72caa5a719dfb1badb58a98cac3a

SHA256
b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529

SHA512
40ca8de592e8cb4ff50e3fd5a82dc1a6695cc137efee27883e20f560dd47ed0b59c2fdb7a5c6fe71f94088abce3c69760b17bba9f480aa3b5fac44bdba6d49fc

Download Submit
memory/552-55-0x0000000000000000-mapping.dmp

Download
memory/552-56-0x0000000076431000-0x0000000076433000-memory.dmp

Filesize
8KB

Download
memory/552-57-0x0000000074660000-0x000000007480B000-memory.dmp

Filesize
1.7MB

Download
memory/552-58-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/552-59-0x0000000074660000-0x0000000074681000-memory.dmp

Filesize
132KB

Download
memory/552-60-0x0000000074660000-0x000000007480B000-memory.dmp

Filesize
1.7MB

Download
memory/572-61-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/572-66-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/572-64-0x0000000074851000-0x0000000074853000-memory.dmp

Filesize
8KB

Download
memory/572-62-0x0000000000000000-mapping.dmp

Download
memory/1268-83-0x0000000000000000-mapping.dmp

Download
memory/1316-81-0x00000000000E0000-0x0000000000101000-memory.dmp

Filesize
132KB

Download
memory/1316-78-0x0000000000000000-mapping.dmp

Download
memory/1336-68-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmp

Filesize
8KB

Download
memory/1336-67-0x0000000000000000-mapping.dmp

Download
memory/1384-73-0x0000000073F10000-0x00000000740BB000-memory.dmp

Filesize
1.7MB

Download
memory/1384-75-0x0000000073F10000-0x00000000740BB000-memory.dmp

Filesize
1.7MB

Download
memory/1384-74-0x0000000073F10000-0x0000000073F31000-memory.dmp

Filesize
132KB

Download
memory/1384-76-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1384-70-0x0000000000000000-mapping.dmp

Download
memory/1836-82-0x0000000000000000-mapping.dmp

Download
memory/1908-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads