qakbot | b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529

General

Target

b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll
Size

1.6MB
MD5

4f7a4448b2e7d0618b86ee1eb62469e9
SHA1

c5854232e23a72caa5a719dfb1badb58a98cac3a
SHA256

b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529
SHA512

40ca8de592e8cb4ff50e3fd5a82dc1a6695cc137efee27883e20f560dd47ed0b59c2fdb7a5c6fe71f94088abce3c69760b17bba9f480aa3b5fac44bdba6d49fc

Score

10^/10

qakbot tr 1634541613 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1260 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4612 schtasks.exe

pid	process
1260	regsvr32.exe

pid	process
4612	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uggaxhh\97212f82 = c25f267eebe70dfe2546df75adc6ee466f0ad605874d9e17194a54220ccd19bfd34b1cd5170a29877ee666c2c8b3b79002293488196f9fa66ec890c5d38c073cd197b6dddb2b3c6f2cd03500590038f97f04153e88cded45ea8d7190e62f979a5bb16c501ddf32f91a6204de575e3dcab652f7161990aaa1fd981a57	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uggaxhh\50d42711 = daa219646e9d46701c9e00e593d6945ea76b6092e04c24d1c933d8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uggaxhh\e8684074 = 7382adedd2cfaa721ee82631e144e9fc3df903805388e2db232fae379aa5ececf3d115772042e1eafdbc898799e9a7b28c0a9b11c0279c7fdb82dcc5a9790dc6388e34c4ee3206137b2c3607b90d3ee1afbbc92bea9285d072d0d33cf046e7469da96dc53e1a417e1bd4413d64	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uggaxhh\2f9d48e7 = 545e293c77a4e3b46c2d9c857af7167fb4ac32c5c50b1bc67c1b3da93d421feb2d9c5b8c2528690459bf9e3b2044a422d289e83361b6ac90da593848a49a02aecff38f2dffa650a35e5cdfd06cb3bd16e711f610	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uggaxhh\ddf7903a = 04496b3b626c13c59751e9ef7f8ca5ecc4b8671a785a349004739aff822d11b40234c4cd5ad3ba6128d6897f5e1bd147aa67ddddbd40e8a9d89972e1feed913419106e6fce79bd56e9dd3c7348e205d6e085300e9f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uggaxhh	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uggaxhh\a2beffcc = ca9605c50f6e69498b2eac8c790218dd7e272deb0e7f79fd8ff396ba40860a2829	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uggaxhh\95600ffe = 1e28a0e3ee918664c9c77937a3cd7a438439ee31dabc07ba7b22d7e6851e4190ff411ed7f22f7fee4605a269e483206b1e96c439179e002c307dddaf858e9a49e6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uggaxhh\2ddc689b = afe39ea5f347372d19ba9a52d8bd1dc5a3702070a050f39804b8fa9941319ef9bc20a91c3d099a3c3afa51f987ca9a4d0e0067f4a5eeab07afee759e07327d93	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uggaxhh\a2beffcc = ca9612c50f6e5c852e70dfec76c819666755046ba2da50244a4bf007ad5413ae080d249f579fcaedf354d8bab35d8f7c4d24fc9e1fc8	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

4484 rundll32.exe
4484 rundll32.exe
1260 regsvr32.exe
1260 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

4484 rundll32.exe
1260 regsvr32.exe

pid	process
4484	rundll32.exe
4484	rundll32.exe
1260	regsvr32.exe
1260	regsvr32.exe

pid	process
4484	rundll32.exe
1260	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 4348 wrote to memory of 4484	4348	rundll32.exe	rundll32.exe
PID 4348 wrote to memory of 4484	4348	rundll32.exe	rundll32.exe
PID 4348 wrote to memory of 4484	4348	rundll32.exe	rundll32.exe
PID 4484 wrote to memory of 4636	4484	rundll32.exe	explorer.exe
PID 4484 wrote to memory of 4636	4484	rundll32.exe	explorer.exe
PID 4484 wrote to memory of 4636	4484	rundll32.exe	explorer.exe
PID 4484 wrote to memory of 4636	4484	rundll32.exe	explorer.exe
PID 4484 wrote to memory of 4636	4484	rundll32.exe	explorer.exe
PID 4636 wrote to memory of 4612	4636	explorer.exe	schtasks.exe
PID 4636 wrote to memory of 4612	4636	explorer.exe	schtasks.exe
PID 4636 wrote to memory of 4612	4636	explorer.exe	schtasks.exe
PID 1244 wrote to memory of 1260	1244	regsvr32.exe	regsvr32.exe
PID 1244 wrote to memory of 1260	1244	regsvr32.exe	regsvr32.exe
PID 1244 wrote to memory of 1260	1244	regsvr32.exe	regsvr32.exe
PID 1260 wrote to memory of 1496	1260	regsvr32.exe	explorer.exe
PID 1260 wrote to memory of 1496	1260	regsvr32.exe	explorer.exe
PID 1260 wrote to memory of 1496	1260	regsvr32.exe	explorer.exe
PID 1260 wrote to memory of 1496	1260	regsvr32.exe	explorer.exe
PID 1260 wrote to memory of 1496	1260	regsvr32.exe	explorer.exe
PID 1496 wrote to memory of 1756	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 1756	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 2044	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 2044	1496	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kvraswwn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll\"" /SC ONCE /Z /ST 04:21 /ET 04:33
      4⤵
      Creates scheduled task(s)
      PID:4612

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Oyxttligt" /d "0"
      4⤵
      PID:1756
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Gemagzsjnp" /d "0"
      4⤵
      PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll

MD5
4f7a4448b2e7d0618b86ee1eb62469e9

SHA1
c5854232e23a72caa5a719dfb1badb58a98cac3a

SHA256
b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529

SHA512
40ca8de592e8cb4ff50e3fd5a82dc1a6695cc137efee27883e20f560dd47ed0b59c2fdb7a5c6fe71f94088abce3c69760b17bba9f480aa3b5fac44bdba6d49fc

Download Submit
\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll

MD5
4f7a4448b2e7d0618b86ee1eb62469e9

SHA1
c5854232e23a72caa5a719dfb1badb58a98cac3a

SHA256
b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529

SHA512
40ca8de592e8cb4ff50e3fd5a82dc1a6695cc137efee27883e20f560dd47ed0b59c2fdb7a5c6fe71f94088abce3c69760b17bba9f480aa3b5fac44bdba6d49fc

Download Submit
memory/1260-133-0x0000000072E10000-0x0000000072FBB000-memory.dmp

Filesize
1.7MB

Download
memory/1260-129-0x0000000000000000-mapping.dmp

Download
memory/1260-134-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download
memory/1260-132-0x0000000072E10000-0x0000000072E31000-memory.dmp

Filesize
132KB

Download
memory/1260-131-0x0000000072E10000-0x0000000072FBB000-memory.dmp

Filesize
1.7MB

Download
memory/1496-140-0x0000000002570000-0x0000000002591000-memory.dmp

Filesize
132KB

Download
memory/1496-138-0x0000000002B60000-0x0000000002B61000-memory.dmp

Filesize
4KB

Download
memory/1496-139-0x0000000002B60000-0x0000000002B61000-memory.dmp

Filesize
4KB

Download
memory/1496-135-0x0000000000000000-mapping.dmp

Download
memory/1756-136-0x0000000000000000-mapping.dmp

Download
memory/2044-137-0x0000000000000000-mapping.dmp

Download
memory/4484-119-0x00000000740D0000-0x000000007427B000-memory.dmp

Filesize
1.7MB

Download
memory/4484-121-0x00000000740D0000-0x000000007427B000-memory.dmp

Filesize
1.7MB

Download
memory/4484-118-0x0000000000000000-mapping.dmp

Download
memory/4484-120-0x00000000740D0000-0x00000000740F1000-memory.dmp

Filesize
132KB

Download
memory/4484-122-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/4612-124-0x0000000000000000-mapping.dmp

Download
memory/4636-127-0x0000000002E00000-0x0000000002E21000-memory.dmp

Filesize
132KB

Download
memory/4636-126-0x0000000003100000-0x0000000003101000-memory.dmp

Filesize
4KB

Download
memory/4636-125-0x0000000003100000-0x0000000003101000-memory.dmp

Filesize
4KB

Download
memory/4636-123-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads