qakbot | a2a676d3c97975edce1e09d9f777287bc953b382962005030f7627d6da08b00a

Analysis

max time kernel
129s
max time network
122s
platform
windows7_x64
resource
win7-en-20211104
submitted
01/12/2021, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
besta.ocx.dll
Size 809KB
Sample211201-mkfahaeeb4
SHA256 a2a676d3c97975edce1e09d9f777287bc953b382962005030f7627d6da08b00a
MD5 ff7813f09571dfdafaf75abffdc7aab1
SHA1 200f8b4ce6d49a3a13b42c590ff176bc9811dd5c
SHA512 b70bee594554bb64f376f73f3fb88d4d086539c86b6f37897c5e6328a9c7d6d8d1778b871ff28ddaa97a6b9dc37ea30a0446cc3e58b299e9b0ee6aca92c52a30
MD5 SHA1 SHA512

Score

10^/10

qakbot tr 1638169179 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

Campaign

1638169179

136.232.34.70:443
117.248.109.38:21
218.101.110.3:995
140.82.49.12:443
102.65.38.57:443
136.143.11.232:443
39.33.188.131:995
76.25.142.196:443
120.150.218.241:995
189.252.156.7:32101
185.53.147.51:443
103.142.10.177:443
117.198.159.148:443
217.165.237.42:443
216.238.71.31:443
207.246.112.221:995
207.246.112.221:443
45.46.53.140:2222
173.21.10.71:2222
67.165.206.193:993
189.135.21.162:443
71.74.12.34:443
86.8.177.143:443
174.20.72.123:443
73.151.236.31:443
94.60.254.81:443
89.137.52.44:443
89.101.97.139:443
109.12.111.14:443
68.204.7.158:443
27.5.4.111:2222
129.208.177.244:995
105.198.236.99:995
65.100.174.110:8443
94.200.181.154:443
65.100.174.110:995
63.143.92.99:995
201.172.31.95:80
75.188.35.168:995
186.64.67.16:443
39.49.33.135:995
182.176.180.73:443
194.36.28.26:443
103.116.178.85:993
75.66.88.33:443
187.156.138.52:443
200.114.247.160:465
189.147.174.121:443
24.139.72.117:443
75.169.58.229:32100
5.31.189.54:995
86.120.85.147:443
93.48.80.198:995
2.222.167.138:443
197.89.6.112:443
27.57.252.156:443
103.150.40.76:995
41.228.22.180:443
81.250.153.227:2222
88.244.161.183:995
111.250.48.162:443
50.194.160.233:32100
50.194.160.233:443
24.55.112.61:443
73.140.38.124:443
108.4.67.252:443
176.63.117.1:22
100.1.119.41:443
24.229.150.54:995
111.91.87.187:443
86.97.10.14:443
220.255.25.187:2222
92.59.35.196:2222
72.252.201.34:465
209.210.95.228:443
68.186.192.69:443
187.121.105.111:995
103.168.241.157:995
103.168.241.157:465
86.190.203.103:443
93.147.212.206:443
5.238.149.217:61202
72.252.201.34:995
24.152.219.253:995
96.37.113.36:993
45.9.20.200:2211
190.73.3.148:2222
80.6.192.58:443
103.116.178.85:61200
93.48.58.123:2222
27.223.92.142:995
91.178.126.51:995
41.235.5.174:443
96.246.158.154:995
50.194.160.233:465
96.21.251.127:2222
216.238.71.31:995
216.238.72.121:995
216.238.72.121:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
1376	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1528	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yqaaawuocoeb\3368652b = def60762a7c853b17e90c3010cd46761d49ad4c137cc0d091c28cf40fa7a50cd49d0a15f8d5deb3029bdb2c7d5b6ce523ef99ef6c2c8deda73951c333e0e3e8bb8e995b210bd998526fee55e27ebd0d35cc28733dee3c2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yqaaawuocoeb\8bd4024e = 64486edb9f296c50d7a6a14387aecfdc1528c7b496f8b9a2473a232f0977b37bbf3d778ae51c83a1d78071e8877e17e5909ebd8ec498f5293c9b09b17722d0ac7bd89d50ba27533da1cdace77fda477790e01d34516d19	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yqaaawuocoeb\f6dc4dc4 = ac2a322ee075b9c7d12288ee600d68e1635934687d7d29150b10a8258f6801312cb122adf9e60836da882080f961d7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yqaaawuocoeb\89952232 = 860488dc3d8a634310e9d676818295f535f252b1da2d4595fa7e14dd3504bcf18268d62b404c4811eed2c41f952757f66d6505ba6bf0499288db450a6a2f8afc554c87b79be92c8a8d71	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yqaaawuocoeb\4b69519 = 51a1fae1f1a307f296ee0b92c094342afb009ecc570fbaf2deb696684068af84dfe2c95fe7546dfbfc52b633087bbf9a45d7b489feb424d6300240f807839a40df87169a75c8c5de453c	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yqaaawuocoeb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yqaaawuocoeb\4b69519 = 51a1ede1f1a33282ae1e0e5ff8206082cd63174953b866bd5b1158308b1942729e354a3d6d9ecba91148ea5c68ef051a59ecbb8015	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yqaaawuocoeb\31294557 = d282453d4fcdba7f49b0824a1af2f1b6d10797f6cb27eec3b36b74054854428f438201318102e016c1f544769897137ddbc6fce6630ecb4cdde64a1a367eb8389d8e1bcc219e2fc8eb89b1a8b771a490ee0ce69bf5521ae12d877646aba5af5ad51a945db3196141965aa1d2fd16ea45a3ff7bd4d85b990985d27d1f9bd0644208d2ad22302e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yqaaawuocoeb\4e602aa1 = a30ca66522b6fda35f7457249cb0007861023b20f9f6525496a20196525de13f8e05fadee191d10c0abe34267005c0fbdcba405205093c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Yqaaawuocoeb\7bfffaef = d7ef76c8cd01831a8b2804febacd574c7666168031529203608f38863f3e9b3b23c9a9584e79ffd71050cd0cef37fc8497a11159bed98dab0f39f55dcb9470d6ef3abb00d1cad6a30f8e4e635a5f06e4e109db0c3892385be1f94daa631009b555679ed8e9ae9b903a405f78	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1344	rundll32.exe
1376	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1344	rundll32.exe
1376	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 1344	1516	rundll32.exe	27
PID 1516 wrote to memory of 1344	1516	rundll32.exe	27
PID 1516 wrote to memory of 1344	1516	rundll32.exe	27
PID 1516 wrote to memory of 1344	1516	rundll32.exe	27
PID 1516 wrote to memory of 1344	1516	rundll32.exe	27
PID 1516 wrote to memory of 1344	1516	rundll32.exe	27
PID 1516 wrote to memory of 1344	1516	rundll32.exe	27
PID 1344 wrote to memory of 1892	1344	rundll32.exe	29
PID 1344 wrote to memory of 1892	1344	rundll32.exe	29
PID 1344 wrote to memory of 1892	1344	rundll32.exe	29
PID 1344 wrote to memory of 1892	1344	rundll32.exe	29
PID 1344 wrote to memory of 1892	1344	rundll32.exe	29
PID 1344 wrote to memory of 1892	1344	rundll32.exe	29
PID 1892 wrote to memory of 1528	1892	explorer.exe	30
PID 1892 wrote to memory of 1528	1892	explorer.exe	30
PID 1892 wrote to memory of 1528	1892	explorer.exe	30
PID 1892 wrote to memory of 1528	1892	explorer.exe	30
PID 1572 wrote to memory of 1788	1572	taskeng.exe	33
PID 1572 wrote to memory of 1788	1572	taskeng.exe	33
PID 1572 wrote to memory of 1788	1572	taskeng.exe	33
PID 1572 wrote to memory of 1788	1572	taskeng.exe	33
PID 1572 wrote to memory of 1788	1572	taskeng.exe	33
PID 1788 wrote to memory of 1376	1788	regsvr32.exe	34
PID 1788 wrote to memory of 1376	1788	regsvr32.exe	34
PID 1788 wrote to memory of 1376	1788	regsvr32.exe	34
PID 1788 wrote to memory of 1376	1788	regsvr32.exe	34
PID 1788 wrote to memory of 1376	1788	regsvr32.exe	34
PID 1788 wrote to memory of 1376	1788	regsvr32.exe	34
PID 1788 wrote to memory of 1376	1788	regsvr32.exe	34
PID 1376 wrote to memory of 1876	1376	regsvr32.exe	35
PID 1376 wrote to memory of 1876	1376	regsvr32.exe	35
PID 1376 wrote to memory of 1876	1376	regsvr32.exe	35
PID 1376 wrote to memory of 1876	1376	regsvr32.exe	35
PID 1376 wrote to memory of 1876	1376	regsvr32.exe	35
PID 1376 wrote to memory of 1876	1376	regsvr32.exe	35
PID 1876 wrote to memory of 548	1876	explorer.exe	36
PID 1876 wrote to memory of 548	1876	explorer.exe	36
PID 1876 wrote to memory of 548	1876	explorer.exe	36
PID 1876 wrote to memory of 548	1876	explorer.exe	36
PID 1876 wrote to memory of 240	1876	explorer.exe	38
PID 1876 wrote to memory of 240	1876	explorer.exe	38
PID 1876 wrote to memory of 240	1876	explorer.exe	38
PID 1876 wrote to memory of 240	1876	explorer.exe	38

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\besta.ocx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\besta.ocx.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kttlsrs /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\besta.ocx.dll\"" /SC ONCE /Z /ST 10:29 /ET 10:41
      4⤵
      Creates scheduled task(s)
      PID:1528

C:\Windows\system32\taskeng.exe
taskeng.exe {A8D5BFAA-37B1-4E8D-B79C-A33C0000BA57} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\besta.ocx.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\besta.ocx.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1876
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Eynooxquxuth" /d "0"
        5⤵
        
        PID:548
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Duybhaiq" /d "0"
        5⤵
        
        PID:240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1344-61-0x0000000000660000-0x0000000000681000-memory.dmp

Download

memory/1344-60-0x0000000000660000-0x0000000000681000-memory.dmp

Download

memory/1344-62-0x0000000000660000-0x0000000000681000-memory.dmp

Download

memory/1344-63-0x0000000000660000-0x0000000000681000-memory.dmp

Download

memory/1344-64-0x0000000000660000-0x0000000000681000-memory.dmp

Download

memory/1344-58-0x0000000000140000-0x0000000000141000-memory.dmp

Download

memory/1344-59-0x00000000003E0000-0x000000000040E000-memory.dmp

Download

memory/1344-57-0x0000000001CF0000-0x0000000001DBF000-memory.dmp

Download

memory/1344-56-0x0000000076A21000-0x0000000076A23000-memory.dmp

Download

memory/1376-81-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/1376-80-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/1376-83-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/1376-82-0x0000000000140000-0x0000000000141000-memory.dmp

Download

memory/1376-77-0x00000000009C0000-0x0000000000A8F000-memory.dmp

Download

memory/1376-79-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/1376-78-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/1788-72-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Download

memory/1876-89-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/1892-70-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/1892-68-0x0000000074E61000-0x0000000074E63000-memory.dmp

Download

memory/1892-65-0x00000000000B0000-0x00000000000B2000-memory.dmp

Download