qakbot | 58be1575bf1aff15c05892b4cc9bc38d9b951f6640375f54d12ccd411a02488d

General

Target

58be1575bf1aff15c05892b4cc9bc38d9b951f6640375f54d12ccd411a02488d.dll
Size

1.6MB
MD5

0478380f70dea614e92761d343369b04
SHA1

be30885a48bc1d0898676c3b0d40d8ac4281d41d
SHA256

58be1575bf1aff15c05892b4cc9bc38d9b951f6640375f54d12ccd411a02488d
SHA512

9a92f9f0056e5aadedbe55bd27150fafdbb9b0fdf9e7ed52710b51b7b95b2580564b88a72f6b7f6015c2844a09f87eac5f9cc39a5885bf9768d7457ce1c6a8b6

Score

10^/10

qakbot tr 1643025307 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

tr

Campaign

1643025307

C2

103.143.8.71:6881

37.210.172.200:2222

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

82.152.39.39:443

65.100.174.110:995

65.100.174.110:443

111.125.245.116:995

117.248.109.38:21

31.215.99.178:443

103.142.10.177:443

39.49.110.129:995

86.97.246.244:1194

68.204.7.158:443

217.128.93.27:2222

144.86.28.125:443

94.59.253.222:2222

120.150.218.241:995

185.249.85.209:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

460 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1520 schtasks.exe

pid	process
460	regsvr32.exe

pid	process
1520	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Acucmmx\ffc1b0f7 = ab502e49710ea7e5e24850e6ba62071045d7fd3f885889bbc2b051cb7109bb1c966b3c879bf3a22f6a171f333e9450a0df3543225486f384c9318ee7e27c8c3e2166bcbcd47b7e56ad40b999fe5b85f916f17445858c0a4a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Acucmmx\3834b864 = 706a2b54cbfb9a6574f37e5b4213feb08879cbc70720cde5d8442c4e8e821cc67fb2d8e69c11d99e39e30128449103dd41806bb076ee	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Acucmmx\8088df01 = d82347298c145e993bc738e7449969ef2782adde4c65bf50686e09df6503a50cc79e37dc233a1a9e88d547ddf0314d12fd01d2115c0eab6f09986c2422b23d43ba054f6aec60c03a9626bfbb10a490a610a0ee0bdb2970735bec84193bb68d3558d460d1823df7da241f15072af750a9a0c25b2979a808863cf801e4e2f5c313aab13a07d68487	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Acucmmx\3a759818 = 3b95e01b90207eed2aad9c9ce019111629e9a8d265c67445ac	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Acucmmx\477dd792 = 4fbbb215f2e441249016053b4a0b9e5d96f8fd20eae09370ce9ce793fcead7bf8e20329ccd6881f75b3e35ff4bdb68843495071e3ab9fe57ce6ef1e8758ac0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Acucmmx\ca5e60b9 = 6706ab434f7c0627c5e0e09c3df1cd2c09345b0d4702202b85e38d0e90b01bbca171b3102085edd4e583a0c0666ad7aedfb0d616481b389515c89754448050eb7472f045e0bffa8f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Acucmmx\b5170f4f = e0cd1565dbbfdd1ae28e55118a9f01c21804d0efa98805713b539c1eee681c0d93525114fd5b29b6734bc8c206fe16c696097704e279bd994e4a44aaa79731929cccfbb63ccde8fab3953a942cd378ee3e5d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Acucmmx	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Acucmmx\b5170f4f = e0cd0265dbbfe883751cd7b8a56dcb69109820d54e52310dfa379ce51bd3b5015ad62a22ee7d61dd73dc4eb6dae3d005766b20bcf3ce09505a62efa5f7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Acucmmx\82c9ff7d = 6e6948c4b1c836fa9dd732b62ddaad214c24cf1a029dfa4539868e04a754fdf3bde445bb117eb8e2ec1bc51a04d1a2bd6a937651f86be56d58dfd3fd91b3c91638a87fa05f1b4138da41d47e9c67a25fd2bfe460c9a8b24955ed127e392b2f8f0616	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2040 rundll32.exe
460 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2040 rundll32.exe
460 regsvr32.exe

pid	process
2040	rundll32.exe
460	regsvr32.exe

pid	process
2040	rundll32.exe
460	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1900 wrote to memory of 2040	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 2040	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 2040	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 2040	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 2040	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 2040	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 2040	1900	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 520	2040	rundll32.exe	explorer.exe
PID 2040 wrote to memory of 520	2040	rundll32.exe	explorer.exe
PID 2040 wrote to memory of 520	2040	rundll32.exe	explorer.exe
PID 2040 wrote to memory of 520	2040	rundll32.exe	explorer.exe
PID 2040 wrote to memory of 520	2040	rundll32.exe	explorer.exe
PID 2040 wrote to memory of 520	2040	rundll32.exe	explorer.exe
PID 520 wrote to memory of 1520	520	explorer.exe	schtasks.exe
PID 520 wrote to memory of 1520	520	explorer.exe	schtasks.exe
PID 520 wrote to memory of 1520	520	explorer.exe	schtasks.exe
PID 520 wrote to memory of 1520	520	explorer.exe	schtasks.exe
PID 1200 wrote to memory of 1556	1200	taskeng.exe	regsvr32.exe
PID 1200 wrote to memory of 1556	1200	taskeng.exe	regsvr32.exe
PID 1200 wrote to memory of 1556	1200	taskeng.exe	regsvr32.exe
PID 1200 wrote to memory of 1556	1200	taskeng.exe	regsvr32.exe
PID 1200 wrote to memory of 1556	1200	taskeng.exe	regsvr32.exe
PID 1556 wrote to memory of 460	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 460	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 460	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 460	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 460	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 460	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 460	1556	regsvr32.exe	regsvr32.exe
PID 460 wrote to memory of 1792	460	regsvr32.exe	explorer.exe
PID 460 wrote to memory of 1792	460	regsvr32.exe	explorer.exe
PID 460 wrote to memory of 1792	460	regsvr32.exe	explorer.exe
PID 460 wrote to memory of 1792	460	regsvr32.exe	explorer.exe
PID 460 wrote to memory of 1792	460	regsvr32.exe	explorer.exe
PID 460 wrote to memory of 1792	460	regsvr32.exe	explorer.exe
PID 1792 wrote to memory of 868	1792	explorer.exe	reg.exe
PID 1792 wrote to memory of 868	1792	explorer.exe	reg.exe
PID 1792 wrote to memory of 868	1792	explorer.exe	reg.exe
PID 1792 wrote to memory of 868	1792	explorer.exe	reg.exe
PID 1792 wrote to memory of 1240	1792	explorer.exe	reg.exe
PID 1792 wrote to memory of 1240	1792	explorer.exe	reg.exe
PID 1792 wrote to memory of 1240	1792	explorer.exe	reg.exe
PID 1792 wrote to memory of 1240	1792	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58be1575bf1aff15c05892b4cc9bc38d9b951f6640375f54d12ccd411a02488d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58be1575bf1aff15c05892b4cc9bc38d9b951f6640375f54d12ccd411a02488d.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:520

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn uidohfy /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\58be1575bf1aff15c05892b4cc9bc38d9b951f6640375f54d12ccd411a02488d.dll\"" /SC ONCE /Z /ST 22:23 /ET 22:35
4⤵
- Creates scheduled task(s)
PID:1520

C:\Windows\system32\taskeng.exe
taskeng.exe {548FD9D6-3F18-4E1C-B08D-37BC791D277D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\58be1575bf1aff15c05892b4cc9bc38d9b951f6640375f54d12ccd411a02488d.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\58be1575bf1aff15c05892b4cc9bc38d9b951f6640375f54d12ccd411a02488d.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:460

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ripiijzyjsze" /d "0"
5⤵
PID:868

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ouyklaeihpi" /d "0"
5⤵
PID:1240

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\58be1575bf1aff15c05892b4cc9bc38d9b951f6640375f54d12ccd411a02488d.dll
MD5
0478380f70dea614e92761d343369b04

SHA1
be30885a48bc1d0898676c3b0d40d8ac4281d41d

SHA256
58be1575bf1aff15c05892b4cc9bc38d9b951f6640375f54d12ccd411a02488d

SHA512
9a92f9f0056e5aadedbe55bd27150fafdbb9b0fdf9e7ed52710b51b7b95b2580564b88a72f6b7f6015c2844a09f87eac5f9cc39a5885bf9768d7457ce1c6a8b6

Download Submit
\Users\Admin\AppData\Local\Temp\58be1575bf1aff15c05892b4cc9bc38d9b951f6640375f54d12ccd411a02488d.dll
MD5
0478380f70dea614e92761d343369b04

SHA1
be30885a48bc1d0898676c3b0d40d8ac4281d41d

SHA256
58be1575bf1aff15c05892b4cc9bc38d9b951f6640375f54d12ccd411a02488d

SHA512
9a92f9f0056e5aadedbe55bd27150fafdbb9b0fdf9e7ed52710b51b7b95b2580564b88a72f6b7f6015c2844a09f87eac5f9cc39a5885bf9768d7457ce1c6a8b6

Download Submit
memory/460-78-0x0000000000290000-0x00000000002B1000-memory.dmp

Filesize
132KB

Download
memory/460-73-0x0000000000290000-0x00000000002B1000-memory.dmp

Filesize
132KB

Download
memory/460-74-0x0000000000290000-0x00000000002B1000-memory.dmp

Filesize
132KB

Download
memory/460-71-0x0000000000290000-0x00000000002B1000-memory.dmp

Filesize
132KB

Download
memory/460-72-0x0000000000290000-0x00000000002B1000-memory.dmp

Filesize
132KB

Download
memory/460-70-0x0000000000AE0000-0x0000000000C88000-memory.dmp

Filesize
1.7MB

Download
memory/520-65-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/520-64-0x0000000074C41000-0x0000000074C43000-memory.dmp

Filesize
8KB

Download
memory/520-62-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/1556-66-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Filesize
8KB

Download
memory/1792-79-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2040-54-0x00000000760F1000-0x00000000760F3000-memory.dmp

Filesize
8KB

Download
memory/2040-61-0x0000000000350000-0x0000000000371000-memory.dmp

Filesize
132KB

Download
memory/2040-60-0x0000000001CD0000-0x0000000001D13000-memory.dmp

Filesize
268KB

Download
memory/2040-58-0x0000000000350000-0x0000000000371000-memory.dmp

Filesize
132KB

Download
memory/2040-59-0x0000000000350000-0x0000000000371000-memory.dmp

Filesize
132KB

Download
memory/2040-56-0x0000000000350000-0x0000000000371000-memory.dmp

Filesize
132KB

Download
memory/2040-57-0x0000000000350000-0x0000000000371000-memory.dmp

Filesize
132KB

Download
memory/2040-55-0x0000000001EA0000-0x0000000002048000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads