qakbot | 4f40db8f7c96f3cbd38de000c8b8818dae8145e533ff2bd1dba2cfa05ceb8885

General

Target

uxx1.dll
Size

1.7MB
MD5

b98cfc4a01cdc1add2ab5c88d2c5f647
SHA1

7e3f7a6df7d4ac26d327ea89d02bde73823be8d5
SHA256

3f7ac7e2b3fabce551c96515d807d2cd23c3de0cc0870ef2df363e2b02b04aba
SHA512

835298e1755176b7283b70bad63deb69ef2008132b8ecc262056a444bf79a5bf608d8b6929f6c0578d559e1b575d50af0cdd32559e6ad3c7dec00197c5a4dfab

Score

10^/10

qakbot tr 1643025307 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

tr

Campaign

1643025307

C2

103.143.8.71:6881

37.210.172.200:2222

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

82.152.39.39:443

65.100.174.110:995

65.100.174.110:443

111.125.245.116:995

117.248.109.38:21

31.215.99.178:443

103.142.10.177:443

39.49.110.129:995

86.97.246.244:1194

68.204.7.158:443

217.128.93.27:2222

144.86.28.125:443

94.59.253.222:2222

120.150.218.241:995

185.249.85.209:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1128 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

456 schtasks.exe

pid	process
1128	regsvr32.exe

pid	process
456	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kgyevvdykaf\5353182 = e504554e3e09961d62aabe9ca7ee72230e280e0e80fd40ae577461be27f38f2ebdc965aeaaf07a8ebc072c400659c952f38ffe5ff866a2417cbe59a871190abdbeee83b1cebaa1e236e6b32ef08894b73fa87b448e4d04accf69fbbb5a113bb8025775815eb7f426f9fce880	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kgyevvdykaf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kgyevvdykaf\c2c03911 = 927d0b2e4b5736c76f9efb57ac87800350af5139d02cc7ebfcd1135c45c1dd118657e226a95fe5ede7f8bdd7a9c713b189980cfcc7f5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kgyevvdykaf\bfc8769b = f7d82f583f2a8671e840ffc2be304c46948ecb0b8057bf6159edc35fa25dc22a304c26eb4a9da1974b39eeb1df337d6e6b9e101dcd53aee1b0493efaeb1138d08d30ea07b3bf50a891b5f6c40d0df14373b52e5f1e668a6636c69e6c028f84db4f12a460	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kgyevvdykaf\77411fe = 11e2114beadcda738d3415398f6b801f9dfddfcfa605b279bfb64a907453096746f2e2a12fe9663ed1fc8f5ff5cbf4bbd657db73e56e211241654c3a6d98292dc4c3ccf5609296d286f66ae6efc89628b3677fd5f0f1d809988adfb3c810abf92e2d983f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kgyevvdykaf\7a7c5e74 = c32278c3994f70ddbbe4cb7532df4bcb768aedca0176091a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kgyevvdykaf\f75fe95f = 47c1401822620febbfb86ee0832eb31a5af9bf1e422842df373ec51636ee759791bc56ffcdec8d15c4bf71	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kgyevvdykaf\881686a9 = 25e78c5f3fffd67a894c3510b1e9fdfa60acf800110e98450e21911e3a72d0fab4fb2b66d0e1d884e3d5c6eea4da08f691b6b4340dd064c6665f2ad4d980	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kgyevvdykaf\881686a9 = 25e79b5f3fffe3dac17a3a6652475bad4c37184e523ae4c2a13ef43853fcdf8171421c45957c9d78bb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kgyevvdykaf\bd8956e7 = cf9743c8c4cf0e3c769b5577ad3aca489e7e57bf8e3dc1ffcb0356979d52decf367056e8f44e712828c9e7d35f984acf4753dd3b4db80bb1962ac8ce68866e58f7c218aae8f38b90f53c5bac3b720968fc40e95131866e02b692ea0e73dee75fb4c84d5450eebb02da56300dda999032129843dc5ca934522ffeb6b0d40be491a0	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1272 rundll32.exe
1128 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1272 rundll32.exe
1128 regsvr32.exe

pid	process
1272	rundll32.exe
1128	regsvr32.exe

pid	process
1272	rundll32.exe
1128	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1680 wrote to memory of 1272	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1272	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1272	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1272	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1272	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1272	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1272	1680	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 552	1272	rundll32.exe	explorer.exe
PID 1272 wrote to memory of 552	1272	rundll32.exe	explorer.exe
PID 1272 wrote to memory of 552	1272	rundll32.exe	explorer.exe
PID 1272 wrote to memory of 552	1272	rundll32.exe	explorer.exe
PID 1272 wrote to memory of 552	1272	rundll32.exe	explorer.exe
PID 1272 wrote to memory of 552	1272	rundll32.exe	explorer.exe
PID 552 wrote to memory of 456	552	explorer.exe	schtasks.exe
PID 552 wrote to memory of 456	552	explorer.exe	schtasks.exe
PID 552 wrote to memory of 456	552	explorer.exe	schtasks.exe
PID 552 wrote to memory of 456	552	explorer.exe	schtasks.exe
PID 1808 wrote to memory of 1552	1808	taskeng.exe	regsvr32.exe
PID 1808 wrote to memory of 1552	1808	taskeng.exe	regsvr32.exe
PID 1808 wrote to memory of 1552	1808	taskeng.exe	regsvr32.exe
PID 1808 wrote to memory of 1552	1808	taskeng.exe	regsvr32.exe
PID 1808 wrote to memory of 1552	1808	taskeng.exe	regsvr32.exe
PID 1552 wrote to memory of 1128	1552	regsvr32.exe	regsvr32.exe
PID 1552 wrote to memory of 1128	1552	regsvr32.exe	regsvr32.exe
PID 1552 wrote to memory of 1128	1552	regsvr32.exe	regsvr32.exe
PID 1552 wrote to memory of 1128	1552	regsvr32.exe	regsvr32.exe
PID 1552 wrote to memory of 1128	1552	regsvr32.exe	regsvr32.exe
PID 1552 wrote to memory of 1128	1552	regsvr32.exe	regsvr32.exe
PID 1552 wrote to memory of 1128	1552	regsvr32.exe	regsvr32.exe
PID 1128 wrote to memory of 1496	1128	regsvr32.exe	explorer.exe
PID 1128 wrote to memory of 1496	1128	regsvr32.exe	explorer.exe
PID 1128 wrote to memory of 1496	1128	regsvr32.exe	explorer.exe
PID 1128 wrote to memory of 1496	1128	regsvr32.exe	explorer.exe
PID 1128 wrote to memory of 1496	1128	regsvr32.exe	explorer.exe
PID 1128 wrote to memory of 1496	1128	regsvr32.exe	explorer.exe
PID 1496 wrote to memory of 1724	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 1724	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 1724	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 1724	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 1996	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 1996	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 1996	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 1996	1496	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\uxx1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\uxx1.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hdncxovuku /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\uxx1.dll\"" /SC ONCE /Z /ST 13:29 /ET 13:41
4⤵
- Creates scheduled task(s)
PID:456

C:\Windows\system32\taskeng.exe
taskeng.exe {CF1CCFA3-2CC0-4615-89DB-03D191619835} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\uxx1.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\uxx1.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Csweigmchjdm" /d "0"
5⤵
PID:1724

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Wjapdbdkv" /d "0"
5⤵
PID:1996

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\uxx1.dll
MD5
b98cfc4a01cdc1add2ab5c88d2c5f647

SHA1
7e3f7a6df7d4ac26d327ea89d02bde73823be8d5

SHA256
3f7ac7e2b3fabce551c96515d807d2cd23c3de0cc0870ef2df363e2b02b04aba

SHA512
835298e1755176b7283b70bad63deb69ef2008132b8ecc262056a444bf79a5bf608d8b6929f6c0578d559e1b575d50af0cdd32559e6ad3c7dec00197c5a4dfab

Download Submit
\Users\Admin\AppData\Local\Temp\uxx1.dll
MD5
b98cfc4a01cdc1add2ab5c88d2c5f647

SHA1
7e3f7a6df7d4ac26d327ea89d02bde73823be8d5

SHA256
3f7ac7e2b3fabce551c96515d807d2cd23c3de0cc0870ef2df363e2b02b04aba

SHA512
835298e1755176b7283b70bad63deb69ef2008132b8ecc262056a444bf79a5bf608d8b6929f6c0578d559e1b575d50af0cdd32559e6ad3c7dec00197c5a4dfab

Download Submit
memory/552-63-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/552-66-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/552-65-0x0000000074461000-0x0000000074463000-memory.dmp

Filesize
8KB

Download
memory/1128-73-0x0000000000360000-0x0000000000381000-memory.dmp

Filesize
132KB

Download
memory/1128-71-0x0000000000D10000-0x0000000000EB8000-memory.dmp

Filesize
1.7MB

Download
memory/1128-76-0x0000000000360000-0x0000000000381000-memory.dmp

Filesize
132KB

Download
memory/1128-74-0x0000000000360000-0x0000000000381000-memory.dmp

Filesize
132KB

Download
memory/1128-75-0x0000000000360000-0x0000000000381000-memory.dmp

Filesize
132KB

Download
memory/1128-72-0x0000000000360000-0x0000000000381000-memory.dmp

Filesize
132KB

Download
memory/1272-57-0x0000000000440000-0x0000000000461000-memory.dmp

Filesize
132KB

Download
memory/1272-61-0x0000000000220000-0x0000000000263000-memory.dmp

Filesize
268KB

Download
memory/1272-56-0x0000000001DC0000-0x0000000001F68000-memory.dmp

Filesize
1.7MB

Download
memory/1272-55-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/1272-58-0x0000000000440000-0x0000000000461000-memory.dmp

Filesize
132KB

Download
memory/1272-60-0x0000000000440000-0x0000000000461000-memory.dmp

Filesize
132KB

Download
memory/1272-59-0x0000000000440000-0x0000000000461000-memory.dmp

Filesize
132KB

Download
memory/1272-62-0x0000000000440000-0x0000000000461000-memory.dmp

Filesize
132KB

Download
memory/1496-80-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1552-67-0x000007FEFB791000-0x000007FEFB793000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads