qakbot | 3b5cf14550a79b9d51a016df893c8dbd2dcd03189d84a239e4d1bbd0a6f15b19

General

Target

3b5cf14550a79b9d51a016df893c8dbd2dcd03189d84a239e4d1bbd0a6f15b19.dll
Size

1.7MB
MD5

310afa8a793843687b964a53226ee574
SHA1

dea0d12de0e53c00b3b4397fe800c85c1a13dc08
SHA256

3b5cf14550a79b9d51a016df893c8dbd2dcd03189d84a239e4d1bbd0a6f15b19
SHA512

08b0995d79e0be8870a2593767a3e6471f40870a3406fd3f51ba16ea013e21e783d28a041fae8ce834b4b63d683d8cd8dfe0c47ddd1c89bd51780e6adee1690e

Score

10^/10

qakbot tr 1643025307 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

tr

Campaign

1643025307

C2

103.143.8.71:6881

37.210.172.200:2222

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

82.152.39.39:443

65.100.174.110:995

65.100.174.110:443

111.125.245.116:995

117.248.109.38:21

31.215.99.178:443

103.142.10.177:443

39.49.110.129:995

86.97.246.244:1194

68.204.7.158:443

217.128.93.27:2222

144.86.28.125:443

94.59.253.222:2222

120.150.218.241:995

185.249.85.209:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2036 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1000 schtasks.exe

pid	process
2036	regsvr32.exe

pid	process
1000	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aayeyeiwmr\9968995d = 62dcb3a024875f134110a0a91ff5f5cfc86509173fb0356864d7c1fa77fa0b4e0a56d45016a2bf11d86aa704fac9ba51fde91099d35f3aeb87c6ab5af2fb43cf76c37ad19af860c8731ecc3b871686429fc3185c1161ebcc5aa4595ed19e6f2e951da2d4697bc49076d3baf8bfabfef39a0db8d904dac26a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aayeyeiwmr\acf74913 = 5c20c68ac1a24f409da4b08269732b1783c0f9e1334485a33e6159e7616a533633605023aeaf26dc577004bcca4e8bec8cee043555411278e59542f4d5f48353a62ced295314972d7f592205945e1ddb65a7cf30bd4936cf92cf03e09af910a6e5c8f7af6cfac853154970e09960c320f38900b1079049f8df3512d451d0c03fa60e928253a8fa4bea327b14fc24161329808d721e319f08ac16a7e1c5cd0633476c11d6a53dad2cab0338d9c407a891222bd116bd8f132c2cce	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aayeyeiwmr\aeb6696f = 4402bd2d027ad2d712b05dc48664a315c6a2c5be0bead47bfb9d3006d35a377b63160733678396eb346141adb76fdcafba7609a5f4b6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aayeyeiwmr\160a0e0a = e555845557b366c012c84f829ff39f0a07cf6135e9d8a95c3dd6ef1ae14964abdfc81b4de2ade6d8d1f4747087a3e95a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aayeyeiwmr\6b024180 = e92ba9e719ed273067c90151476072d1995948c1b203ed318c8351863507f43bfff8a4f2524675a1d02a7bc32988fc9eb5e97324567a1c7b8da5df38e6f284d886e3c6089f9e8dbb1d14f3e567e328939e181f00854bccb7f1b6c4bc62a766e8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aayeyeiwmr\d3be26e5 = c2c123f3a2d00a45321a3d69ffecc6043fae672a33eea30a0a377a4713ae59b03f845dc8463c611129ca35984adc1cf491545ee533065b61d6df6d9b84664dbaf27ac66f3464d5d6f0a043df684d03d5ce088de2	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aayeyeiwmr	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aayeyeiwmr\9968995d = 62dca4a024876a1a52017254365ac5a211fc15bcdb8f01653fa0fe3aa466c4bfe9b4ffca19d05c8b862761d2b5db7788341d9eee3cdf3d70a86b69cb6e712cbb78fff37d88b49cdcd905432deaa6f17ea665bec58c2f16ee49cd83effb5f4eb2857419	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aayeyeiwmr\144b2e76 = 7f510c0a4253a6ef1fb0a0fddeba11f41c755b4a7519a454862b925f2c82bc5a7e0fa7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aayeyeiwmr\e621f6ab = 87ea8a51de455150bf98cbfe84852ca1b92fb5f9	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1548 rundll32.exe
2036 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1548 rundll32.exe
2036 regsvr32.exe

pid	process
1548	rundll32.exe
2036	regsvr32.exe

pid	process
1548	rundll32.exe
2036	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1572 wrote to memory of 1548	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 1548	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 1548	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 1548	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 1548	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 1548	1572	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 1548	1572	rundll32.exe	rundll32.exe
PID 1548 wrote to memory of 520	1548	rundll32.exe	explorer.exe
PID 1548 wrote to memory of 520	1548	rundll32.exe	explorer.exe
PID 1548 wrote to memory of 520	1548	rundll32.exe	explorer.exe
PID 1548 wrote to memory of 520	1548	rundll32.exe	explorer.exe
PID 1548 wrote to memory of 520	1548	rundll32.exe	explorer.exe
PID 1548 wrote to memory of 520	1548	rundll32.exe	explorer.exe
PID 520 wrote to memory of 1000	520	explorer.exe	schtasks.exe
PID 520 wrote to memory of 1000	520	explorer.exe	schtasks.exe
PID 520 wrote to memory of 1000	520	explorer.exe	schtasks.exe
PID 520 wrote to memory of 1000	520	explorer.exe	schtasks.exe
PID 1484 wrote to memory of 1068	1484	taskeng.exe	regsvr32.exe
PID 1484 wrote to memory of 1068	1484	taskeng.exe	regsvr32.exe
PID 1484 wrote to memory of 1068	1484	taskeng.exe	regsvr32.exe
PID 1484 wrote to memory of 1068	1484	taskeng.exe	regsvr32.exe
PID 1484 wrote to memory of 1068	1484	taskeng.exe	regsvr32.exe
PID 1068 wrote to memory of 2036	1068	regsvr32.exe	regsvr32.exe
PID 1068 wrote to memory of 2036	1068	regsvr32.exe	regsvr32.exe
PID 1068 wrote to memory of 2036	1068	regsvr32.exe	regsvr32.exe
PID 1068 wrote to memory of 2036	1068	regsvr32.exe	regsvr32.exe
PID 1068 wrote to memory of 2036	1068	regsvr32.exe	regsvr32.exe
PID 1068 wrote to memory of 2036	1068	regsvr32.exe	regsvr32.exe
PID 1068 wrote to memory of 2036	1068	regsvr32.exe	regsvr32.exe
PID 2036 wrote to memory of 1832	2036	regsvr32.exe	explorer.exe
PID 2036 wrote to memory of 1832	2036	regsvr32.exe	explorer.exe
PID 2036 wrote to memory of 1832	2036	regsvr32.exe	explorer.exe
PID 2036 wrote to memory of 1832	2036	regsvr32.exe	explorer.exe
PID 2036 wrote to memory of 1832	2036	regsvr32.exe	explorer.exe
PID 2036 wrote to memory of 1832	2036	regsvr32.exe	explorer.exe
PID 1832 wrote to memory of 1700	1832	explorer.exe	reg.exe
PID 1832 wrote to memory of 1700	1832	explorer.exe	reg.exe
PID 1832 wrote to memory of 1700	1832	explorer.exe	reg.exe
PID 1832 wrote to memory of 1700	1832	explorer.exe	reg.exe
PID 1832 wrote to memory of 1704	1832	explorer.exe	reg.exe
PID 1832 wrote to memory of 1704	1832	explorer.exe	reg.exe
PID 1832 wrote to memory of 1704	1832	explorer.exe	reg.exe
PID 1832 wrote to memory of 1704	1832	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b5cf14550a79b9d51a016df893c8dbd2dcd03189d84a239e4d1bbd0a6f15b19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b5cf14550a79b9d51a016df893c8dbd2dcd03189d84a239e4d1bbd0a6f15b19.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:520

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn drdmowqs /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\3b5cf14550a79b9d51a016df893c8dbd2dcd03189d84a239e4d1bbd0a6f15b19.dll\"" /SC ONCE /Z /ST 14:09 /ET 14:21
4⤵
- Creates scheduled task(s)
PID:1000

C:\Windows\system32\taskeng.exe
taskeng.exe {0CD026A4-9AFB-48CA-B8C4-6B0C1F4350CD} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\3b5cf14550a79b9d51a016df893c8dbd2dcd03189d84a239e4d1bbd0a6f15b19.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\3b5cf14550a79b9d51a016df893c8dbd2dcd03189d84a239e4d1bbd0a6f15b19.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Bseizi" /d "0"
5⤵
PID:1700

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ocfpxis" /d "0"
5⤵
PID:1704

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3b5cf14550a79b9d51a016df893c8dbd2dcd03189d84a239e4d1bbd0a6f15b19.dll
MD5
310afa8a793843687b964a53226ee574

SHA1
dea0d12de0e53c00b3b4397fe800c85c1a13dc08

SHA256
3b5cf14550a79b9d51a016df893c8dbd2dcd03189d84a239e4d1bbd0a6f15b19

SHA512
08b0995d79e0be8870a2593767a3e6471f40870a3406fd3f51ba16ea013e21e783d28a041fae8ce834b4b63d683d8cd8dfe0c47ddd1c89bd51780e6adee1690e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\3b5cf14550a79b9d51a016df893c8dbd2dcd03189d84a239e4d1bbd0a6f15b19.dll
MD5
310afa8a793843687b964a53226ee574

SHA1
dea0d12de0e53c00b3b4397fe800c85c1a13dc08

SHA256
3b5cf14550a79b9d51a016df893c8dbd2dcd03189d84a239e4d1bbd0a6f15b19

SHA512
08b0995d79e0be8870a2593767a3e6471f40870a3406fd3f51ba16ea013e21e783d28a041fae8ce834b4b63d683d8cd8dfe0c47ddd1c89bd51780e6adee1690e

Download Submit
memory/520-63-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/520-66-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/520-65-0x0000000074281000-0x0000000074283000-memory.dmp

Filesize
8KB

Download
memory/1068-67-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Filesize
8KB

Download
memory/1548-59-0x0000000000270000-0x0000000000291000-memory.dmp

Filesize
132KB

Download
memory/1548-56-0x0000000000B70000-0x0000000000D18000-memory.dmp

Filesize
1.7MB

Download
memory/1548-61-0x0000000000200000-0x0000000000243000-memory.dmp

Filesize
268KB

Download
memory/1548-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download
memory/1548-60-0x0000000000270000-0x0000000000291000-memory.dmp

Filesize
132KB

Download
memory/1548-57-0x0000000000270000-0x0000000000291000-memory.dmp

Filesize
132KB

Download
memory/1548-58-0x0000000000270000-0x0000000000291000-memory.dmp

Filesize
132KB

Download
memory/1548-62-0x0000000000270000-0x0000000000291000-memory.dmp

Filesize
132KB

Download
memory/1832-82-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2036-71-0x0000000000A90000-0x0000000000C38000-memory.dmp

Filesize
1.7MB

Download
memory/2036-74-0x00000000001C0000-0x00000000001E1000-memory.dmp

Filesize
132KB

Download
memory/2036-75-0x00000000001C0000-0x00000000001E1000-memory.dmp

Filesize
132KB

Download
memory/2036-73-0x00000000001C0000-0x00000000001E1000-memory.dmp

Filesize
132KB

Download
memory/2036-81-0x00000000001C0000-0x00000000001E1000-memory.dmp

Filesize
132KB

Download
memory/2036-80-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2036-72-0x00000000001C0000-0x00000000001E1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads