qakbot | 44387c6f5d8a576d5af2e3267ce81871657b053c36d5e16495525a034cafb188

General

Target

44387c6f5d8a576d5af2e3267ce81871657b053c36d5e16495525a034cafb188.dll
Size

536KB
MD5

2d11c63f3f8d57e65285038f6b4e3a40
SHA1

9be7f2b49753a7dc115689942c0c25786f3582c7
SHA256

44387c6f5d8a576d5af2e3267ce81871657b053c36d5e16495525a034cafb188
SHA512

d3d3b911064da81efd6c2828e2604d6c9d3b26c0fd457f7a8782a081750ef23863c0db4c478566f354419817896f3756584134680f8f1d915dc758cc8075420e

Score

10^/10

qakbot tr 1643025272 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

tr

Campaign

1643025272

C2

103.143.8.71:6881

37.210.172.200:2222

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

82.152.39.39:443

65.100.174.110:995

65.100.174.110:443

111.125.245.116:995

117.248.109.38:21

31.215.99.178:443

103.142.10.177:443

39.49.110.129:995

86.97.246.244:1194

68.204.7.158:443

217.128.93.27:2222

144.86.28.125:443

94.59.253.222:2222

120.150.218.241:995

185.249.85.209:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1956 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2576 schtasks.exe

pid	process
1956	regsvr32.exe

pid	process
2576	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xuurqyvigaxme\be36f70b = d7c873eb5c39e235aae1b69ebbc99d47fffa24a85b51856a155d64b74452fb9e68abcc97b921b8701b157c0b48a37a1cfb9c09dd5c4bc224d02ed4ef8ef3b51b44c07f1e9dff36ce732aae20fc5fa0a21618b987d13c475d2960fcbb8fc3ab63292447550778cd9d41f8ae2a2d2af5159f0ea15dd9d6c16f812df28f553ae23baeab5e3d59a702b98edc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xuurqyvigaxme\bc77d777 = 46d83326573a482ab969f793cf794bf584bd30a1b78b4429112b4feb399e6896a5286d3a3c8fe2003daa	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xuurqyvigaxme\79c3ff98 = 1e9642d8196c551032068a3ff3da9312de0d2ba87b542ce3601aec56324eef887857d1633a16862772cb910a4ad151dc57708deefe6711e6f5ffd6318e9652e451c3d7fcb48af0f839ce1b9601b6fbf4b00d814995318712ccec3061f10ad74534af238ee3bc2d82f0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xuurqyvigaxme\c17f98fd = 38ef28fb3ae18964fc3bd41fbab5e32de167ed7ea23f78ae1d10758029d01ef3a07abc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xuurqyvigaxme\68a906e = 543e9cff65ab014e9e7f7db146ac8e05f0a25e40e4efe13f057ef8a9f59337a78438c2be5a82209338dac8d204cf79bf9495312c65	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xuurqyvigaxme	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xuurqyvigaxme\8ba92745 = b358457903f73e649eae548ee0f945d3337b4e3914b3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xuurqyvigaxme\4cbb012 = d5abf0d7196cc32fec6f34dc9681391b5a881b7177be3e037b72fc9f80de6aeeb66d0c3a2363c310f06a02901666cbd4ac9fee48716b7a5011a9632915f42040109e778a54a30f5e3f1bb869a940ed8588be327882c6a2e471d0f5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xuurqyvigaxme\f4e048b3 = f64b69ea1b48502c380f2b4ef5903a6536e0cfad60d24b65177582e16982c82ad2a3fd8a21a0724ee75802358e31b2466502b496ef7eca4980e236c41e3115bb3d0d4ef3e757a1b90daca7c4063a32	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xuurqyvigaxme\8ba92745 = b358527903f70b014ca2f48f308346e68d2998b92bfa01242b8a33b01ee5c7799127f67c8f3af3e5952794	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3052 regsvr32.exe
3052 regsvr32.exe
1956 regsvr32.exe
1956 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3052 regsvr32.exe
1956 regsvr32.exe

pid	process
3052	regsvr32.exe
3052	regsvr32.exe
1956	regsvr32.exe
1956	regsvr32.exe

pid	process
3052	regsvr32.exe
1956	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2644 wrote to memory of 3052	2644	regsvr32.exe	regsvr32.exe
PID 2644 wrote to memory of 3052	2644	regsvr32.exe	regsvr32.exe
PID 2644 wrote to memory of 3052	2644	regsvr32.exe	regsvr32.exe
PID 3052 wrote to memory of 3796	3052	regsvr32.exe	explorer.exe
PID 3052 wrote to memory of 3796	3052	regsvr32.exe	explorer.exe
PID 3052 wrote to memory of 3796	3052	regsvr32.exe	explorer.exe
PID 3052 wrote to memory of 3796	3052	regsvr32.exe	explorer.exe
PID 3052 wrote to memory of 3796	3052	regsvr32.exe	explorer.exe
PID 3796 wrote to memory of 2576	3796	explorer.exe	schtasks.exe
PID 3796 wrote to memory of 2576	3796	explorer.exe	schtasks.exe
PID 3796 wrote to memory of 2576	3796	explorer.exe	schtasks.exe
PID 1316 wrote to memory of 1956	1316	regsvr32.exe	regsvr32.exe
PID 1316 wrote to memory of 1956	1316	regsvr32.exe	regsvr32.exe
PID 1316 wrote to memory of 1956	1316	regsvr32.exe	regsvr32.exe
PID 1956 wrote to memory of 2528	1956	regsvr32.exe	explorer.exe
PID 1956 wrote to memory of 2528	1956	regsvr32.exe	explorer.exe
PID 1956 wrote to memory of 2528	1956	regsvr32.exe	explorer.exe
PID 1956 wrote to memory of 2528	1956	regsvr32.exe	explorer.exe
PID 1956 wrote to memory of 2528	1956	regsvr32.exe	explorer.exe
PID 2528 wrote to memory of 416	2528	explorer.exe	reg.exe
PID 2528 wrote to memory of 416	2528	explorer.exe	reg.exe
PID 2528 wrote to memory of 1220	2528	explorer.exe	reg.exe
PID 2528 wrote to memory of 1220	2528	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\44387c6f5d8a576d5af2e3267ce81871657b053c36d5e16495525a034cafb188.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2644

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\44387c6f5d8a576d5af2e3267ce81871657b053c36d5e16495525a034cafb188.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3796

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn iqpqlvcxc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44387c6f5d8a576d5af2e3267ce81871657b053c36d5e16495525a034cafb188.dll\"" /SC ONCE /Z /ST 23:38 /ET 23:50
4⤵
- Creates scheduled task(s)
PID:2576

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44387c6f5d8a576d5af2e3267ce81871657b053c36d5e16495525a034cafb188.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\44387c6f5d8a576d5af2e3267ce81871657b053c36d5e16495525a034cafb188.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2528

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ncanetxku" /d "0"
4⤵
PID:416

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Yeejtyyryehg" /d "0"
4⤵
PID:1220

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44387c6f5d8a576d5af2e3267ce81871657b053c36d5e16495525a034cafb188.dll
MD5
2d11c63f3f8d57e65285038f6b4e3a40

SHA1
9be7f2b49753a7dc115689942c0c25786f3582c7

SHA256
44387c6f5d8a576d5af2e3267ce81871657b053c36d5e16495525a034cafb188

SHA512
d3d3b911064da81efd6c2828e2604d6c9d3b26c0fd457f7a8782a081750ef23863c0db4c478566f354419817896f3756584134680f8f1d915dc758cc8075420e

Download Submit
\Users\Admin\AppData\Local\Temp\44387c6f5d8a576d5af2e3267ce81871657b053c36d5e16495525a034cafb188.dll
MD5
2d11c63f3f8d57e65285038f6b4e3a40

SHA1
9be7f2b49753a7dc115689942c0c25786f3582c7

SHA256
44387c6f5d8a576d5af2e3267ce81871657b053c36d5e16495525a034cafb188

SHA512
d3d3b911064da81efd6c2828e2604d6c9d3b26c0fd457f7a8782a081750ef23863c0db4c478566f354419817896f3756584134680f8f1d915dc758cc8075420e

Download Submit
memory/1956-125-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

Filesize
4KB

Download
memory/2528-126-0x0000000002CC0000-0x0000000002CE1000-memory.dmp

Filesize
132KB

Download
memory/3052-118-0x0000000002F80000-0x0000000002F81000-memory.dmp

Filesize
4KB

Download
memory/3052-119-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/3796-122-0x0000000002810000-0x0000000002831000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads