qakbot | a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6

General

Target

a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll
Size

541KB
MD5

cccab2984ff316a36630e869282d8189
SHA1

24201f608110ae4d54a840e3af9490ea96091cb5
SHA256

a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6
SHA512

bf332287aee1dbaa813dc8ed12a7a362d8e1b2a57455e2609fe720658415cc417fd938aab69a30962cc74b777ab06a6707f306ec1f019e7dac5d2b5e59da4742

Score

10^/10

qakbot tr 1643025272 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

tr

Campaign

1643025272

C2

103.143.8.71:6881

37.210.172.200:2222

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

82.152.39.39:443

65.100.174.110:995

65.100.174.110:443

111.125.245.116:995

117.248.109.38:21

31.215.99.178:443

103.142.10.177:443

39.49.110.129:995

86.97.246.244:1194

68.204.7.158:443

217.128.93.27:2222

144.86.28.125:443

94.59.253.222:2222

120.150.218.241:995

185.249.85.209:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

960 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

568 schtasks.exe

pid	process
960	regsvr32.exe

pid	process
568	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tyvyqqoobxywt	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tyvyqqoobxywt\f614144 = 716918c752918b4e3e4dc491e906bd3cfca982bef0554f7220dfe3df0506e3cc291153a64ac2f4cc8fc7930176a00f9dd28866bff0c3b717eceb1cbd37affe769cc7fd798c21b23aff68909963a5d4dd9e16bcc3c95f47b6148ea376a2ea8d0e72aecb94b662d85416b6e7ed8f29e07d2bd74b3c78a556c48a38ec4dee97b4e1a71d786a592946b9beb86f4e69b8d589485f99274718fb6387a59a90e1d6ee1115ed857585a308246d13b41b6c27967c0d7f5203ff3062b7ef4e1d2ddb8e5219030e5c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tyvyqqoobxywt\c89449d7 = e4b0e731460033d0df78913e2880f7ef41afef56228f6072a63503300ca07e932ff1560380e5841b02b0145f3ea30d6b86ee0163ba1cf42384948a9d88a9f38974040cbc801ffea0e64b84d2de273898f38b1d6cb39b8e5132d8dec4c1ecd16a4ff32354251f6f1d647313b8aefb83495186	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tyvyqqoobxywt\3afe910a = 95dc030e7c789f82c050378eb8625adf813f051c55343b97f4e44b6c24f8e9945e5953f928245995fc3a41eeeea6d77fafce42b27dd7aaf272cf37d84f0401b052cc87d538549fd3a30a08b8c4896cc7056c8bd21f80112ff0c05328164010300b13bbf693bcb02e3d7cf712242f36a831b3de9505f4beeb2fe21c91eb35	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tyvyqqoobxywt\3afe910a = 95dc140e7c78aaf3095101ab7b397e9be0f60c353dd66b69520d642e4f088e9948cb942f79dc97748b364a1ae172c0ff495d7711d15b7d6f7abf8734019a0ca84716079af589d4adce136437909bc07b2ea7d61ba875cf5978d1bb0af037973e0cfdc22497d9243175	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tyvyqqoobxywt\d206138 = c7b242f1237c48d09636b5adf7fd3e0e0975d43e3b625a77b9a4bbb7cfe4bb10764066c9d091ae043d80d6b110e69420786e6572ce14b3c328f265fe623518935e83e0bc6358ffae529d0ac8d1ff76d5eae89ae262dd6121b40edd10691a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tyvyqqoobxywt\b59c065d = 23231d93eddced2eaf3665903526a9735fc5476b5f2354b84565c080e5e9c48d0d4245	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tyvyqqoobxywt\70282eb2 = 79f655e301c13625cbd3ef0917278ecf8d8480bd683f901c21dfb4f75edb3934fad6dd38a018bc2ac92a36	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tyvyqqoobxywt\b7dd2621 = df81fb8b59aa1677a9b79261d9244ccf9563c144a9e4b3bb5853dcd9baeb0b655dd78a99e02c7b4b1ad5f865d1ce8f0e27	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tyvyqqoobxywt\45b7fefc = e7f1947077a8128bd13e7ecf56e505	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1140 regsvr32.exe
960 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1140 regsvr32.exe
960 regsvr32.exe

pid	process
1140	regsvr32.exe
960	regsvr32.exe

pid	process
1140	regsvr32.exe
960	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1148 wrote to memory of 1140	1148	regsvr32.exe	regsvr32.exe
PID 1148 wrote to memory of 1140	1148	regsvr32.exe	regsvr32.exe
PID 1148 wrote to memory of 1140	1148	regsvr32.exe	regsvr32.exe
PID 1148 wrote to memory of 1140	1148	regsvr32.exe	regsvr32.exe
PID 1148 wrote to memory of 1140	1148	regsvr32.exe	regsvr32.exe
PID 1148 wrote to memory of 1140	1148	regsvr32.exe	regsvr32.exe
PID 1148 wrote to memory of 1140	1148	regsvr32.exe	regsvr32.exe
PID 1140 wrote to memory of 524	1140	regsvr32.exe	explorer.exe
PID 1140 wrote to memory of 524	1140	regsvr32.exe	explorer.exe
PID 1140 wrote to memory of 524	1140	regsvr32.exe	explorer.exe
PID 1140 wrote to memory of 524	1140	regsvr32.exe	explorer.exe
PID 1140 wrote to memory of 524	1140	regsvr32.exe	explorer.exe
PID 1140 wrote to memory of 524	1140	regsvr32.exe	explorer.exe
PID 524 wrote to memory of 568	524	explorer.exe	schtasks.exe
PID 524 wrote to memory of 568	524	explorer.exe	schtasks.exe
PID 524 wrote to memory of 568	524	explorer.exe	schtasks.exe
PID 524 wrote to memory of 568	524	explorer.exe	schtasks.exe
PID 1492 wrote to memory of 736	1492	taskeng.exe	regsvr32.exe
PID 1492 wrote to memory of 736	1492	taskeng.exe	regsvr32.exe
PID 1492 wrote to memory of 736	1492	taskeng.exe	regsvr32.exe
PID 1492 wrote to memory of 736	1492	taskeng.exe	regsvr32.exe
PID 1492 wrote to memory of 736	1492	taskeng.exe	regsvr32.exe
PID 736 wrote to memory of 960	736	regsvr32.exe	regsvr32.exe
PID 736 wrote to memory of 960	736	regsvr32.exe	regsvr32.exe
PID 736 wrote to memory of 960	736	regsvr32.exe	regsvr32.exe
PID 736 wrote to memory of 960	736	regsvr32.exe	regsvr32.exe
PID 736 wrote to memory of 960	736	regsvr32.exe	regsvr32.exe
PID 736 wrote to memory of 960	736	regsvr32.exe	regsvr32.exe
PID 736 wrote to memory of 960	736	regsvr32.exe	regsvr32.exe
PID 960 wrote to memory of 1612	960	regsvr32.exe	explorer.exe
PID 960 wrote to memory of 1612	960	regsvr32.exe	explorer.exe
PID 960 wrote to memory of 1612	960	regsvr32.exe	explorer.exe
PID 960 wrote to memory of 1612	960	regsvr32.exe	explorer.exe
PID 960 wrote to memory of 1612	960	regsvr32.exe	explorer.exe
PID 960 wrote to memory of 1612	960	regsvr32.exe	explorer.exe
PID 1612 wrote to memory of 1700	1612	explorer.exe	reg.exe
PID 1612 wrote to memory of 1700	1612	explorer.exe	reg.exe
PID 1612 wrote to memory of 1700	1612	explorer.exe	reg.exe
PID 1612 wrote to memory of 1700	1612	explorer.exe	reg.exe
PID 1612 wrote to memory of 1736	1612	explorer.exe	reg.exe
PID 1612 wrote to memory of 1736	1612	explorer.exe	reg.exe
PID 1612 wrote to memory of 1736	1612	explorer.exe	reg.exe
PID 1612 wrote to memory of 1736	1612	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1140

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:524

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yuobqrnez /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll\"" /SC ONCE /Z /ST 14:38 /ET 14:50
4⤵
- Creates scheduled task(s)
PID:568

C:\Windows\system32\taskeng.exe
taskeng.exe {9F817477-FF36-4DED-82AA-5F0F3DC37D3A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:736

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Xyedzmnquepy" /d "0"
5⤵
PID:1700

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ikbyjsoihb" /d "0"
5⤵
PID:1736

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll
MD5
cccab2984ff316a36630e869282d8189

SHA1
24201f608110ae4d54a840e3af9490ea96091cb5

SHA256
a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6

SHA512
bf332287aee1dbaa813dc8ed12a7a362d8e1b2a57455e2609fe720658415cc417fd938aab69a30962cc74b777ab06a6707f306ec1f019e7dac5d2b5e59da4742

Download Submit
\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll
MD5
cccab2984ff316a36630e869282d8189

SHA1
24201f608110ae4d54a840e3af9490ea96091cb5

SHA256
a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6

SHA512
bf332287aee1dbaa813dc8ed12a7a362d8e1b2a57455e2609fe720658415cc417fd938aab69a30962cc74b777ab06a6707f306ec1f019e7dac5d2b5e59da4742

Download Submit
memory/524-59-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/524-61-0x0000000074B61000-0x0000000074B63000-memory.dmp

Filesize
8KB

Download
memory/524-62-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/960-70-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1140-56-0x0000000076511000-0x0000000076513000-memory.dmp

Filesize
8KB

Download
memory/1140-57-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1140-58-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/1148-55-0x000007FEFC151000-0x000007FEFC153000-memory.dmp

Filesize
8KB

Download
memory/1612-71-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads