qakbot | 576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80

General

Target

576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80.dll
Size

542KB
MD5

95fb7a5785e55959ebd1f8783640e491
SHA1

021db3fcf016a75f1b8a087732b04e6dbc3e5d56
SHA256

576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80
SHA512

037608eb16306e5716ff75f99dcd8850f5d80d0419e9ac6d466be30f14cdea5afc02a112a4fe9a63b481149640c73f9691a89124a2417a2d5ce164959f8523a1

Score

10^/10

qakbot tr 1643025272 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

tr

Campaign

1643025272

C2

103.143.8.71:6881

37.210.172.200:2222

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

82.152.39.39:443

65.100.174.110:995

65.100.174.110:443

111.125.245.116:995

117.248.109.38:21

31.215.99.178:443

103.142.10.177:443

39.49.110.129:995

86.97.246.244:1194

68.204.7.158:443

217.128.93.27:2222

144.86.28.125:443

94.59.253.222:2222

120.150.218.241:995

185.249.85.209:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1752 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1136 schtasks.exe

pid	process
1752	regsvr32.exe

pid	process
1136	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ifqshbsyjxub\d25620bb = 411cdd92ea1d9404c68e75cc629f343939ac180a60b57d98a66223f7168737c4953f5e1f7b0860c3a819a1da8fd42ebb2aa6a827538231bd760350ec4559f938e6fb44d8157792bdeb411de375a5ac8f0ea267b032a98f85a92ac1416f0a95ea50ba3fd87aff3b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ifqshbsyjxub\ad1f4f4d = 6e70479980a9eac777a97ae4be04	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ifqshbsyjxub	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ifqshbsyjxub\e7c9f0f5 = f63aae1a4c0be133312fb33598fa07f2c8db4c9f6ec9f6160cd5d2b754ef8948defe41e3bc0e0ad552b2248b6acd5a2f28a76a515e55f142	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ifqshbsyjxub\15a32828 = fe57f56f626b13560209abb160833a0e7c84778c038184c563d3be01d8b77c0041159539c4d1066c78a9cdabebf1fb9221f1f9fcd853d091d2c98d0f23dc789565de8423deeded39b171799f4cd2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ifqshbsyjxub\6aea47de = 81d1f40f3d251139cb8e67ed6f6da4224ad81657316faf35f715cd24e5af2e67eaaaa04fb5b84aee43aa4aa3c41389efd16cb341bec93081	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ifqshbsyjxub\98809f03 = 9b87a9ded3fd13be93244aa242a8c5f2cc2bc9bcf35a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ifqshbsyjxub\e7c9f0f5 = f63ab91a4c0bd43a15f7a22cf30afdd90ee8c7f834f1c80ca3f5197fabfce78e69a320edff0d1815b6b4a7e561e514ce433a6d02b647d138eef2fd23ae31d633db77609d4c780fa4d7093640a0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ifqshbsyjxub\d01700c7 = 6aa4cca094f5921bda23908dcf76ba65d9412688db20f9979492ddd192a900412053b4845889af9a2c40bfe126f1f7ec0c67b19d003dd3062c3d517448929ed980796f9e0f6ffa88f32a1ff9c65aa8e0a11c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ifqshbsyjxub\68ab67a2 = 1fa6ba33db9e36f11c16e2062929df48013b786101fccac32d0471e04469d40fc1b34f2bbe58afc60b95b14222b8f8a3b32c	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1552 regsvr32.exe
1752 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1552 regsvr32.exe
1752 regsvr32.exe

pid	process
1552	regsvr32.exe
1752	regsvr32.exe

pid	process
1552	regsvr32.exe
1752	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1272 wrote to memory of 1552	1272	regsvr32.exe	regsvr32.exe
PID 1272 wrote to memory of 1552	1272	regsvr32.exe	regsvr32.exe
PID 1272 wrote to memory of 1552	1272	regsvr32.exe	regsvr32.exe
PID 1272 wrote to memory of 1552	1272	regsvr32.exe	regsvr32.exe
PID 1272 wrote to memory of 1552	1272	regsvr32.exe	regsvr32.exe
PID 1272 wrote to memory of 1552	1272	regsvr32.exe	regsvr32.exe
PID 1272 wrote to memory of 1552	1272	regsvr32.exe	regsvr32.exe
PID 1552 wrote to memory of 436	1552	regsvr32.exe	explorer.exe
PID 1552 wrote to memory of 436	1552	regsvr32.exe	explorer.exe
PID 1552 wrote to memory of 436	1552	regsvr32.exe	explorer.exe
PID 1552 wrote to memory of 436	1552	regsvr32.exe	explorer.exe
PID 1552 wrote to memory of 436	1552	regsvr32.exe	explorer.exe
PID 1552 wrote to memory of 436	1552	regsvr32.exe	explorer.exe
PID 436 wrote to memory of 1136	436	explorer.exe	schtasks.exe
PID 436 wrote to memory of 1136	436	explorer.exe	schtasks.exe
PID 436 wrote to memory of 1136	436	explorer.exe	schtasks.exe
PID 436 wrote to memory of 1136	436	explorer.exe	schtasks.exe
PID 1760 wrote to memory of 516	1760	taskeng.exe	regsvr32.exe
PID 1760 wrote to memory of 516	1760	taskeng.exe	regsvr32.exe
PID 1760 wrote to memory of 516	1760	taskeng.exe	regsvr32.exe
PID 1760 wrote to memory of 516	1760	taskeng.exe	regsvr32.exe
PID 1760 wrote to memory of 516	1760	taskeng.exe	regsvr32.exe
PID 516 wrote to memory of 1752	516	regsvr32.exe	regsvr32.exe
PID 516 wrote to memory of 1752	516	regsvr32.exe	regsvr32.exe
PID 516 wrote to memory of 1752	516	regsvr32.exe	regsvr32.exe
PID 516 wrote to memory of 1752	516	regsvr32.exe	regsvr32.exe
PID 516 wrote to memory of 1752	516	regsvr32.exe	regsvr32.exe
PID 516 wrote to memory of 1752	516	regsvr32.exe	regsvr32.exe
PID 516 wrote to memory of 1752	516	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1368	1752	regsvr32.exe	explorer.exe
PID 1752 wrote to memory of 1368	1752	regsvr32.exe	explorer.exe
PID 1752 wrote to memory of 1368	1752	regsvr32.exe	explorer.exe
PID 1752 wrote to memory of 1368	1752	regsvr32.exe	explorer.exe
PID 1752 wrote to memory of 1368	1752	regsvr32.exe	explorer.exe
PID 1752 wrote to memory of 1368	1752	regsvr32.exe	explorer.exe
PID 1368 wrote to memory of 268	1368	explorer.exe	reg.exe
PID 1368 wrote to memory of 268	1368	explorer.exe	reg.exe
PID 1368 wrote to memory of 268	1368	explorer.exe	reg.exe
PID 1368 wrote to memory of 268	1368	explorer.exe	reg.exe
PID 1368 wrote to memory of 1724	1368	explorer.exe	reg.exe
PID 1368 wrote to memory of 1724	1368	explorer.exe	reg.exe
PID 1368 wrote to memory of 1724	1368	explorer.exe	reg.exe
PID 1368 wrote to memory of 1724	1368	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:436

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dqfomfohzw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80.dll\"" /SC ONCE /Z /ST 14:38 /ET 14:50
4⤵
- Creates scheduled task(s)
PID:1136

C:\Windows\system32\taskeng.exe
taskeng.exe {A9026602-2E1D-408F-8ECF-95719E97C52A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:516

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Hdngae" /d "0"
5⤵
PID:268

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ikjwbzqeazf" /d "0"
5⤵
PID:1724

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80.dll
MD5
95fb7a5785e55959ebd1f8783640e491

SHA1
021db3fcf016a75f1b8a087732b04e6dbc3e5d56

SHA256
576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80

SHA512
037608eb16306e5716ff75f99dcd8850f5d80d0419e9ac6d466be30f14cdea5afc02a112a4fe9a63b481149640c73f9691a89124a2417a2d5ce164959f8523a1

Download Submit
\Users\Admin\AppData\Local\Temp\576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80.dll
MD5
95fb7a5785e55959ebd1f8783640e491

SHA1
021db3fcf016a75f1b8a087732b04e6dbc3e5d56

SHA256
576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80

SHA512
037608eb16306e5716ff75f99dcd8850f5d80d0419e9ac6d466be30f14cdea5afc02a112a4fe9a63b481149640c73f9691a89124a2417a2d5ce164959f8523a1

Download Submit
memory/436-59-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/436-61-0x0000000073FE1000-0x0000000073FE3000-memory.dmp

Filesize
8KB

Download
memory/436-62-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1272-55-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Filesize
8KB

Download
memory/1368-71-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1552-56-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download
memory/1552-57-0x0000000000170000-0x00000000001F0000-memory.dmp

Filesize
512KB

Download
memory/1552-58-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/1752-67-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads