qakbot | 576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80

General

Target

576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80.dll
Size

542KB
MD5

95fb7a5785e55959ebd1f8783640e491
SHA1

021db3fcf016a75f1b8a087732b04e6dbc3e5d56
SHA256

576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80
SHA512

037608eb16306e5716ff75f99dcd8850f5d80d0419e9ac6d466be30f14cdea5afc02a112a4fe9a63b481149640c73f9691a89124a2417a2d5ce164959f8523a1

Score

10^/10

qakbot tr 1643025272 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

tr

Campaign

1643025272

C2

103.143.8.71:6881

37.210.172.200:2222

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

82.152.39.39:443

65.100.174.110:995

65.100.174.110:443

111.125.245.116:995

117.248.109.38:21

31.215.99.178:443

103.142.10.177:443

39.49.110.129:995

86.97.246.244:1194

68.204.7.158:443

217.128.93.27:2222

144.86.28.125:443

94.59.253.222:2222

120.150.218.241:995

185.249.85.209:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

400 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1328 schtasks.exe

pid	process
400	regsvr32.exe

pid	process
1328	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owhkyai\531498a2 = e36787ee47a66f9752b496f03f4459af1928ed7c7c26eeddbe698ea3a150388214074d9e6277f82eed244287195f2b7ab44bdc0f8d2f3c748c97f7882ef2cfa05b9ad69fa764b0ce16c7c20569bdc5c7b6b074b961702e7be4609230ec30fc76	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owhkyai\eba8ffc7 = 9f739e10ef6dc31bab76c778093a0b46bfa5b966518532ecf79cade00d596e85d66c01fd1268447d931c3760fc292931c72237b8b69631053429daecaa44bb732537afe0401b2b5a2c380ec1a66629ff21d43ea2c9ee917c163698c7560fbe4b83603c3e43479f4c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owhkyai\de372f89 = 497603062b1f2c17c7bdf9c1c57547e8a0e9	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owhkyai	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owhkyai\96a0b04d = 920af104a44c536b7070ef57adc1679f4648648a86d8efa37c141cf8572c1d94dd7840	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owhkyai\2e1cd728 = 7a187ed2e6f7b77f1e86a827666a5746715da25b98583377dc917bff4cbb230d3405df161abe961e2bc331d752ade7c6852791d303520acfa8cd06ba0ce3dad7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owhkyai\2c5df754 = 790771365d9084b302154429d68710deba357ba3b1d0dde6629d0789a4b523bb8dd7e31a336e8f9aced8cded49991a875d89a86a6bca87f93eb26c228d8dbac56aace94740a70c3f32d55a7525d5622415f6d765fc526241	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owhkyai\a17e407f = f820d12d6d9596aaa037093e669023e85033e7ae865f6dade2ce0bb8df8f81a5f80927fecee0797c7e4cef29a7c64b3bee7f0ee64c4ae1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owhkyai\a17e407f = f820c62d6d95a3a50f78267ee6d6dd56b9d07ba4ff3f96a0ded367b9031ee636d0e3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Owhkyai\94e19031 = c6edcfaf64f1b9e834fee042db08d6a3775c2871a708a132443450d3d132b5528f589b1814abb4776bbe9c9d95b6caed9e63d4490821604f76aec54465e0c1c1d82b7bc5d3b53ffd4ec7f8c81a4774059ba19ccb21a9b2238318a1f52340a2004ec0f49a55581de674715da248c9389169bd4fe3c24ed3573227f99dee73761748bd14753d94e934284f	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2828 regsvr32.exe
2828 regsvr32.exe
400 regsvr32.exe
400 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2828 regsvr32.exe
400 regsvr32.exe

pid	process
2828	regsvr32.exe
2828	regsvr32.exe
400	regsvr32.exe
400	regsvr32.exe

pid	process
2828	regsvr32.exe
400	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2776 wrote to memory of 2828	2776	regsvr32.exe	regsvr32.exe
PID 2776 wrote to memory of 2828	2776	regsvr32.exe	regsvr32.exe
PID 2776 wrote to memory of 2828	2776	regsvr32.exe	regsvr32.exe
PID 2828 wrote to memory of 3156	2828	regsvr32.exe	explorer.exe
PID 2828 wrote to memory of 3156	2828	regsvr32.exe	explorer.exe
PID 2828 wrote to memory of 3156	2828	regsvr32.exe	explorer.exe
PID 2828 wrote to memory of 3156	2828	regsvr32.exe	explorer.exe
PID 2828 wrote to memory of 3156	2828	regsvr32.exe	explorer.exe
PID 3156 wrote to memory of 1328	3156	explorer.exe	schtasks.exe
PID 3156 wrote to memory of 1328	3156	explorer.exe	schtasks.exe
PID 3156 wrote to memory of 1328	3156	explorer.exe	schtasks.exe
PID 680 wrote to memory of 400	680	regsvr32.exe	regsvr32.exe
PID 680 wrote to memory of 400	680	regsvr32.exe	regsvr32.exe
PID 680 wrote to memory of 400	680	regsvr32.exe	regsvr32.exe
PID 400 wrote to memory of 2852	400	regsvr32.exe	explorer.exe
PID 400 wrote to memory of 2852	400	regsvr32.exe	explorer.exe
PID 400 wrote to memory of 2852	400	regsvr32.exe	explorer.exe
PID 400 wrote to memory of 2852	400	regsvr32.exe	explorer.exe
PID 400 wrote to memory of 2852	400	regsvr32.exe	explorer.exe
PID 2852 wrote to memory of 1088	2852	explorer.exe	reg.exe
PID 2852 wrote to memory of 1088	2852	explorer.exe	reg.exe
PID 2852 wrote to memory of 896	2852	explorer.exe	reg.exe
PID 2852 wrote to memory of 896	2852	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2776

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2828

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3156

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn brmpxjchiq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80.dll\"" /SC ONCE /Z /ST 16:58 /ET 17:10
4⤵
- Creates scheduled task(s)
PID:1328

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:400

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2852

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Hhixpbjd" /d "0"
4⤵
PID:1088

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Mgekiyploxmi" /d "0"
4⤵
PID:896

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80.dll
MD5
95fb7a5785e55959ebd1f8783640e491

SHA1
021db3fcf016a75f1b8a087732b04e6dbc3e5d56

SHA256
576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80

SHA512
037608eb16306e5716ff75f99dcd8850f5d80d0419e9ac6d466be30f14cdea5afc02a112a4fe9a63b481149640c73f9691a89124a2417a2d5ce164959f8523a1

Download Submit
\Users\Admin\AppData\Local\Temp\576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80.dll
MD5
95fb7a5785e55959ebd1f8783640e491

SHA1
021db3fcf016a75f1b8a087732b04e6dbc3e5d56

SHA256
576dc48b1a4f26b779efe36ca94f2bfcb4812954063ade5f16854d4145626d80

SHA512
037608eb16306e5716ff75f99dcd8850f5d80d0419e9ac6d466be30f14cdea5afc02a112a4fe9a63b481149640c73f9691a89124a2417a2d5ce164959f8523a1

Download Submit
memory/400-122-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/2828-115-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/2828-116-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/2852-125-0x00000000001A0000-0x00000000001C1000-memory.dmp

Filesize
132KB

Download
memory/3156-119-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads