qakbot | bfb96ce10b830f0be6ea2a3a29f60fd59f22fcf7ab274c76bb28911ba94ce506

General

Target

bfb96ce10b830f0be6ea2a3a29f60fd59f22fcf7ab274c76bb28911ba94ce506.dll
Size

523KB
MD5

cba21007f8686c66d424f0326913536c
SHA1

dad5b7f080c8a79a03ae65946078dff7cca7253f
SHA256

bfb96ce10b830f0be6ea2a3a29f60fd59f22fcf7ab274c76bb28911ba94ce506
SHA512

6ca040e5bb59f512f80456726702cd44fcf4479de1bd689b6b8d1e7f43107a5fd5ed39c26ad7a245b1a2d83d49f78aa0fbc877e2e5d64859de5e91653faeeff2

Score

10^/10

qakbot tr 1643025272 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

tr

Campaign

1643025272

C2

103.143.8.71:6881

37.210.172.200:2222

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

82.152.39.39:443

65.100.174.110:995

65.100.174.110:443

111.125.245.116:995

117.248.109.38:21

31.215.99.178:443

103.142.10.177:443

39.49.110.129:995

86.97.246.244:1194

68.204.7.158:443

217.128.93.27:2222

144.86.28.125:443

94.59.253.222:2222

120.150.218.241:995

185.249.85.209:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2864 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2156 schtasks.exe

pid	process
2864	regsvr32.exe

pid	process
2156	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yrwhgzsreym	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yrwhgzsreym\d78f0ded = b73e3585450567b093e3003786648b5f08	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yrwhgzsreym\6f336a88 = 79afc86f2e5ed57a480ea0b3d36a2c8b91f6d150dedd36b622a7e8e10f262fdd3102ac5baf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yrwhgzsreym\123b2502 = 877376aaf7fa3af534485d236f22ce4605441881b08ae212d6dc42794b93c0afae3272dd7b30	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yrwhgzsreym\e051fddf = c03ae404f30e075ce49491e3efe5880a1328aa214147badc7746ef5d7af9231df9a026590d7edf97858b2ac1c8a6b950cb3e11c5d37eb517165854b4af1db50ecc7cbcc5c3fa99adc6fc5200b9f7dee7afe8fa7b820b615cf023fecb08e16ef0c1ae166bbda9b4727c735068a2d46ed3c018fd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yrwhgzsreym\e051fddf = c03af304f30e3246d70048427215dc5d367d3f6b6b97b911fc2d18472c6aac7f00fc02eab6f1ebcd9e27873f6f2126aa51f4434678d0628f25869250083dc7d8639bfff005d1d10007382509afbab6750e8ef99fc7fa053dece7004d2a7f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yrwhgzsreym\d5ce2d91 = 9944aca5a35161be0c643770d62e51a62da68b19e01b3fe01c36bc045c3f0bfeb22a730792a45d7cbb0e2a595ca41b5802c9bcfb9c982999291ac8100635011a90bf3148efb3a1e97666c088dc3b0a719d293d52e3e87ea8f254ab837c3b39250d4883f95d04530521ac6306040ad4cff159b1942781b4034f92ef05446a268d6e57	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yrwhgzsreym\aa874267 = 2300381888f2808da75832569e18a7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yrwhgzsreym\6d724af4 = 2ea8631c9da03fd8b7b2145b40b1459d9795e9b82d2fb62327603d03f3491096f1b148ca4e51184d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Yrwhgzsreym\9f189229 = ff184c230e98bf7e3cdeefaf4789541b607bdaaf3def6ed0fbb4edcfb2d64383f100129de01466d66c18c6e781f49671740fc05d1de2e2bae2f7872f6c0a1f16b5b382ba812c158ecffd92c06f8137e42279f464d704693e	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2628 regsvr32.exe
2628 regsvr32.exe
2864 regsvr32.exe
2864 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2628 regsvr32.exe
2864 regsvr32.exe

pid	process
2628	regsvr32.exe
2628	regsvr32.exe
2864	regsvr32.exe
2864	regsvr32.exe

pid	process
2628	regsvr32.exe
2864	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 660 wrote to memory of 2628	660	regsvr32.exe	regsvr32.exe
PID 660 wrote to memory of 2628	660	regsvr32.exe	regsvr32.exe
PID 660 wrote to memory of 2628	660	regsvr32.exe	regsvr32.exe
PID 2628 wrote to memory of 2072	2628	regsvr32.exe	explorer.exe
PID 2628 wrote to memory of 2072	2628	regsvr32.exe	explorer.exe
PID 2628 wrote to memory of 2072	2628	regsvr32.exe	explorer.exe
PID 2628 wrote to memory of 2072	2628	regsvr32.exe	explorer.exe
PID 2628 wrote to memory of 2072	2628	regsvr32.exe	explorer.exe
PID 2072 wrote to memory of 2156	2072	explorer.exe	schtasks.exe
PID 2072 wrote to memory of 2156	2072	explorer.exe	schtasks.exe
PID 2072 wrote to memory of 2156	2072	explorer.exe	schtasks.exe
PID 1064 wrote to memory of 2864	1064	regsvr32.exe	regsvr32.exe
PID 1064 wrote to memory of 2864	1064	regsvr32.exe	regsvr32.exe
PID 1064 wrote to memory of 2864	1064	regsvr32.exe	regsvr32.exe
PID 2864 wrote to memory of 3156	2864	regsvr32.exe	explorer.exe
PID 2864 wrote to memory of 3156	2864	regsvr32.exe	explorer.exe
PID 2864 wrote to memory of 3156	2864	regsvr32.exe	explorer.exe
PID 2864 wrote to memory of 3156	2864	regsvr32.exe	explorer.exe
PID 2864 wrote to memory of 3156	2864	regsvr32.exe	explorer.exe
PID 3156 wrote to memory of 3868	3156	explorer.exe	reg.exe
PID 3156 wrote to memory of 3868	3156	explorer.exe	reg.exe
PID 3156 wrote to memory of 616	3156	explorer.exe	reg.exe
PID 3156 wrote to memory of 616	3156	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bfb96ce10b830f0be6ea2a3a29f60fd59f22fcf7ab274c76bb28911ba94ce506.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:660

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\bfb96ce10b830f0be6ea2a3a29f60fd59f22fcf7ab274c76bb28911ba94ce506.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2628

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kgsbkezzp /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\bfb96ce10b830f0be6ea2a3a29f60fd59f22fcf7ab274c76bb28911ba94ce506.dll\"" /SC ONCE /Z /ST 12:04 /ET 12:16
4⤵
- Creates scheduled task(s)
PID:2156

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\bfb96ce10b830f0be6ea2a3a29f60fd59f22fcf7ab274c76bb28911ba94ce506.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\bfb96ce10b830f0be6ea2a3a29f60fd59f22fcf7ab274c76bb28911ba94ce506.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3156

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Amecxox" /d "0"
4⤵
PID:3868

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Aoiihvvolvjp" /d "0"
4⤵
PID:616

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bfb96ce10b830f0be6ea2a3a29f60fd59f22fcf7ab274c76bb28911ba94ce506.dll
MD5
cba21007f8686c66d424f0326913536c

SHA1
dad5b7f080c8a79a03ae65946078dff7cca7253f

SHA256
bfb96ce10b830f0be6ea2a3a29f60fd59f22fcf7ab274c76bb28911ba94ce506

SHA512
6ca040e5bb59f512f80456726702cd44fcf4479de1bd689b6b8d1e7f43107a5fd5ed39c26ad7a245b1a2d83d49f78aa0fbc877e2e5d64859de5e91653faeeff2

Download Submit
\Users\Admin\AppData\Local\Temp\bfb96ce10b830f0be6ea2a3a29f60fd59f22fcf7ab274c76bb28911ba94ce506.dll
MD5
cba21007f8686c66d424f0326913536c

SHA1
dad5b7f080c8a79a03ae65946078dff7cca7253f

SHA256
bfb96ce10b830f0be6ea2a3a29f60fd59f22fcf7ab274c76bb28911ba94ce506

SHA512
6ca040e5bb59f512f80456726702cd44fcf4479de1bd689b6b8d1e7f43107a5fd5ed39c26ad7a245b1a2d83d49f78aa0fbc877e2e5d64859de5e91653faeeff2

Download Submit
memory/2072-119-0x0000000000900000-0x0000000000921000-memory.dmp

Filesize
132KB

Download
memory/2628-115-0x0000000000C00000-0x0000000000CAE000-memory.dmp

Filesize
696KB

Download
memory/2628-116-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/2864-122-0x0000000000510000-0x000000000065A000-memory.dmp

Filesize
1.3MB

Download
memory/3156-125-0x0000000000330000-0x0000000000351000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads