qakbot | 3de6eaa85150e4a73732d4307c39106140486909ecfb0b489b3c2664c76c8694

General

Target

cen1.dll
Size

548KB
MD5

da731fc040edee0c31bfe7b02ead89a5
SHA1

abb40ce2801801fe50daea5339ae4b1453a41b86
SHA256

3de6eaa85150e4a73732d4307c39106140486909ecfb0b489b3c2664c76c8694
SHA512

6d6faa49461a89a86f16110a2ad68f233ee193c0a3c69f907b445991bc23a3ef257eaeca558e0996fd3635601011b61931daed59ac43cf5522adc14954b63077

Score

10^/10

qakbot tr 1643025272 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

tr

Campaign

1643025272

C2

103.143.8.71:6881

37.210.172.200:2222

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

82.152.39.39:443

65.100.174.110:995

65.100.174.110:443

111.125.245.116:995

117.248.109.38:21

31.215.99.178:443

103.142.10.177:443

39.49.110.129:995

86.97.246.244:1194

68.204.7.158:443

217.128.93.27:2222

144.86.28.125:443

94.59.253.222:2222

120.150.218.241:995

185.249.85.209:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1360 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

112 schtasks.exe

pid	process
1360	regsvr32.exe

pid	process
112	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jpaeplwl\16114ad4 = 9ac7d68b94390bc3af48a5006ce3dc1cfafed42c4c15b7901ace381a8baea52a0fc6377f082c3a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jpaeplwl\d3a5623b = 21a6a958dffcd1e9d04a94e36caeff558a3c24be65a218bd723c8a29f4cf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jpaeplwl\5e86d510 = bc893ea8b8d1b7cf5387660c4c312f7673e521e45c3f0ce7ce1466928d90fec87f88989b7b9aa93cefa9911921b76c18e7a92f19a24df7cc6d4c07b29f2455411da258d63c05311e264e63daa1a897bc00bcbf0124b58ec6596cf31b9a1a23e0259ab50c81d0708c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jpaeplwl\21cfbae6 = 0a6a2bdf3fba966928fe08663f4df0c72baad5b09045051b62212e394d9ce9e02d65f442c5c8f8f22c7bb70e2ffae511d3d48e718e383982055789fdb266ea698abbbae0ee01fe	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jpaeplwl	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jpaeplwl\21cfbae6 = 0a6a3cdf3fbaa3173a2ec84df69986fa67138184f065a4142039c94bc787ad2b7b6ce74f0baf0027b3724d6236a5bb931c3d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jpaeplwl\14506aa8 = 2716c7fa4bf53efb5e173fdef6d6a86556375c0804ad99efdce5eaf9ffa511019105457122a71545eba4f9973c7f9bc78c0d11b46ff071e9aedce8c022d912d7967a2503175ece7f572f2cf4ebb787b34e4e046e36a38ae70ccfceff1e4af3e71e01e088bb1a6aabd71965107ea1618e8a3684373da1e05ef475116e0f2ceec46932b5bef0fda07a1042f2500740171d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jpaeplwl\aead2db1 = 6a454468aed5b366666a0cf4dbcd8304190493f68bcbbfa592a7a6e9da8d5b61e13e543029871ec2bfa5ba61b03e8110	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jpaeplwl\6b19055e = 902606c419ef133737e03e7b886579707e9ab3adedc9b55c1596ba017061e991d287589d03003bea972fb23fd356	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jpaeplwl\acec0dcd = 55bb20dc185e250eee5013daa6c1a16d26aee5fe8c870b57bbd30a37bdd8d575e33283771dc2be42ee900a70b8	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1416 regsvr32.exe
1360 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1416 regsvr32.exe
1360 regsvr32.exe

pid	process
1416	regsvr32.exe
1360	regsvr32.exe

pid	process
1416	regsvr32.exe
1360	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1572 wrote to memory of 1416	1572	regsvr32.exe	regsvr32.exe
PID 1572 wrote to memory of 1416	1572	regsvr32.exe	regsvr32.exe
PID 1572 wrote to memory of 1416	1572	regsvr32.exe	regsvr32.exe
PID 1572 wrote to memory of 1416	1572	regsvr32.exe	regsvr32.exe
PID 1572 wrote to memory of 1416	1572	regsvr32.exe	regsvr32.exe
PID 1572 wrote to memory of 1416	1572	regsvr32.exe	regsvr32.exe
PID 1572 wrote to memory of 1416	1572	regsvr32.exe	regsvr32.exe
PID 1416 wrote to memory of 1224	1416	regsvr32.exe	explorer.exe
PID 1416 wrote to memory of 1224	1416	regsvr32.exe	explorer.exe
PID 1416 wrote to memory of 1224	1416	regsvr32.exe	explorer.exe
PID 1416 wrote to memory of 1224	1416	regsvr32.exe	explorer.exe
PID 1416 wrote to memory of 1224	1416	regsvr32.exe	explorer.exe
PID 1416 wrote to memory of 1224	1416	regsvr32.exe	explorer.exe
PID 1224 wrote to memory of 112	1224	explorer.exe	schtasks.exe
PID 1224 wrote to memory of 112	1224	explorer.exe	schtasks.exe
PID 1224 wrote to memory of 112	1224	explorer.exe	schtasks.exe
PID 1224 wrote to memory of 112	1224	explorer.exe	schtasks.exe
PID 1100 wrote to memory of 1832	1100	taskeng.exe	regsvr32.exe
PID 1100 wrote to memory of 1832	1100	taskeng.exe	regsvr32.exe
PID 1100 wrote to memory of 1832	1100	taskeng.exe	regsvr32.exe
PID 1100 wrote to memory of 1832	1100	taskeng.exe	regsvr32.exe
PID 1100 wrote to memory of 1832	1100	taskeng.exe	regsvr32.exe
PID 1832 wrote to memory of 1360	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1360	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1360	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1360	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1360	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1360	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 1360	1832	regsvr32.exe	regsvr32.exe
PID 1360 wrote to memory of 1304	1360	regsvr32.exe	explorer.exe
PID 1360 wrote to memory of 1304	1360	regsvr32.exe	explorer.exe
PID 1360 wrote to memory of 1304	1360	regsvr32.exe	explorer.exe
PID 1360 wrote to memory of 1304	1360	regsvr32.exe	explorer.exe
PID 1360 wrote to memory of 1304	1360	regsvr32.exe	explorer.exe
PID 1360 wrote to memory of 1304	1360	regsvr32.exe	explorer.exe
PID 1304 wrote to memory of 1604	1304	explorer.exe	reg.exe
PID 1304 wrote to memory of 1604	1304	explorer.exe	reg.exe
PID 1304 wrote to memory of 1604	1304	explorer.exe	reg.exe
PID 1304 wrote to memory of 1604	1304	explorer.exe	reg.exe
PID 1304 wrote to memory of 1840	1304	explorer.exe	reg.exe
PID 1304 wrote to memory of 1840	1304	explorer.exe	reg.exe
PID 1304 wrote to memory of 1840	1304	explorer.exe	reg.exe
PID 1304 wrote to memory of 1840	1304	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cen1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\cen1.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1224

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jkdjfrdp /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\cen1.dll\"" /SC ONCE /Z /ST 16:04 /ET 16:16
4⤵
- Creates scheduled task(s)
PID:112

C:\Windows\system32\taskeng.exe
taskeng.exe {BCCE1D33-1689-4C6C-8E02-478480DB466F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\cen1.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\cen1.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Oivzyxmmgdi" /d "0"
5⤵
PID:1604

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ivkdbcep" /d "0"
5⤵
PID:1840

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cen1.dll
MD5
da731fc040edee0c31bfe7b02ead89a5

SHA1
abb40ce2801801fe50daea5339ae4b1453a41b86

SHA256
3de6eaa85150e4a73732d4307c39106140486909ecfb0b489b3c2664c76c8694

SHA512
6d6faa49461a89a86f16110a2ad68f233ee193c0a3c69f907b445991bc23a3ef257eaeca558e0996fd3635601011b61931daed59ac43cf5522adc14954b63077

Download Submit
\Users\Admin\AppData\Local\Temp\cen1.dll
MD5
da731fc040edee0c31bfe7b02ead89a5

SHA1
abb40ce2801801fe50daea5339ae4b1453a41b86

SHA256
3de6eaa85150e4a73732d4307c39106140486909ecfb0b489b3c2664c76c8694

SHA512
6d6faa49461a89a86f16110a2ad68f233ee193c0a3c69f907b445991bc23a3ef257eaeca558e0996fd3635601011b61931daed59ac43cf5522adc14954b63077

Download Submit
memory/1224-58-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/1224-60-0x0000000074F21000-0x0000000074F23000-memory.dmp

Filesize
8KB

Download
memory/1224-61-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1304-70-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1360-66-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/1416-55-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/1416-56-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1416-57-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/1572-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads