qakbot | a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6

General

Target

a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll
Size

541KB
MD5

cccab2984ff316a36630e869282d8189
SHA1

24201f608110ae4d54a840e3af9490ea96091cb5
SHA256

a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6
SHA512

bf332287aee1dbaa813dc8ed12a7a362d8e1b2a57455e2609fe720658415cc417fd938aab69a30962cc74b777ab06a6707f306ec1f019e7dac5d2b5e59da4742

Score

10^/10

qakbot tr 1643025272 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

tr

Campaign

1643025272

C2

103.143.8.71:6881

37.210.172.200:2222

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

82.152.39.39:443

65.100.174.110:995

65.100.174.110:443

111.125.245.116:995

117.248.109.38:21

31.215.99.178:443

103.142.10.177:443

39.49.110.129:995

86.97.246.244:1194

68.204.7.158:443

217.128.93.27:2222

144.86.28.125:443

94.59.253.222:2222

120.150.218.241:995

185.249.85.209:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1720 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

564 schtasks.exe

pid	process
1720	regsvr32.exe

pid	process
564	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edsdbcb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Edsdbcb\e66a39de = c12d062eecd9f77034628001f8c2c834384f17c9a38b33157e815089f321f5d6d9940dbc7fe93a5b22e8d329b4d6b15aaa88d050a73219aab7af8facfa5da09f6c37a3816362c61e6a8ea15cbfd7d004218cf18a015c17742c54724649aa95579c50a4cb56f6d43aef117bfb8ab36b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Edsdbcb\e42b19a2 = 233a00769ca41213d5590d903fde05b62f2cdd24e9b09d2745f4c60912d328bc54d235f6ce2d1e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Edsdbcb\99235628 = 4271e16b2f94f8b1a03182bd8eb754f46338f74ad40322fcce96aafdecabba0bfc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Edsdbcb\5ed65ebb = e3a35099a7f8797ffee2e1c82e56484611eadba1653e5a4e44364ef2c48e96cf3689b80e39c8946c50453d1b03c97dbc67bd574a2356bd921732ec9edc74b5adf1e0d323728fae2a6b83371a275ef0e96530fe186d4ac96333762469780fa130bb4dbba050ec688fffedf6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Edsdbcb\d3f5e990 = 079934a68028a72d6a3ca0018eb36622dad3d036cdcd5f0b5931e008661d60316e02d2111c106409bcbca64bd04f3cab2d19c7a7ed29cfde228763f22b50275ac7046df3341b08cc4744b3c2dd66e0bc62f2e95ca733e1861ffcf2a9226290	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Edsdbcb\5c977ec7 = 40f62bbefa688e44cdebb6249baa30abc4479f6b19a32aa2c613a51bab92	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Edsdbcb\219f314d = 2dfe71228a6821dfbbc662f2d036163c9c1cfdf67c0b7993ca0ef813de976edb3464eeb807d31dfea7304b2dfd702326dea966aa0d3579387707f5d40fa14fb762af	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Edsdbcb\acbc8666 = 92a272623e0595b0d1971b554a8747e0e70c5abfe57bd77a5f50afb5bf7dd8bbaf5e05204c9c37afbd4fef299935c449949133328e8ad5e2eb5b650ed9c84b19a5bd5f4782fa082f8fffc822d0b1ac606d4b9691c4e3feab00fdc63cde85f27fb0d48de5f5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Edsdbcb\d3f5e990 = 079923a680289215bdc9e83b0c376358c5e796fb36796003cbf3c729d60648dee11afa90ed072798350acf4414fe6047b46de30799f1e5d2981a9f30269cd3fca2798c429e8295b561d9e3501a18587a6231e7553e8366719bf5fa4f7d8f0df5ba77d7af48a92b40e3c34f3c1b6b6f58bb677290	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1612 regsvr32.exe
1720 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1612 regsvr32.exe
1720 regsvr32.exe

pid	process
1612	regsvr32.exe
1720	regsvr32.exe

pid	process
1612	regsvr32.exe
1720	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1756 wrote to memory of 1612	1756	regsvr32.exe	regsvr32.exe
PID 1756 wrote to memory of 1612	1756	regsvr32.exe	regsvr32.exe
PID 1756 wrote to memory of 1612	1756	regsvr32.exe	regsvr32.exe
PID 1756 wrote to memory of 1612	1756	regsvr32.exe	regsvr32.exe
PID 1756 wrote to memory of 1612	1756	regsvr32.exe	regsvr32.exe
PID 1756 wrote to memory of 1612	1756	regsvr32.exe	regsvr32.exe
PID 1756 wrote to memory of 1612	1756	regsvr32.exe	regsvr32.exe
PID 1612 wrote to memory of 268	1612	regsvr32.exe	explorer.exe
PID 1612 wrote to memory of 268	1612	regsvr32.exe	explorer.exe
PID 1612 wrote to memory of 268	1612	regsvr32.exe	explorer.exe
PID 1612 wrote to memory of 268	1612	regsvr32.exe	explorer.exe
PID 1612 wrote to memory of 268	1612	regsvr32.exe	explorer.exe
PID 1612 wrote to memory of 268	1612	regsvr32.exe	explorer.exe
PID 268 wrote to memory of 564	268	explorer.exe	schtasks.exe
PID 268 wrote to memory of 564	268	explorer.exe	schtasks.exe
PID 268 wrote to memory of 564	268	explorer.exe	schtasks.exe
PID 268 wrote to memory of 564	268	explorer.exe	schtasks.exe
PID 1180 wrote to memory of 1724	1180	taskeng.exe	regsvr32.exe
PID 1180 wrote to memory of 1724	1180	taskeng.exe	regsvr32.exe
PID 1180 wrote to memory of 1724	1180	taskeng.exe	regsvr32.exe
PID 1180 wrote to memory of 1724	1180	taskeng.exe	regsvr32.exe
PID 1180 wrote to memory of 1724	1180	taskeng.exe	regsvr32.exe
PID 1724 wrote to memory of 1720	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1720	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1720	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1720	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1720	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1720	1724	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1720	1724	regsvr32.exe	regsvr32.exe
PID 1720 wrote to memory of 1600	1720	regsvr32.exe	explorer.exe
PID 1720 wrote to memory of 1600	1720	regsvr32.exe	explorer.exe
PID 1720 wrote to memory of 1600	1720	regsvr32.exe	explorer.exe
PID 1720 wrote to memory of 1600	1720	regsvr32.exe	explorer.exe
PID 1720 wrote to memory of 1600	1720	regsvr32.exe	explorer.exe
PID 1720 wrote to memory of 1600	1720	regsvr32.exe	explorer.exe
PID 1600 wrote to memory of 1848	1600	explorer.exe	reg.exe
PID 1600 wrote to memory of 1848	1600	explorer.exe	reg.exe
PID 1600 wrote to memory of 1848	1600	explorer.exe	reg.exe
PID 1600 wrote to memory of 1848	1600	explorer.exe	reg.exe
PID 1600 wrote to memory of 1824	1600	explorer.exe	reg.exe
PID 1600 wrote to memory of 1824	1600	explorer.exe	reg.exe
PID 1600 wrote to memory of 1824	1600	explorer.exe	reg.exe
PID 1600 wrote to memory of 1824	1600	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn gxgshqqrw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll\"" /SC ONCE /Z /ST 17:13 /ET 17:25
4⤵
- Creates scheduled task(s)
PID:564

C:\Windows\system32\taskeng.exe
taskeng.exe {8DE724AB-4B15-4F85-8D9C-E5C58E7D6869} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Evihkbazgpw" /d "0"
5⤵
PID:1848

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Zltttb" /d "0"
5⤵
PID:1824

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll
MD5
cccab2984ff316a36630e869282d8189

SHA1
24201f608110ae4d54a840e3af9490ea96091cb5

SHA256
a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6

SHA512
bf332287aee1dbaa813dc8ed12a7a362d8e1b2a57455e2609fe720658415cc417fd938aab69a30962cc74b777ab06a6707f306ec1f019e7dac5d2b5e59da4742

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll
MD5
cccab2984ff316a36630e869282d8189

SHA1
24201f608110ae4d54a840e3af9490ea96091cb5

SHA256
a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6

SHA512
bf332287aee1dbaa813dc8ed12a7a362d8e1b2a57455e2609fe720658415cc417fd938aab69a30962cc74b777ab06a6707f306ec1f019e7dac5d2b5e59da4742

Download Submit
memory/268-59-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/268-61-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download
memory/268-62-0x00000000000E0000-0x0000000000101000-memory.dmp

Filesize
132KB

Download
memory/1600-72-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1612-56-0x00000000769D1000-0x00000000769D3000-memory.dmp

Filesize
8KB

Download
memory/1612-57-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1612-58-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/1720-67-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1756-55-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads