qakbot | a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6

General

Target

a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll
Size

541KB
MD5

cccab2984ff316a36630e869282d8189
SHA1

24201f608110ae4d54a840e3af9490ea96091cb5
SHA256

a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6
SHA512

bf332287aee1dbaa813dc8ed12a7a362d8e1b2a57455e2609fe720658415cc417fd938aab69a30962cc74b777ab06a6707f306ec1f019e7dac5d2b5e59da4742

Score

10^/10

qakbot tr 1643025272 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

tr

Campaign

1643025272

C2

103.143.8.71:6881

37.210.172.200:2222

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

82.152.39.39:443

65.100.174.110:995

65.100.174.110:443

111.125.245.116:995

117.248.109.38:21

31.215.99.178:443

103.142.10.177:443

39.49.110.129:995

86.97.246.244:1194

68.204.7.158:443

217.128.93.27:2222

144.86.28.125:443

94.59.253.222:2222

120.150.218.241:995

185.249.85.209:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3476 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2160 schtasks.exe

pid	process
3476	regsvr32.exe

pid	process
2160	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pyjqfwasael\a7d245f7 = 25a84322e8863a616eb363fe3d7c2c7a1d78f02ee127845fbf074702fa4b4f24c69f76153ffaeac494100698bd9c07b40164c0914e14b3fe074460ca5795c33d014065f5033328e3400c4788ba	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pyjqfwasael\2af1f2dc = d6072571872317486763fe6ff7b62cfaf2cceab424	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pyjqfwasael\a7d245f7 = 25a85422e8860f90b453e60cf51d1b823a0d89632637d0afff9aa62c40c0532f9b9a193a028ebca70b8359572ada9eabc5ad1b3741d7f8d37594909adb5356b20fbc7dc54f2e7f026cdc349e3e4a283b7b1d7ffe7a063a66e907894bb0735218fd68	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pyjqfwasael	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pyjqfwasael\924d95b9 = 6793b107bf78cd38a52f04a85eba2082b4769b951bdbed7cce658698b30c417c153e55ee14529846f89f9af3b7554e672264520da177fb23ae5ec3b8231d4fe43d85935f16bcbdf8538c23807e4aa356f741b122b564c9a1d185240f26560d16ada15a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pyjqfwasael\900cb5c5 = 5c17ee1ce89d8f09d84bbdf60821	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pyjqfwasael\28b0d2a0 = 82b8c116924c7f42627ee70e3ef9209b5509ba7469ad48163e9939b9a1dbb6b71cb46f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pyjqfwasael\55b89d2a = c657fcea078942d7194c064addac30ac1a874b2cd1611e65e3d2f18334e935eaa079a25ed11dcb98d0d8aaa4d3f6ac02104710f0a772d6ac940d70dad223d256e2c997c150225a035f5e44dd9fa0af59efd1b4b1de31ce9f276f8c91a7b0727e36be6ce64fef2eed3363db356ed0932d0c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pyjqfwasael\ed04fa4f = 0a1fd276630a2def5ad0e569d9b121cbe47030db73fc9fa8a8e5ed0a61ca42a06ce93655685ec6145c3cf275	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pyjqfwasael\d89b2a01 = ba86a7f6cf1c0d0da23a9b99fc56340d217975cf5f4596811681b6ad29aabaa250ff2c991177d84d432d44468b5d29ae5666f15130	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3676 regsvr32.exe
3676 regsvr32.exe
3476 regsvr32.exe
3476 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3676 regsvr32.exe
3476 regsvr32.exe

pid	process
3676	regsvr32.exe
3676	regsvr32.exe
3476	regsvr32.exe
3476	regsvr32.exe

pid	process
3676	regsvr32.exe
3476	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3500 wrote to memory of 3676	3500	regsvr32.exe	regsvr32.exe
PID 3500 wrote to memory of 3676	3500	regsvr32.exe	regsvr32.exe
PID 3500 wrote to memory of 3676	3500	regsvr32.exe	regsvr32.exe
PID 3676 wrote to memory of 1724	3676	regsvr32.exe	explorer.exe
PID 3676 wrote to memory of 1724	3676	regsvr32.exe	explorer.exe
PID 3676 wrote to memory of 1724	3676	regsvr32.exe	explorer.exe
PID 3676 wrote to memory of 1724	3676	regsvr32.exe	explorer.exe
PID 3676 wrote to memory of 1724	3676	regsvr32.exe	explorer.exe
PID 1724 wrote to memory of 2160	1724	explorer.exe	schtasks.exe
PID 1724 wrote to memory of 2160	1724	explorer.exe	schtasks.exe
PID 1724 wrote to memory of 2160	1724	explorer.exe	schtasks.exe
PID 3108 wrote to memory of 3476	3108	regsvr32.exe	regsvr32.exe
PID 3108 wrote to memory of 3476	3108	regsvr32.exe	regsvr32.exe
PID 3108 wrote to memory of 3476	3108	regsvr32.exe	regsvr32.exe
PID 3476 wrote to memory of 4512	3476	regsvr32.exe	explorer.exe
PID 3476 wrote to memory of 4512	3476	regsvr32.exe	explorer.exe
PID 3476 wrote to memory of 4512	3476	regsvr32.exe	explorer.exe
PID 3476 wrote to memory of 4512	3476	regsvr32.exe	explorer.exe
PID 3476 wrote to memory of 4512	3476	regsvr32.exe	explorer.exe
PID 4512 wrote to memory of 3320	4512	explorer.exe	reg.exe
PID 4512 wrote to memory of 3320	4512	explorer.exe	reg.exe
PID 4512 wrote to memory of 612	4512	explorer.exe	reg.exe
PID 4512 wrote to memory of 612	4512	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3500

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3676

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn avwbdfregv /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll\"" /SC ONCE /Z /ST 16:13 /ET 16:25
4⤵
- Creates scheduled task(s)
PID:2160

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3108

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3476

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4512

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Olivv" /d "0"
4⤵
PID:3320

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Zqtgdpux" /d "0"
4⤵
PID:612

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll
MD5
cccab2984ff316a36630e869282d8189

SHA1
24201f608110ae4d54a840e3af9490ea96091cb5

SHA256
a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6

SHA512
bf332287aee1dbaa813dc8ed12a7a362d8e1b2a57455e2609fe720658415cc417fd938aab69a30962cc74b777ab06a6707f306ec1f019e7dac5d2b5e59da4742

Download Submit
\Users\Admin\AppData\Local\Temp\a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6.dll
MD5
cccab2984ff316a36630e869282d8189

SHA1
24201f608110ae4d54a840e3af9490ea96091cb5

SHA256
a6c5c62772e986359385b47073dfa909e5638bb1b8f3622e147153b4721f0aa6

SHA512
bf332287aee1dbaa813dc8ed12a7a362d8e1b2a57455e2609fe720658415cc417fd938aab69a30962cc74b777ab06a6707f306ec1f019e7dac5d2b5e59da4742

Download Submit
memory/1724-122-0x00000000009A0000-0x00000000009C1000-memory.dmp

Filesize
132KB

Download
memory/3476-125-0x00000000028F0000-0x0000000002A3A000-memory.dmp

Filesize
1.3MB

Download
memory/3676-118-0x0000000002E80000-0x0000000002FCA000-memory.dmp

Filesize
1.3MB

Download
memory/3676-119-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/4512-128-0x0000000000570000-0x0000000000591000-memory.dmp

Filesize
132KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads