qakbot | 5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c

General

Target

5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c.dll
Size

550KB
MD5

e43670838f429eaabdddf2bf2276248b
SHA1

824f8695c9a0a2b7ec1e997eb959383f6a29de0c
SHA256

5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c
SHA512

bad04c3225db7e45eb0261afa629faf93edfffd7766e585a3c129e0d31f8c54b4208e0eeafdc59f7d545f908103b1cee297d646b2e04dbdc57815f4a799d1a74

Score

10^/10

qakbot tr 1643025272 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

tr

Campaign

1643025272

C2

103.143.8.71:6881

37.210.172.200:2222

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

82.152.39.39:443

65.100.174.110:995

65.100.174.110:443

111.125.245.116:995

117.248.109.38:21

31.215.99.178:443

103.142.10.177:443

39.49.110.129:995

86.97.246.244:1194

68.204.7.158:443

217.128.93.27:2222

144.86.28.125:443

94.59.253.222:2222

120.150.218.241:995

185.249.85.209:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1264 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1624 schtasks.exe

pid	process
1264	regsvr32.exe

pid	process
1624	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hxfbxoyyxkw\70ca5b77 = 4ef027f3fcc1268c7fea84350fe293e530655c4ade1892db5592f7c17302664f14b5521c16b6297b3f41cfd77e5d095d43e26ccfaabd3605fea595c2e3e84e1cb96ee7cb23105a2e8bb30d27e99a4d312d763e987990b21419af827b9a887d6f5b89b577b1ae6e6dfa847d36217ae178187c2cbe671222a7644757d698686a5e4d296b14261d933d8a9b77f5a1d04a1730d45a6dc39deb2a9604d7bc055df2ea89	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hxfbxoyyxkw\728b7b0b = b3eaa41e0cc116ef168a9ce0db706bf8b5f3b14f4f759fe6c848a33efa5dc90f8fe080705ec47df9ec2c89c41c21770a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hxfbxoyyxkw\ca371c6e = e485e9695aeacff8593bf409cdc9c83d1a74094b49479a15a5ae30f3627a74e6449cede14ed49bc42884bb2f9feef699	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hxfbxoyyxkw\b73f53e4 = 9e56cfd0e51e70d1b8bf19a497ab27ca15826365ada6313730fa90e0cd367b983737e825fd069ff036c00fe54363dac002c8b392e4cda87cf81586f473152e7827e549ed257944859622019e8881494a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hxfbxoyyxkw\3a1ce4cf = 3be7ec1bb22d5a2c947dd9c112117243f1e5e40747edcce2aaa69b5887d365a39d3e4507c5717f891cde589b91f58b43b79043192a0cdfd3ab4b8e444bfc0756f96dc61855530a0a00e1297314fa741a	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hxfbxoyyxkw	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hxfbxoyyxkw\f833481 = e6d31125520d1427d8aaa2985fd0ada941fc024131a6949c78bcda678aa922ac56917ce774da742dc90801d58ec74048	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hxfbxoyyxkw\c8763c12 = e3dc1a22a6fe996862a01f734028d2d54ebd83bb24aded87bae0bfb33812fde6c5bd111dfe4e1b0dec6b415af998dd902578315ebf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hxfbxoyyxkw\45558b39 = ea0939a56aec720093aa031a26c6b92cbfa148c9122d0ac665687311e6590126876e3f692f18d5341a9b13d6801bdd8bce20e56049f2555499c3f98ed39558b39bcf71	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hxfbxoyyxkw\45558b39 = ea092ea56aec472867c91659153fd175e3b910a7da7487b6fdc41ec77dc091232011982f1203f62707849c556d91	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1580 regsvr32.exe
1264 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1580 regsvr32.exe
1264 regsvr32.exe

pid	process
1580	regsvr32.exe
1264	regsvr32.exe

pid	process
1580	regsvr32.exe
1264	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 744 wrote to memory of 1580	744	regsvr32.exe	regsvr32.exe
PID 744 wrote to memory of 1580	744	regsvr32.exe	regsvr32.exe
PID 744 wrote to memory of 1580	744	regsvr32.exe	regsvr32.exe
PID 744 wrote to memory of 1580	744	regsvr32.exe	regsvr32.exe
PID 744 wrote to memory of 1580	744	regsvr32.exe	regsvr32.exe
PID 744 wrote to memory of 1580	744	regsvr32.exe	regsvr32.exe
PID 744 wrote to memory of 1580	744	regsvr32.exe	regsvr32.exe
PID 1580 wrote to memory of 1772	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 1772	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 1772	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 1772	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 1772	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 1772	1580	regsvr32.exe	explorer.exe
PID 1772 wrote to memory of 1624	1772	explorer.exe	schtasks.exe
PID 1772 wrote to memory of 1624	1772	explorer.exe	schtasks.exe
PID 1772 wrote to memory of 1624	1772	explorer.exe	schtasks.exe
PID 1772 wrote to memory of 1624	1772	explorer.exe	schtasks.exe
PID 1280 wrote to memory of 1392	1280	taskeng.exe	regsvr32.exe
PID 1280 wrote to memory of 1392	1280	taskeng.exe	regsvr32.exe
PID 1280 wrote to memory of 1392	1280	taskeng.exe	regsvr32.exe
PID 1280 wrote to memory of 1392	1280	taskeng.exe	regsvr32.exe
PID 1280 wrote to memory of 1392	1280	taskeng.exe	regsvr32.exe
PID 1392 wrote to memory of 1264	1392	regsvr32.exe	regsvr32.exe
PID 1392 wrote to memory of 1264	1392	regsvr32.exe	regsvr32.exe
PID 1392 wrote to memory of 1264	1392	regsvr32.exe	regsvr32.exe
PID 1392 wrote to memory of 1264	1392	regsvr32.exe	regsvr32.exe
PID 1392 wrote to memory of 1264	1392	regsvr32.exe	regsvr32.exe
PID 1392 wrote to memory of 1264	1392	regsvr32.exe	regsvr32.exe
PID 1392 wrote to memory of 1264	1392	regsvr32.exe	regsvr32.exe
PID 1264 wrote to memory of 592	1264	regsvr32.exe	explorer.exe
PID 1264 wrote to memory of 592	1264	regsvr32.exe	explorer.exe
PID 1264 wrote to memory of 592	1264	regsvr32.exe	explorer.exe
PID 1264 wrote to memory of 592	1264	regsvr32.exe	explorer.exe
PID 1264 wrote to memory of 592	1264	regsvr32.exe	explorer.exe
PID 1264 wrote to memory of 592	1264	regsvr32.exe	explorer.exe
PID 592 wrote to memory of 1688	592	explorer.exe	reg.exe
PID 592 wrote to memory of 1688	592	explorer.exe	reg.exe
PID 592 wrote to memory of 1688	592	explorer.exe	reg.exe
PID 592 wrote to memory of 1688	592	explorer.exe	reg.exe
PID 592 wrote to memory of 1760	592	explorer.exe	reg.exe
PID 592 wrote to memory of 1760	592	explorer.exe	reg.exe
PID 592 wrote to memory of 1760	592	explorer.exe	reg.exe
PID 592 wrote to memory of 1760	592	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dsytbnadz /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c.dll\"" /SC ONCE /Z /ST 14:02 /ET 14:14
4⤵
- Creates scheduled task(s)
PID:1624

C:\Windows\system32\taskeng.exe
taskeng.exe {24120CBF-F49C-476C-89FD-5E991F46C44F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Xyebjqdx" /d "0"
5⤵
PID:1688

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ulyiau" /d "0"
5⤵
PID:1760

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c.dll
MD5
e43670838f429eaabdddf2bf2276248b

SHA1
824f8695c9a0a2b7ec1e997eb959383f6a29de0c

SHA256
5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c

SHA512
bad04c3225db7e45eb0261afa629faf93edfffd7766e585a3c129e0d31f8c54b4208e0eeafdc59f7d545f908103b1cee297d646b2e04dbdc57815f4a799d1a74

Download Submit
\Users\Admin\AppData\Local\Temp\5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c.dll
MD5
e43670838f429eaabdddf2bf2276248b

SHA1
824f8695c9a0a2b7ec1e997eb959383f6a29de0c

SHA256
5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c

SHA512
bad04c3225db7e45eb0261afa629faf93edfffd7766e585a3c129e0d31f8c54b4208e0eeafdc59f7d545f908103b1cee297d646b2e04dbdc57815f4a799d1a74

Download Submit
memory/592-70-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/744-54-0x000007FEFC241000-0x000007FEFC243000-memory.dmp

Filesize
8KB

Download
memory/1264-66-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1580-55-0x00000000763B1000-0x00000000763B3000-memory.dmp

Filesize
8KB

Download
memory/1580-56-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1580-57-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/1772-58-0x0000000000340000-0x0000000000342000-memory.dmp

Filesize
8KB

Download
memory/1772-60-0x0000000074C51000-0x0000000074C53000-memory.dmp

Filesize
8KB

Download
memory/1772-61-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads