qakbot | 5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c

General

Target

5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c.dll
Size

550KB
MD5

e43670838f429eaabdddf2bf2276248b
SHA1

824f8695c9a0a2b7ec1e997eb959383f6a29de0c
SHA256

5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c
SHA512

bad04c3225db7e45eb0261afa629faf93edfffd7766e585a3c129e0d31f8c54b4208e0eeafdc59f7d545f908103b1cee297d646b2e04dbdc57815f4a799d1a74

Score

10^/10

qakbot tr 1643025272 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

tr

Campaign

1643025272

C2

103.143.8.71:6881

37.210.172.200:2222

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

82.152.39.39:443

65.100.174.110:995

65.100.174.110:443

111.125.245.116:995

117.248.109.38:21

31.215.99.178:443

103.142.10.177:443

39.49.110.129:995

86.97.246.244:1194

68.204.7.158:443

217.128.93.27:2222

144.86.28.125:443

94.59.253.222:2222

120.150.218.241:995

185.249.85.209:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

376 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

988 schtasks.exe

pid	process
376	regsvr32.exe

pid	process
988	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urhtrebgszugyx\6fd40c1d = 9ef98b169cac0586c431670a1985dda6bbf6c97bbc478570dd2af20fcd30a60339ca0016987effc099a8c677f0ebe513d1181f334e8aafe0f282f5c78f8c3f423e4fcd60d96ac2b7d5eb41afb2e13690b8785050fa95fbd11ee4e7de3f4e029f4331714c7856fe1accbe25f1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urhtrebgszugyx\aa6024f2 = 86cf3dc62520e8be574a8d8c685b230160a913fbd6d7096a8a242ebd9884395666c329c90066d0127fe40b8fe426b42c0d0e753afc39870d0a4027701fcf10fcc241be93815e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urhtrebgszugyx\6d952c61 = 7633aa1285180bffb2be0b685b3a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urhtrebgszugyx\e0b69b4a = de016f65bce623d5615b9af54ed9564eb8d6e3709973d26fbb17a8a6efb341e486bb9d5db201fa614254d2aac852a750b55f6f2037d38398e3fd50a9cc41f08a21b001b31150f3cbb02f65de35	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urhtrebgszugyx	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urhtrebgszugyx\e0b69b4a = de017865bce61631ab8bea5ccf7ceeb1ee0f281db31fde5338a81eb5b25f4dd8f54b1caceb0c00a66f9949e6adddaf227fcb177fd0c3ab7a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urhtrebgszugyx\12dc4397 = ba78963d11fca0050b773aa5a29408f345df3358e3c70e689828bf2bea978d8dca6091c76677bc339688ddaa6ea8c826675ce538b78f8cf6b8e77fef99ba9a52164381702a00c0da20fb5ba87a7d9abce437c5cf6ed1d6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urhtrebgszugyx\9ffff4bc = ec0d1260368c76049d10c8d3eb2ef7595ec2c7e184081a72d4e7dfd909cf84d9b6c86ea29ab6157bda946ed14033dd2bc1e2f448e917c533f21b5e0ccda42b6967a536bfac01c5558bd81e309a4995c8a38d19b3e9e7232205f24208db133cbd12d3aeffc4efccbab28b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urhtrebgszugyx\d5294b04 = f49ffd4ee46a6a129217182ceec244e945c91186caee49e26d9b8054303f22e08c62aa839b62d0d10da29d0de411fe0c74d08beee7eafeef666051522c705d904c61c8e076a8ccffa883c40fe4d02ccae71e73b7d98601a27a26bb997459060e601f4f372e732c04f79af1ab5777975fd62ec0355e51afcfcad2e2d39f2ded46085587c77d41	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urhtrebgszugyx\d7686b78 = e1203df571263cb8fa501610e7e08fd21e0ded2d25d6c3905178594e	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3780 regsvr32.exe
3780 regsvr32.exe
376 regsvr32.exe
376 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3780 regsvr32.exe
376 regsvr32.exe

pid	process
3780	regsvr32.exe
3780	regsvr32.exe
376	regsvr32.exe
376	regsvr32.exe

pid	process
3780	regsvr32.exe
376	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3484 wrote to memory of 3780	3484	regsvr32.exe	regsvr32.exe
PID 3484 wrote to memory of 3780	3484	regsvr32.exe	regsvr32.exe
PID 3484 wrote to memory of 3780	3484	regsvr32.exe	regsvr32.exe
PID 3780 wrote to memory of 3920	3780	regsvr32.exe	explorer.exe
PID 3780 wrote to memory of 3920	3780	regsvr32.exe	explorer.exe
PID 3780 wrote to memory of 3920	3780	regsvr32.exe	explorer.exe
PID 3780 wrote to memory of 3920	3780	regsvr32.exe	explorer.exe
PID 3780 wrote to memory of 3920	3780	regsvr32.exe	explorer.exe
PID 3920 wrote to memory of 988	3920	explorer.exe	schtasks.exe
PID 3920 wrote to memory of 988	3920	explorer.exe	schtasks.exe
PID 3920 wrote to memory of 988	3920	explorer.exe	schtasks.exe
PID 1192 wrote to memory of 376	1192	regsvr32.exe	regsvr32.exe
PID 1192 wrote to memory of 376	1192	regsvr32.exe	regsvr32.exe
PID 1192 wrote to memory of 376	1192	regsvr32.exe	regsvr32.exe
PID 376 wrote to memory of 3644	376	regsvr32.exe	explorer.exe
PID 376 wrote to memory of 3644	376	regsvr32.exe	explorer.exe
PID 376 wrote to memory of 3644	376	regsvr32.exe	explorer.exe
PID 376 wrote to memory of 3644	376	regsvr32.exe	explorer.exe
PID 376 wrote to memory of 3644	376	regsvr32.exe	explorer.exe
PID 3644 wrote to memory of 980	3644	explorer.exe	reg.exe
PID 3644 wrote to memory of 980	3644	explorer.exe	reg.exe
PID 3644 wrote to memory of 500	3644	explorer.exe	reg.exe
PID 3644 wrote to memory of 500	3644	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3484

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3780

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3920

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qxdftuwr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c.dll\"" /SC ONCE /Z /ST 19:04 /ET 19:16
4⤵
- Creates scheduled task(s)
PID:988

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:376

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Uhsnyuon" /d "0"
4⤵
PID:980

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Izgys" /d "0"
4⤵
PID:500

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c.dll
MD5
e43670838f429eaabdddf2bf2276248b

SHA1
824f8695c9a0a2b7ec1e997eb959383f6a29de0c

SHA256
5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c

SHA512
bad04c3225db7e45eb0261afa629faf93edfffd7766e585a3c129e0d31f8c54b4208e0eeafdc59f7d545f908103b1cee297d646b2e04dbdc57815f4a799d1a74

Download Submit
\Users\Admin\AppData\Local\Temp\5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c.dll
MD5
e43670838f429eaabdddf2bf2276248b

SHA1
824f8695c9a0a2b7ec1e997eb959383f6a29de0c

SHA256
5884b14669bed3fefadb36933c5a20070c275fca1c549ee9d8ebe041c6a6290c

SHA512
bad04c3225db7e45eb0261afa629faf93edfffd7766e585a3c129e0d31f8c54b4208e0eeafdc59f7d545f908103b1cee297d646b2e04dbdc57815f4a799d1a74

Download Submit
memory/376-122-0x0000000002A00000-0x0000000002B4A000-memory.dmp

Filesize
1.3MB

Download
memory/3644-123-0x0000000000390000-0x00000000003B1000-memory.dmp

Filesize
132KB

Download
memory/3780-115-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/3780-116-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/3920-117-0x0000000003200000-0x0000000003221000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads