qakbot | abe530cd4c01bf2e22799547987e92d788024887c24ad71c8e6ce78146a1da13

General

Target

abe530cd4c01bf2e22799547987e92d788024887c24ad71c8e6ce78146a1da13.dll
Size

87KB
MD5

679ea37a80e72d2071261017b874b799
SHA1

45812f582f1eeab7c05f0d0a056acab039115ee5
SHA256

abe530cd4c01bf2e22799547987e92d788024887c24ad71c8e6ce78146a1da13
SHA512

a2cd81f439778b87af25333779da15162f739122cf035f8a42a55574ce51d4364b20b366556b4033bd1485abdbf0c513a357797fb186f24f61e240d1e4c3e20a

Score

10^/10

qakbot clinton04 1618322109 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.1

Botnet

clinton04

Campaign

1618322109

C2

75.137.47.174:443

140.82.49.12:443

151.205.102.42:443

24.226.156.153:443

24.43.22.221:993

216.201.162.158:443

76.25.142.196:443

149.28.99.97:995

149.28.101.90:2222

207.246.116.237:8443

149.28.99.97:443

45.63.107.192:2222

45.32.211.207:2222

149.28.101.90:443

45.77.117.108:995

207.246.77.75:443

207.246.77.75:8443

149.28.98.196:2222

45.32.211.207:995

45.32.211.207:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3496 created 1864 3496 WerFault.exe explorer.exe

description	pid	process	target process
PID 3496 created 1864	3496	WerFault.exe	explorer.exe

Drops file in Windows directory 3 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3428 1864 WerFault.exe explorer.exe

pid	pid_target	process	target process
3428	1864	WerFault.exe	explorer.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exeMusNotifyIcon.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.006578"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "13.639570"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "6.080992"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4328"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4120"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132895019735085128"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4008"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeWerFault.exe

pid process

3564 regsvr32.exe
3564 regsvr32.exe
3428 WerFault.exe
3428 WerFault.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

3564 regsvr32.exe

pid	process
3564	regsvr32.exe
3564	regsvr32.exe
3428	WerFault.exe
3428	WerFault.exe

pid	process
3564	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WerFault.exeTiWorker.exe

description	pid	process
Token: SeRestorePrivilege	3428	WerFault.exe
Token: SeBackupPrivilege	3428	WerFault.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe
Token: SeSecurityPrivilege	1752	TiWorker.exe
Token: SeBackupPrivilege	1752	TiWorker.exe
Token: SeRestorePrivilege	1752	TiWorker.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

regsvr32.exeregsvr32.exeWerFault.exe

description	pid	process	target process
PID 3972 wrote to memory of 3564	3972	regsvr32.exe	regsvr32.exe
PID 3972 wrote to memory of 3564	3972	regsvr32.exe	regsvr32.exe
PID 3972 wrote to memory of 3564	3972	regsvr32.exe	regsvr32.exe
PID 3564 wrote to memory of 1864	3564	regsvr32.exe	explorer.exe
PID 3564 wrote to memory of 1864	3564	regsvr32.exe	explorer.exe
PID 3564 wrote to memory of 1864	3564	regsvr32.exe	explorer.exe
PID 3564 wrote to memory of 1864	3564	regsvr32.exe	explorer.exe
PID 3564 wrote to memory of 1864	3564	regsvr32.exe	explorer.exe
PID 3496 wrote to memory of 1864	3496	WerFault.exe	explorer.exe
PID 3496 wrote to memory of 1864	3496	WerFault.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\abe530cd4c01bf2e22799547987e92d788024887c24ad71c8e6ce78146a1da13.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3972

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\abe530cd4c01bf2e22799547987e92d788024887c24ad71c8e6ce78146a1da13.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3564

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 812
4⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1864 -ip 1864
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3496

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:2576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3360

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-130-0x0000000000113000-0x0000000000114000-memory.dmp

Filesize
4KB

Download
memory/1864-131-0x0000000002F80000-0x0000000002F99000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads