qakbot | aaaac7add78fd2f9eb7638559958432498ed11480acf706d6023923fc75a48ec

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-en-20211208
submitted
14/02/2022, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dxv1.dll
Size 798KB
Sample220214-stl3ashfc2
SHA256 aaaac7add78fd2f9eb7638559958432498ed11480acf706d6023923fc75a48ec
MD5 a10a2c494cac5eafccee74cc73648646
SHA1 1f33182c46d587c40e642874ccb6001bdc86bba5
SHA512 c233b3f08686c92207a7a93b963bf4cfe094be471bcd0264c8f2b0a2d113ffe9eecf6996f7c9dbeb1a8d1301035572fd915c78efaa55e38090bc71ae35211c2e
MD5 SHA1 SHA512

Score

10^/10

qakbot banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
1836	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
276	schtasks.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Viuqtebnwo\c71fdb10 = ceb2357d8652a8a561af4413eb8bb84edf0cbd66369d6a40d569c06ef23a8dae9b28e753a175036f91d52e96950ccd84612167edf7b4d23bb78dd5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Viuqtebnwo\7fa3bc75 = 5290dc10f900c75c5494688896b984e51a142744767e4b4518fce47b866fd8e26a947a20b2fe745a2aa327b0362d4347e44c101677b17716468b2d602448764d30ce5c49bb28acbd537859f3f503d0f364ca818dcc8eeddb9dd113aaec62e583b8ca5ae38f4f2a43c144578a8b7c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Viuqtebnwo\c55efb6c = b5d905b8d291b4ab7073eba95333dc86002a2961b244ffb238f5db7f34f0dc306346c97515a5c018c079776aa72d3ffc6a70a010fa858329edd885d5f15fd8f3fc6c753cd19beb1be0e6789b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Viuqtebnwo\ead383 = de36ec3fbc94d64400e0d280b3de7bbfd51b603cda268842bf4e21f6aa2cb532ce	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Viuqtebnwo\b856b4e6 = 1336e73aa2d613baff0fcb221e0070e7cd44cd1b41ee37dfca8e5e646472603385e17c4d04d86b50893eff92cd2a1a1764bdc115fbb1995d13411feea62e5a5a904a009b1a96d1e0829a1d657c510fc2d5f63ec0b8386bc5688a1bb4ec800153747cab	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Viuqtebnwo\357503cd = 86f2310639770d0e3a83abd35a30cb39cda325c416c9d269f67175fce34fdec3d176c4042c0bcdaafdb0a5c42ee09f599b355b5cfc28d6f2ecd6a997fde03c2649d1c4ed4a731b2cc0f9ae4fdb3b525280608f40dec0b1ead48b2fd2312ecbff08	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Viuqtebnwo	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Viuqtebnwo\4a3c6c3b = 8ae31551ef0e710eea7582b222c688e770b150e9274d4d8a3c7b92ee071b6f4ddd0afc418e6cd03d7ce2bc29a2bfea5f7084dc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Viuqtebnwo\7de29c09 = e0bc86d5181a954cc8c7482b6b3542ae42635ab8a5f9b49e4d2dedddfeda92f41af863e9a439721ac62506debe77a76677bfc7bf21d7ba94273f6d4bb8f1911a3a8dd8579b48f12b66776a5595badacad84eb4fe425bb6eda4fce4aef86509c0593a	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2028	regsvr32.exe
1836	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2028	regsvr32.exe
1836	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2028	1540	regsvr32.exe	27
PID 1540 wrote to memory of 2028	1540	regsvr32.exe	27
PID 1540 wrote to memory of 2028	1540	regsvr32.exe	27
PID 1540 wrote to memory of 2028	1540	regsvr32.exe	27
PID 1540 wrote to memory of 2028	1540	regsvr32.exe	27
PID 1540 wrote to memory of 2028	1540	regsvr32.exe	27
PID 1540 wrote to memory of 2028	1540	regsvr32.exe	27
PID 2028 wrote to memory of 316	2028	regsvr32.exe	28
PID 2028 wrote to memory of 316	2028	regsvr32.exe	28
PID 2028 wrote to memory of 316	2028	regsvr32.exe	28
PID 2028 wrote to memory of 316	2028	regsvr32.exe	28
PID 2028 wrote to memory of 316	2028	regsvr32.exe	28
PID 2028 wrote to memory of 316	2028	regsvr32.exe	28
PID 316 wrote to memory of 276	316	explorer.exe	29
PID 316 wrote to memory of 276	316	explorer.exe	29
PID 316 wrote to memory of 276	316	explorer.exe	29
PID 316 wrote to memory of 276	316	explorer.exe	29
PID 1096 wrote to memory of 1496	1096	taskeng.exe	34
PID 1096 wrote to memory of 1496	1096	taskeng.exe	34
PID 1096 wrote to memory of 1496	1096	taskeng.exe	34
PID 1096 wrote to memory of 1496	1096	taskeng.exe	34
PID 1096 wrote to memory of 1496	1096	taskeng.exe	34
PID 1496 wrote to memory of 1836	1496	regsvr32.exe	35
PID 1496 wrote to memory of 1836	1496	regsvr32.exe	35
PID 1496 wrote to memory of 1836	1496	regsvr32.exe	35
PID 1496 wrote to memory of 1836	1496	regsvr32.exe	35
PID 1496 wrote to memory of 1836	1496	regsvr32.exe	35
PID 1496 wrote to memory of 1836	1496	regsvr32.exe	35
PID 1496 wrote to memory of 1836	1496	regsvr32.exe	35
PID 1836 wrote to memory of 1316	1836	regsvr32.exe	36
PID 1836 wrote to memory of 1316	1836	regsvr32.exe	36
PID 1836 wrote to memory of 1316	1836	regsvr32.exe	36
PID 1836 wrote to memory of 1316	1836	regsvr32.exe	36
PID 1836 wrote to memory of 1316	1836	regsvr32.exe	36
PID 1836 wrote to memory of 1316	1836	regsvr32.exe	36
PID 1316 wrote to memory of 1068	1316	explorer.exe	37
PID 1316 wrote to memory of 1068	1316	explorer.exe	37
PID 1316 wrote to memory of 1068	1316	explorer.exe	37
PID 1316 wrote to memory of 1068	1316	explorer.exe	37
PID 1316 wrote to memory of 480	1316	explorer.exe	39
PID 1316 wrote to memory of 480	1316	explorer.exe	39
PID 1316 wrote to memory of 480	1316	explorer.exe	39
PID 1316 wrote to memory of 480	1316	explorer.exe	39

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dxv1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dxv1.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:316
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yscmyqzi /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\dxv1.dll\"" /SC ONCE /Z /ST 16:27 /ET 16:39
      4⤵
      Creates scheduled task(s)
      PID:276

C:\Windows\system32\taskeng.exe
taskeng.exe {534C30DD-EA55-4172-A787-E8E993D416E5} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\dxv1.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\dxv1.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1316
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Lrleb" /d "0"
        5⤵
        
        PID:1068
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Eejrir" /d "0"
        5⤵
        
        PID:480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/316-59-0x0000000000080000-0x0000000000082000-memory.dmp

Download

memory/316-61-0x00000000746C1000-0x00000000746C3000-memory.dmp

Download

memory/316-62-0x0000000000180000-0x00000000001EC000-memory.dmp

Download

memory/1316-72-0x0000000000080000-0x00000000000EC000-memory.dmp

Download

memory/1540-55-0x000007FEFBE21000-0x000007FEFBE23000-memory.dmp

Download

memory/1836-67-0x0000000074BD0000-0x0000000074C9A000-memory.dmp

Download

memory/2028-56-0x0000000076731000-0x0000000076733000-memory.dmp

Download

memory/2028-57-0x0000000000910000-0x0000000000A4A000-memory.dmp

Download

memory/2028-58-0x0000000074960000-0x0000000074A2A000-memory.dmp

Download