qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
4294191s
max time network
127s
platform
windows7_x64
resource
win7-20220311-en
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7.dll
Size

355KB
MD5

ed3b43ef66f58f891cc51cacc79b0b72
SHA1

02cfa19d275c96fafad6b3e440b220200b839f99
SHA256

9c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7
SHA512

73913ebf9895625de2b4a4e5c4534164f79b708bfc1338aade1d90aae57836bd7ea79e2a32976b138d8d5ab1d877ec5997428461acb588e732ec49ab8235d116

Score

10^/10

qakbot tr 1632730751 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

Campaign

1632730751

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1992 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

560 schtasks.exe

pid	process
1992	regsvr32.exe

pid	process
560	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vpjufamamizh\c12c6866 = 5d9e1c438b6de7a128bde960983e286cd3b3107a2c5905297a361a5fcfb96f38423640ddbedfc367c8e816a46a13a6a32ca7ee98592363788e25d8a88848472055fe984de116cd02db1a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vpjufamamizh\f4b3b828 = 929db87c094e351844d1ff024b950b458179c98f7b56e50cb251c13742d6572f30bdb6d7ab173a37118447342a5378565604e2544618439e7dd16eb6033db962fae19e9a8c3d02a342b0fde5e4ae64bed1aa4d1359726b3ad451adb1a13c551b9eb709ff41644325631a6f3ab867d617cf4efc3e20378fc67c43fac76e0dd772675ed77c5689e4c6237a24c48a92099be0a722f7c7547a8cec4bd4aae41b2e279b6172819f6ddfadb29521fd182df7f374bbe7cd49dd94f5f0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vpjufamamizh\f6f29854 = b864f561b5567e85ac9fed765f36c1f0c8e1d423ec8d524b60aa9168f57e7a655cc9ae846be4d5987ff2586363b96787030227dfe3b0ba01dbe86d418dcfe78fcadd39ca547982bbc98d4769bc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vpjufamamizh\3346b0bb = 5c567a5dc45b21810b9d4efa79fe83dcba366f95d40b1d0c8769058ef66ebaee1946c1bf9be5a8876fc2b27ba700f5b7288c1bb328432c16bd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vpjufamamizh\8bfad7de = 00e56aace5f31c62ca4717e7231dda70baf247d30f03c1e9a7965e339b6cd718db661477279f857a31547d41b8b70584682056a5c9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vpjufamamizh\be650790 = 817a1813d0b0862231795d74ecc90493c67bbf7a25e0ef2a8395340764eceb195cf8db467cbc9fe2ca2f6c02df22e2d68337b66c70b2e63ef58bfe057a37d02b012921c4797f964d787f10c24fc9	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vpjufamamizh	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vpjufamamizh\4e4eff31 = 4cc88c318d4ee976cf7e7d9218ec87f2f28c419e41d5e6c25578c253d85f2774a5ad6e8404ccb94105b5584dd0f28e2a3355ed89b17e664ab270b4c3be31f28999	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vpjufamamizh\4c0fdf4d = 89050c87ef2dc3b6e0cd4b9e933731fc7292829005cd0b8fee73b5cf144dd2a0b564a80cc7b3db4c127ea1192a7334d9c886e68d7d0b39773d38792dc128c7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vpjufamamizh\c12c6866 = 5d9e0b438b6dd2f90a5a1b592e7d841023e14a72e6f8fcb8b1b49897f8deeca22f53b660a2348eaa7377366341b621c76a8c4cc14bbfec2d49bb08d69e647d41596ca4a6490c981fa10fc88dd14616fa1381b81fccd75bcfdfa7d65661bb53	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2012 rundll32.exe
1992 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2012 rundll32.exe
1992 regsvr32.exe

pid	process
2012	rundll32.exe
1992	regsvr32.exe

pid	process
2012	rundll32.exe
1992	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2032 wrote to memory of 2012	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2012	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2012	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2012	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2012	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2012	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 2012	2032	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 1684	2012	rundll32.exe	explorer.exe
PID 2012 wrote to memory of 1684	2012	rundll32.exe	explorer.exe
PID 2012 wrote to memory of 1684	2012	rundll32.exe	explorer.exe
PID 2012 wrote to memory of 1684	2012	rundll32.exe	explorer.exe
PID 2012 wrote to memory of 1684	2012	rundll32.exe	explorer.exe
PID 2012 wrote to memory of 1684	2012	rundll32.exe	explorer.exe
PID 1684 wrote to memory of 560	1684	explorer.exe	schtasks.exe
PID 1684 wrote to memory of 560	1684	explorer.exe	schtasks.exe
PID 1684 wrote to memory of 560	1684	explorer.exe	schtasks.exe
PID 1684 wrote to memory of 560	1684	explorer.exe	schtasks.exe
PID 600 wrote to memory of 1556	600	taskeng.exe	regsvr32.exe
PID 600 wrote to memory of 1556	600	taskeng.exe	regsvr32.exe
PID 600 wrote to memory of 1556	600	taskeng.exe	regsvr32.exe
PID 600 wrote to memory of 1556	600	taskeng.exe	regsvr32.exe
PID 600 wrote to memory of 1556	600	taskeng.exe	regsvr32.exe
PID 1556 wrote to memory of 1992	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 1992	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 1992	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 1992	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 1992	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 1992	1556	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 1992	1556	regsvr32.exe	regsvr32.exe
PID 1992 wrote to memory of 988	1992	regsvr32.exe	explorer.exe
PID 1992 wrote to memory of 988	1992	regsvr32.exe	explorer.exe
PID 1992 wrote to memory of 988	1992	regsvr32.exe	explorer.exe
PID 1992 wrote to memory of 988	1992	regsvr32.exe	explorer.exe
PID 1992 wrote to memory of 988	1992	regsvr32.exe	explorer.exe
PID 1992 wrote to memory of 988	1992	regsvr32.exe	explorer.exe
PID 988 wrote to memory of 1404	988	explorer.exe	reg.exe
PID 988 wrote to memory of 1404	988	explorer.exe	reg.exe
PID 988 wrote to memory of 1404	988	explorer.exe	reg.exe
PID 988 wrote to memory of 1404	988	explorer.exe	reg.exe
PID 988 wrote to memory of 760	988	explorer.exe	reg.exe
PID 988 wrote to memory of 760	988	explorer.exe	reg.exe
PID 988 wrote to memory of 760	988	explorer.exe	reg.exe
PID 988 wrote to memory of 760	988	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pihhpxh /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7.dll\"" /SC ONCE /Z /ST 11:24 /ET 11:36
4⤵
- Creates scheduled task(s)
PID:560

C:\Windows\system32\taskeng.exe
taskeng.exe {11539076-59DC-4DF2-9047-C4EFB0E1411F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:600

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\9c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:988

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Maluoxshmm" /d "0"
5⤵
PID:1404

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Cceoi" /d "0"
5⤵
PID:760

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7.dll
MD5
ed3b43ef66f58f891cc51cacc79b0b72

SHA1
02cfa19d275c96fafad6b3e440b220200b839f99

SHA256
9c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7

SHA512
73913ebf9895625de2b4a4e5c4534164f79b708bfc1338aade1d90aae57836bd7ea79e2a32976b138d8d5ab1d877ec5997428461acb588e732ec49ab8235d116

Download Submit
\Users\Admin\AppData\Local\Temp\9c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7.dll
MD5
ed3b43ef66f58f891cc51cacc79b0b72

SHA1
02cfa19d275c96fafad6b3e440b220200b839f99

SHA256
9c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7

SHA512
73913ebf9895625de2b4a4e5c4534164f79b708bfc1338aade1d90aae57836bd7ea79e2a32976b138d8d5ab1d877ec5997428461acb588e732ec49ab8235d116

Download Submit
memory/988-72-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1556-62-0x000007FEFC411000-0x000007FEFC413000-memory.dmp

Filesize
8KB

Download
memory/1684-57-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/1684-60-0x0000000075031000-0x0000000075033000-memory.dmp

Filesize
8KB

Download
memory/1684-61-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1992-66-0x0000000000420000-0x0000000000463000-memory.dmp

Filesize
268KB

Download
memory/1992-67-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2012-54-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/2012-55-0x00000000001F0000-0x0000000000233000-memory.dmp

Filesize
268KB

Download
memory/2012-56-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads