qakbot | 38be1a5eb7776ab8783f867c85fdf1239b897122208f91c1a818f6776fb946a4

General

Target

a347edbe3b48344772aeb91faf49c525.dll
Size

1.7MB
MD5

a347edbe3b48344772aeb91faf49c525
SHA1

6630b4561647b88dc8664ef2f683a6c59adcbea0
SHA256

38be1a5eb7776ab8783f867c85fdf1239b897122208f91c1a818f6776fb946a4
SHA512

36061a016fe275a969aa86884746dfa80ec4a654516ffbbfba451307cee1178358d91912069f4150feda5210f33a4b46cfafee8a2a6154aa8d550268f73dd772

Score

10^/10

qakbot aa 1649273304 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.573

Botnet

AA

Campaign

1649273304

C2

83.110.75.97:2222

47.23.89.62:993

187.207.48.194:61202

45.63.1.12:995

140.82.63.183:995

45.76.167.26:995

140.82.63.183:443

144.202.2.175:995

144.202.3.39:443

149.28.238.199:443

144.202.3.39:995

45.63.1.12:443

149.28.238.199:995

45.76.167.26:443

144.202.2.175:443

100.1.108.246:443

32.221.224.140:995

24.55.67.176:443

31.35.28.29:443

70.51.134.168:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1328 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1972 schtasks.exe

pid	process
1328	regsvr32.exe

pid	process
1972	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fiwosybdakz\2556eae6 = 471f81aec511e0908a5633779897a1a85b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fiwosybdakz\10c93aa8 = ea7ba98000ad2749d0db6c69aedf2cb008f39739a7b95459c4d3c41ef7ae4f1823515f949fd2350530c488647adde9d612d300bad67df7d3a5a8759e683def85b6dc37f3a8fa417abe92c006e48144da6366edd05ec06a769c6d040acaf274745b3d0846f6c5ee14f0ed1674672b507926c743f87d696fd4c87071cca5a1b7d09426	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fiwosybdakz\6f80555e = eeaabf061bf69337a955d55a2263a81782cf05caeacf9beec3085820181fc65150766593	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fiwosybdakz\a8755dcd = 08195255c8d25adcbeca2030db2bbbe80674e0054ced932b85aae960f1c58756ee1f3b54823e8df4cf3843596e9e1fa3a88fc933f4640500b6f588544141f16714b04c57c1cb4adaf9fb01bee0a6cc617337858222c938170ff73e60b6911d7c573e816b3234d2bdbeb9503d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fiwosybdakz\2556eae6 = 471f96aec511d5174cf06e42c1e2e5b3edff9313edf492ca55da800b8216efc5cdd77b398115	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fiwosybdakz	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fiwosybdakz\12881ad4 = ee28566a56c4ee4eb72dbb8be35bffeffc3d8d320f441164e9043e3cd72ba1ed608d2396333391504a889ded4efab8f37d0a8363bd4949ad5cc1ea6a03	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fiwosybdakz\aa347db1 = c53d46f7383d0c64f41e77	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fiwosybdakz\d73c323b = 2085c31f7aaaaf8d4a076bde80c8ded24dfe18132a7cd61db6b6a63e36f73097d1255f23360cf9e62aad97aab68ec3316b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fiwosybdakz\5a1f8510 = 78b64134613336354a4703f00c9648a22537e9614af2ba11502319a0be13a2eb223ffc79107ebfd15b713bb3f09014c3	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeexplorer.exe

pid	process
1816	rundll32.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe
616	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1816 rundll32.exe
1328 regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1800 wrote to memory of 1816	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 1816	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 1816	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 1816	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 1816	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 1816	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 1816	1800	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 616	1816	rundll32.exe	explorer.exe
PID 1816 wrote to memory of 616	1816	rundll32.exe	explorer.exe
PID 1816 wrote to memory of 616	1816	rundll32.exe	explorer.exe
PID 1816 wrote to memory of 616	1816	rundll32.exe	explorer.exe
PID 1816 wrote to memory of 616	1816	rundll32.exe	explorer.exe
PID 1816 wrote to memory of 616	1816	rundll32.exe	explorer.exe
PID 616 wrote to memory of 1972	616	explorer.exe	schtasks.exe
PID 616 wrote to memory of 1972	616	explorer.exe	schtasks.exe
PID 616 wrote to memory of 1972	616	explorer.exe	schtasks.exe
PID 616 wrote to memory of 1972	616	explorer.exe	schtasks.exe
PID 1956 wrote to memory of 1336	1956	taskeng.exe	regsvr32.exe
PID 1956 wrote to memory of 1336	1956	taskeng.exe	regsvr32.exe
PID 1956 wrote to memory of 1336	1956	taskeng.exe	regsvr32.exe
PID 1956 wrote to memory of 1336	1956	taskeng.exe	regsvr32.exe
PID 1956 wrote to memory of 1336	1956	taskeng.exe	regsvr32.exe
PID 1336 wrote to memory of 1328	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1328	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1328	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1328	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1328	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1328	1336	regsvr32.exe	regsvr32.exe
PID 1336 wrote to memory of 1328	1336	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 740	1328	regsvr32.exe	explorer.exe
PID 1328 wrote to memory of 740	1328	regsvr32.exe	explorer.exe
PID 1328 wrote to memory of 740	1328	regsvr32.exe	explorer.exe
PID 1328 wrote to memory of 740	1328	regsvr32.exe	explorer.exe
PID 1328 wrote to memory of 740	1328	regsvr32.exe	explorer.exe
PID 1328 wrote to memory of 740	1328	regsvr32.exe	explorer.exe
PID 740 wrote to memory of 1604	740	explorer.exe	reg.exe
PID 740 wrote to memory of 1604	740	explorer.exe	reg.exe
PID 740 wrote to memory of 1604	740	explorer.exe	reg.exe
PID 740 wrote to memory of 1604	740	explorer.exe	reg.exe
PID 740 wrote to memory of 1620	740	explorer.exe	reg.exe
PID 740 wrote to memory of 1620	740	explorer.exe	reg.exe
PID 740 wrote to memory of 1620	740	explorer.exe	reg.exe
PID 740 wrote to memory of 1620	740	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a347edbe3b48344772aeb91faf49c525.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a347edbe3b48344772aeb91faf49c525.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:616

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn enxvgecuk /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a347edbe3b48344772aeb91faf49c525.dll\"" /SC ONCE /Z /ST 14:50 /ET 15:02
4⤵
- Creates scheduled task(s)
PID:1972

C:\Windows\system32\taskeng.exe
taskeng.exe {86B5536D-5DC8-4A86-9632-642D39AEF624} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a347edbe3b48344772aeb91faf49c525.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\a347edbe3b48344772aeb91faf49c525.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Mpjnakbhky" /d "0"
5⤵
PID:1604

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Arsadi" /d "0"
5⤵
PID:1620

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a347edbe3b48344772aeb91faf49c525.dll
Filesize
1.7MB

MD5
a347edbe3b48344772aeb91faf49c525

SHA1
6630b4561647b88dc8664ef2f683a6c59adcbea0

SHA256
38be1a5eb7776ab8783f867c85fdf1239b897122208f91c1a818f6776fb946a4

SHA512
36061a016fe275a969aa86884746dfa80ec4a654516ffbbfba451307cee1178358d91912069f4150feda5210f33a4b46cfafee8a2a6154aa8d550268f73dd772

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\a347edbe3b48344772aeb91faf49c525.dll
Filesize
1.7MB

MD5
a347edbe3b48344772aeb91faf49c525

SHA1
6630b4561647b88dc8664ef2f683a6c59adcbea0

SHA256
38be1a5eb7776ab8783f867c85fdf1239b897122208f91c1a818f6776fb946a4

SHA512
36061a016fe275a969aa86884746dfa80ec4a654516ffbbfba451307cee1178358d91912069f4150feda5210f33a4b46cfafee8a2a6154aa8d550268f73dd772

Download Submit
memory/616-65-0x00000000741C1000-0x00000000741C3000-memory.dmp

Filesize
8KB

Download
memory/616-68-0x00000000000F0000-0x000000000017F000-memory.dmp

Filesize
572KB

Download
memory/616-61-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/616-63-0x0000000000000000-mapping.dmp

Download
memory/740-91-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download
memory/740-85-0x0000000000000000-mapping.dmp

Download
memory/1328-78-0x0000000001220000-0x00000000012AF000-memory.dmp

Filesize
572KB

Download
memory/1328-82-0x0000000001220000-0x00000000012AF000-memory.dmp

Filesize
572KB

Download
memory/1328-81-0x0000000000CC0000-0x0000000000D4B000-memory.dmp

Filesize
556KB

Download
memory/1328-80-0x0000000001220000-0x00000000012AF000-memory.dmp

Filesize
572KB

Download
memory/1328-79-0x0000000001220000-0x00000000012AF000-memory.dmp

Filesize
572KB

Download
memory/1328-77-0x0000000001220000-0x00000000012AF000-memory.dmp

Filesize
572KB

Download
memory/1328-76-0x0000000000A60000-0x0000000000C0E000-memory.dmp

Filesize
1.7MB

Download
memory/1328-73-0x0000000000000000-mapping.dmp

Download
memory/1336-71-0x000007FEFB551000-0x000007FEFB553000-memory.dmp

Filesize
8KB

Download
memory/1336-70-0x0000000000000000-mapping.dmp

Download
memory/1604-89-0x0000000000000000-mapping.dmp

Download
memory/1620-90-0x0000000000000000-mapping.dmp

Download
memory/1816-59-0x00000000024A0000-0x000000000252F000-memory.dmp

Filesize
572KB

Download
memory/1816-60-0x00000000024A0000-0x000000000252F000-memory.dmp

Filesize
572KB

Download
memory/1816-67-0x00000000024A0000-0x000000000252F000-memory.dmp

Filesize
572KB

Download
memory/1816-66-0x0000000001D30000-0x0000000001DBB000-memory.dmp

Filesize
556KB

Download
memory/1816-58-0x00000000024A0000-0x000000000252F000-memory.dmp

Filesize
572KB

Download
memory/1816-56-0x0000000001E60000-0x000000000200E000-memory.dmp

Filesize
1.7MB

Download
memory/1816-54-0x0000000000000000-mapping.dmp

Download
memory/1816-57-0x00000000024A0000-0x000000000252F000-memory.dmp

Filesize
572KB

Download
memory/1816-55-0x0000000075081000-0x0000000075083000-memory.dmp

Filesize
8KB

Download
memory/1972-69-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads