qakbot | 08c8093291e391d35310028b3fa0fd130d061e8afec72fff7633026b7fe456ac

General

Target

08c8093291e391d35310028b3fa0fd130d061e8afec72fff7633026b7fe456ac.dll
Size

1.7MB
MD5

f6777611b84582a1714ec511ce0f9dcb
SHA1

bfc784473dde678b9f52870c292867100f4472e9
SHA256

08c8093291e391d35310028b3fa0fd130d061e8afec72fff7633026b7fe456ac
SHA512

e864616a8dca7fd1eae740e60c24003801f9ebbfaa553455ca507b79c0d08d3750ae387665e9a94bda0e77d54c539352c200fec7a3cae739ae9440857a2b2729

Score

10^/10

qakbot aa 1649273304 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.573

Botnet

AA

Campaign

1649273304

C2

83.110.75.97:2222

47.23.89.62:993

187.207.48.194:61202

45.63.1.12:995

140.82.63.183:995

45.76.167.26:995

140.82.63.183:443

144.202.2.175:995

144.202.3.39:443

149.28.238.199:443

144.202.3.39:995

45.63.1.12:443

149.28.238.199:995

45.76.167.26:443

144.202.2.175:443

100.1.108.246:443

32.221.224.140:995

24.55.67.176:443

31.35.28.29:443

70.51.134.168:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3752 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2844 4304 WerFault.exe rundll32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4264 schtasks.exe

pid	process
3752	regsvr32.exe

pid	pid_target	process	target process
2844	4304	WerFault.exe	rundll32.exe

pid	process
4264	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyyhrnivk\97a0a381 = 345843e47ab49b1601bce97b1f4adf871d004a3aa030a5028cd1cfcca8b87eb8e43a7f11abd7f7996b812c5cceb07f632053052346ee8ee08a0ad1c4fbb73d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyyhrnivk\97a0a381 = 345854e47ab4ae0e1f49119c43607b256be57e995c64df415cc5e61b9143d12f4553fc8f183467522584	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyyhrnivk\a07e53b3 = 714b9e0647b10a3bc7b69326f882306876e9ea0d87ab84b745e0f5b5c8b575f639611eaceaf461455210191708b499933c6d8fac9982218477	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyyhrnivk\18c234d6 = 88d33b8858b11589f45bbdb998803e27584a20da45b8accebc3c2737921a3abc83b2e85736e0c16fd1b7f49df4d627a1b012c70ac6fd815805e85ad748577182b29f5db9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyyhrnivk\dd761c39 = 22be79a5def0e2f905aa22ae6da5e66704f82f9b66732a2cd974998c80be8108c58aa80b86	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyyhrnivk\e8e9cc77 = ae6ca845e482a9d6e3f20faaa845b56087ce53f0aa0f2647db730db8519c3e3588d57b30a049b88b35a36c82d86c87c18068074a00deb7ef24f91b33c108713c4660	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyyhrnivk	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyyhrnivk\a23f73cf = f7d8736fbb7d53203d582a2dd713b3c414001b75d0a6d7a6991c72c31ddf83550fd4f22d448605202999df0e37626e2881cad3b6d7fc95b50daf13becd1133902844d54b700a74ca2985e8584007c069a7260d407838381475aa37cf9f136a1cd96ebc644ae05b2dfb0c0b8346ca71d63b8aefca311b8b1e6f0489f30bde2bf13e4336fbf358700126b8c44811fbb3b578395ab423eec5836f8a40582f3fcf99c7054ae002e1a55f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyyhrnivk\65ca7b5c = 95d0e03ab39092f84d9012f2dc5dad7cec7131870c06a33b95918e05086bc4b1100ec2b3ab6d69deb556fefb0f314ce1175854878c880022aa2014f33cac2603d1adf3274b3a612cecf205a5a0940fa7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyyhrnivk\1a8314aa = 75d477ecd38e073690c5889c4df3819110b9905ef41f467518fc2ec7032740ffcf40b1637a705cbaca868def3b164a73bc211805520878c9aea1cfb0afbcb809491fba2b4fe7e2ad1b42be9c6240f709a67d9f532b97c1d10bf32e36813c725a80dd6a60f6c0418e294df121bcdc029e	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeexplorer.exe

pid	process
4304	rundll32.exe
4304	rundll32.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

4304 rundll32.exe
3752 regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3992 wrote to memory of 4304	3992	rundll32.exe	rundll32.exe
PID 3992 wrote to memory of 4304	3992	rundll32.exe	rundll32.exe
PID 3992 wrote to memory of 4304	3992	rundll32.exe	rundll32.exe
PID 4304 wrote to memory of 2700	4304	rundll32.exe	explorer.exe
PID 4304 wrote to memory of 2700	4304	rundll32.exe	explorer.exe
PID 4304 wrote to memory of 2700	4304	rundll32.exe	explorer.exe
PID 4304 wrote to memory of 2700	4304	rundll32.exe	explorer.exe
PID 4304 wrote to memory of 2700	4304	rundll32.exe	explorer.exe
PID 2700 wrote to memory of 4264	2700	explorer.exe	schtasks.exe
PID 2700 wrote to memory of 4264	2700	explorer.exe	schtasks.exe
PID 2700 wrote to memory of 4264	2700	explorer.exe	schtasks.exe
PID 740 wrote to memory of 3752	740	regsvr32.exe	regsvr32.exe
PID 740 wrote to memory of 3752	740	regsvr32.exe	regsvr32.exe
PID 740 wrote to memory of 3752	740	regsvr32.exe	regsvr32.exe
PID 3752 wrote to memory of 1484	3752	regsvr32.exe	explorer.exe
PID 3752 wrote to memory of 1484	3752	regsvr32.exe	explorer.exe
PID 3752 wrote to memory of 1484	3752	regsvr32.exe	explorer.exe
PID 3752 wrote to memory of 1484	3752	regsvr32.exe	explorer.exe
PID 3752 wrote to memory of 1484	3752	regsvr32.exe	explorer.exe
PID 1484 wrote to memory of 4900	1484	explorer.exe	reg.exe
PID 1484 wrote to memory of 4900	1484	explorer.exe	reg.exe
PID 1484 wrote to memory of 3556	1484	explorer.exe	reg.exe
PID 1484 wrote to memory of 3556	1484	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08c8093291e391d35310028b3fa0fd130d061e8afec72fff7633026b7fe456ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08c8093291e391d35310028b3fa0fd130d061e8afec72fff7633026b7fe456ac.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 652
3⤵
- Program crash
PID:2844

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wlqjvbnpkm /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\08c8093291e391d35310028b3fa0fd130d061e8afec72fff7633026b7fe456ac.dll\"" /SC ONCE /Z /ST 19:02 /ET 19:14
4⤵
- Creates scheduled task(s)
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4304 -ip 4304
1⤵
PID:1384

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\08c8093291e391d35310028b3fa0fd130d061e8afec72fff7633026b7fe456ac.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\08c8093291e391d35310028b3fa0fd130d061e8afec72fff7633026b7fe456ac.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3752

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Aucejgtn" /d "0"
4⤵
PID:4900

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Kqzwzotz" /d "0"
4⤵
PID:3556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\08c8093291e391d35310028b3fa0fd130d061e8afec72fff7633026b7fe456ac.dll
Filesize
1.7MB

MD5
f6777611b84582a1714ec511ce0f9dcb

SHA1
bfc784473dde678b9f52870c292867100f4472e9

SHA256
08c8093291e391d35310028b3fa0fd130d061e8afec72fff7633026b7fe456ac

SHA512
e864616a8dca7fd1eae740e60c24003801f9ebbfaa553455ca507b79c0d08d3750ae387665e9a94bda0e77d54c539352c200fec7a3cae739ae9440857a2b2729

Download Submit
C:\Users\Admin\AppData\Local\Temp\08c8093291e391d35310028b3fa0fd130d061e8afec72fff7633026b7fe456ac.dll
Filesize
1.7MB

MD5
f6777611b84582a1714ec511ce0f9dcb

SHA1
bfc784473dde678b9f52870c292867100f4472e9

SHA256
08c8093291e391d35310028b3fa0fd130d061e8afec72fff7633026b7fe456ac

SHA512
e864616a8dca7fd1eae740e60c24003801f9ebbfaa553455ca507b79c0d08d3750ae387665e9a94bda0e77d54c539352c200fec7a3cae739ae9440857a2b2729

Download Submit
memory/1484-142-0x0000000000D60000-0x0000000000DEF000-memory.dmp

Filesize
572KB

Download
memory/1484-140-0x0000000000000000-mapping.dmp

Download
memory/2700-132-0x0000000000EE0000-0x0000000000F6F000-memory.dmp

Filesize
572KB

Download
memory/2700-130-0x0000000000000000-mapping.dmp

Download
memory/3556-143-0x0000000000000000-mapping.dmp

Download
memory/3752-139-0x00000000019E0000-0x0000000001A6F000-memory.dmp

Filesize
572KB

Download
memory/3752-134-0x0000000000000000-mapping.dmp

Download
memory/3752-136-0x00000000019E0000-0x0000000001A6F000-memory.dmp

Filesize
572KB

Download
memory/3752-137-0x00000000019E0000-0x0000000001A6F000-memory.dmp

Filesize
572KB

Download
memory/3752-138-0x00000000018C0000-0x000000000194B000-memory.dmp

Filesize
556KB

Download
memory/4264-131-0x0000000000000000-mapping.dmp

Download
memory/4304-129-0x0000000002870000-0x00000000028FF000-memory.dmp

Filesize
572KB

Download
memory/4304-128-0x0000000002870000-0x00000000028FF000-memory.dmp

Filesize
572KB

Download
memory/4304-124-0x0000000000000000-mapping.dmp

Download
memory/4304-127-0x0000000002870000-0x00000000028FF000-memory.dmp

Filesize
572KB

Download
memory/4304-126-0x0000000002750000-0x00000000027DB000-memory.dmp

Filesize
556KB

Download
memory/4304-125-0x0000000002120000-0x00000000022CE000-memory.dmp

Filesize
1.7MB

Download
memory/4900-141-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads