qakbot | d953520bee78221267e3d5b1388940a130b706661f866e2daccdb5617b508335

General

Target

d953520bee78221267e3d5b1388940a130b706661f866e2daccdb5617b508335.dll
Size

1.7MB
MD5

447c1e0402d41aab4de7d3144fb59f39
SHA1

cfe590f0a5ee761a2ce0bc4e560da1604f094d48
SHA256

d953520bee78221267e3d5b1388940a130b706661f866e2daccdb5617b508335
SHA512

cae851cbffd6f61c5d0b7998b287225abcf5042c8c48dfd35eb4a50df2b3a47b9c16841118f4badc2cb44d158c95084450f524742973575b533aa6bdf1cb01d2

Score

10^/10

qakbot aa 1649273304 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.573

Botnet

AA

Campaign

1649273304

C2

83.110.75.97:2222

47.23.89.62:993

187.207.48.194:61202

45.63.1.12:995

140.82.63.183:995

45.76.167.26:995

140.82.63.183:443

144.202.2.175:995

144.202.3.39:443

149.28.238.199:443

144.202.3.39:995

45.63.1.12:443

149.28.238.199:995

45.76.167.26:443

144.202.2.175:443

100.1.108.246:443

32.221.224.140:995

24.55.67.176:443

31.35.28.29:443

70.51.134.168:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

288 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1680 schtasks.exe

pid	process
288	regsvr32.exe

pid	process
1680	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Etuetxwxonbbdw\3430c1a5 = 16d9d3dfe628a9b250169e65b71bedc685ad10353a5f3386d23b56b8cd2c3c818552db7bd38e61c2c0b257aeea1b268a6ecef70809f1a866c709f7482dd24a14eef0489f4ea5dfff4fb1948cbcaf6fc2b001827d9d2b34616981b68be397e05f026226b65e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Etuetxwxonbbdw	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Etuetxwxonbbdw\4b79ae53 = f0f92dbd874c0999b459d84cd19722dc3d9d69a2196c7a38aac6f97a196c9b9138069030	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Etuetxwxonbbdw\7ca75e61 = b691f1b5f1b2870282340d2c890adc9671e6e37fc39da2549a50571b9023a4292899df15617fc17bb4cf559ca3cfdde54bde4d72	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Etuetxwxonbbdw\b913768e = e611eb42e32d23f7cf59e07a987f736d11062b6287a31ca8acc4ff80903c7818f0b8bfcf3ef41b1f042e37987909c613f8e4abbee40c8aa4aa92b2736d5e746eaaceb91a6b9d9189027159ae69595186279c8dfe2a675aa8a1b3e3fd5c27362947da3efcee34276fccc75e53891b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Etuetxwxonbbdw\4b79ae53 = f0f93abd874c3cfb9cb6112c2daf77d4af99837c912249e0b5a14f55c2795ad552783c465f13ae32201a86e35f8d1689d34695432daba12d38	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Etuetxwxonbbdw\7ee67e1d = dc67c571004f17fc88d65894fed8399e1e6585b8d6ce9990b8bf7ad93506995338ef6cfc857c61bf6a7d7f3121b1d7f768e116865358261a8326a21f3b0444792ea3d0a9d9a5716e2a7a97abc3c1a6afa06499693c0204152bcd9b09f73d7b4f2dfeb4bd5acd381f757f6c2e97cfa0385c140138b453520e0be53b35cb4186e6f8a21388c6c4786aae9936c7f101f0ac1fe8c7ed06e086f76133ef	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Etuetxwxonbbdw\c41b3904 = 6f8461bf7e1576ab2fd045fcd3f84879f19fbb33b28443a25dc08f2ffc63f739e9d8f98d2b10982bd09ac30f902f9e9b8cef9dc3e30e54c6be467fee8509f8d3c633f2b99f9831	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Etuetxwxonbbdw\1af11eb = 28db47b74a8353fe44a7d786c0c11b9234c9d9e044135944f5e4cbf932232c4c68ea70ebd514a31272c6a2c21e9c8aca8da0a8ba4fd1741e6c424a5cc7bfa0783d50da507cd6c097d50236184682c9fa51bc123edf43c0eec2d2ab	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Etuetxwxonbbdw\c65a1978 = c0280a829e05b57300054f604b129ee3cd318af31a75cc037dc3077308ed7ae3360352e8e3b6787b59ac54cf4663c4	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeexplorer.exe

pid	process
900	rundll32.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe
2036	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

900 rundll32.exe
288 regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 948 wrote to memory of 900	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 900	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 900	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 900	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 900	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 900	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 900	948	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 2036	900	rundll32.exe	explorer.exe
PID 900 wrote to memory of 2036	900	rundll32.exe	explorer.exe
PID 900 wrote to memory of 2036	900	rundll32.exe	explorer.exe
PID 900 wrote to memory of 2036	900	rundll32.exe	explorer.exe
PID 900 wrote to memory of 2036	900	rundll32.exe	explorer.exe
PID 900 wrote to memory of 2036	900	rundll32.exe	explorer.exe
PID 2036 wrote to memory of 1680	2036	explorer.exe	schtasks.exe
PID 2036 wrote to memory of 1680	2036	explorer.exe	schtasks.exe
PID 2036 wrote to memory of 1680	2036	explorer.exe	schtasks.exe
PID 2036 wrote to memory of 1680	2036	explorer.exe	schtasks.exe
PID 1628 wrote to memory of 1236	1628	taskeng.exe	regsvr32.exe
PID 1628 wrote to memory of 1236	1628	taskeng.exe	regsvr32.exe
PID 1628 wrote to memory of 1236	1628	taskeng.exe	regsvr32.exe
PID 1628 wrote to memory of 1236	1628	taskeng.exe	regsvr32.exe
PID 1628 wrote to memory of 1236	1628	taskeng.exe	regsvr32.exe
PID 1236 wrote to memory of 288	1236	regsvr32.exe	regsvr32.exe
PID 1236 wrote to memory of 288	1236	regsvr32.exe	regsvr32.exe
PID 1236 wrote to memory of 288	1236	regsvr32.exe	regsvr32.exe
PID 1236 wrote to memory of 288	1236	regsvr32.exe	regsvr32.exe
PID 1236 wrote to memory of 288	1236	regsvr32.exe	regsvr32.exe
PID 1236 wrote to memory of 288	1236	regsvr32.exe	regsvr32.exe
PID 1236 wrote to memory of 288	1236	regsvr32.exe	regsvr32.exe
PID 288 wrote to memory of 436	288	regsvr32.exe	explorer.exe
PID 288 wrote to memory of 436	288	regsvr32.exe	explorer.exe
PID 288 wrote to memory of 436	288	regsvr32.exe	explorer.exe
PID 288 wrote to memory of 436	288	regsvr32.exe	explorer.exe
PID 288 wrote to memory of 436	288	regsvr32.exe	explorer.exe
PID 288 wrote to memory of 436	288	regsvr32.exe	explorer.exe
PID 436 wrote to memory of 968	436	explorer.exe	reg.exe
PID 436 wrote to memory of 968	436	explorer.exe	reg.exe
PID 436 wrote to memory of 968	436	explorer.exe	reg.exe
PID 436 wrote to memory of 968	436	explorer.exe	reg.exe
PID 436 wrote to memory of 1316	436	explorer.exe	reg.exe
PID 436 wrote to memory of 1316	436	explorer.exe	reg.exe
PID 436 wrote to memory of 1316	436	explorer.exe	reg.exe
PID 436 wrote to memory of 1316	436	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d953520bee78221267e3d5b1388940a130b706661f866e2daccdb5617b508335.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d953520bee78221267e3d5b1388940a130b706661f866e2daccdb5617b508335.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn byjiscezny /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\d953520bee78221267e3d5b1388940a130b706661f866e2daccdb5617b508335.dll\"" /SC ONCE /Z /ST 01:02 /ET 01:14
4⤵
- Creates scheduled task(s)
PID:1680

C:\Windows\system32\taskeng.exe
taskeng.exe {9145EC09-859F-418B-97E4-E6A83047B512} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\d953520bee78221267e3d5b1388940a130b706661f866e2daccdb5617b508335.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\d953520bee78221267e3d5b1388940a130b706661f866e2daccdb5617b508335.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:288

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:436

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Umsbc" /d "0"
5⤵
PID:968

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Yyvqbxewz" /d "0"
5⤵
PID:1316

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d953520bee78221267e3d5b1388940a130b706661f866e2daccdb5617b508335.dll
Filesize
1.7MB

MD5
447c1e0402d41aab4de7d3144fb59f39

SHA1
cfe590f0a5ee761a2ce0bc4e560da1604f094d48

SHA256
d953520bee78221267e3d5b1388940a130b706661f866e2daccdb5617b508335

SHA512
cae851cbffd6f61c5d0b7998b287225abcf5042c8c48dfd35eb4a50df2b3a47b9c16841118f4badc2cb44d158c95084450f524742973575b533aa6bdf1cb01d2

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\d953520bee78221267e3d5b1388940a130b706661f866e2daccdb5617b508335.dll
Filesize
1.7MB

MD5
447c1e0402d41aab4de7d3144fb59f39

SHA1
cfe590f0a5ee761a2ce0bc4e560da1604f094d48

SHA256
d953520bee78221267e3d5b1388940a130b706661f866e2daccdb5617b508335

SHA512
cae851cbffd6f61c5d0b7998b287225abcf5042c8c48dfd35eb4a50df2b3a47b9c16841118f4badc2cb44d158c95084450f524742973575b533aa6bdf1cb01d2

Download Submit
memory/288-78-0x0000000001270000-0x00000000012FF000-memory.dmp

Filesize
572KB

Download
memory/288-82-0x0000000001270000-0x00000000012FF000-memory.dmp

Filesize
572KB

Download
memory/288-81-0x0000000000E50000-0x0000000000EDB000-memory.dmp

Filesize
556KB

Download
memory/288-79-0x0000000001270000-0x00000000012FF000-memory.dmp

Filesize
572KB

Download
memory/288-80-0x0000000001270000-0x00000000012FF000-memory.dmp

Filesize
572KB

Download
memory/288-77-0x0000000001270000-0x00000000012FF000-memory.dmp

Filesize
572KB

Download
memory/288-76-0x0000000000BA0000-0x0000000000D4E000-memory.dmp

Filesize
1.7MB

Download
memory/288-73-0x0000000000000000-mapping.dmp

Download
memory/436-85-0x0000000000000000-mapping.dmp

Download
memory/436-91-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download
memory/900-61-0x0000000000270000-0x00000000002FB000-memory.dmp

Filesize
556KB

Download
memory/900-57-0x00000000023E0000-0x000000000246F000-memory.dmp

Filesize
572KB

Download
memory/900-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/900-56-0x0000000001F00000-0x00000000020AE000-memory.dmp

Filesize
1.7MB

Download
memory/900-58-0x00000000023E0000-0x000000000246F000-memory.dmp

Filesize
572KB

Download
memory/900-60-0x00000000023E0000-0x000000000246F000-memory.dmp

Filesize
572KB

Download
memory/900-59-0x00000000023E0000-0x000000000246F000-memory.dmp

Filesize
572KB

Download
memory/900-54-0x0000000000000000-mapping.dmp

Download
memory/900-62-0x00000000023E0000-0x000000000246F000-memory.dmp

Filesize
572KB

Download
memory/968-89-0x0000000000000000-mapping.dmp

Download
memory/1236-70-0x0000000000000000-mapping.dmp

Download
memory/1236-71-0x000007FEFBA91000-0x000007FEFBA93000-memory.dmp

Filesize
8KB

Download
memory/1316-90-0x0000000000000000-mapping.dmp

Download
memory/1680-68-0x0000000000000000-mapping.dmp

Download
memory/2036-63-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/2036-65-0x0000000000000000-mapping.dmp

Download
memory/2036-67-0x00000000746F1000-0x00000000746F3000-memory.dmp

Filesize
8KB

Download
memory/2036-69-0x0000000000440000-0x00000000004CF000-memory.dmp

Filesize
572KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads