qakbot | 95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d

General

Target

44491.6090605324.dll
Size

890KB
MD5

fdc89b23e17d46173806407132b2903c
SHA1

e425a2d4cd89cb995a5fbf5e9b6671be8c51774f
SHA256

95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d
SHA512

f2dc346c36a879133cefb2ab5df55c1dcab5287630ccebf70d0baa043b65a2a64698f4083b0c2c8f9f7f83612ac0f3d277b120540d828d99ac3581068b007cda

Score

10^/10

qakbot biden54 1634810637 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden54

Campaign

1634810637

C2

136.143.11.232:443

63.143.92.99:995

182.176.180.73:443

136.232.34.70:443

123.252.190.14:443

216.201.162.158:443

37.208.181.198:61200

140.82.49.12:443

197.89.144.102:443

89.137.52.44:443

109.12.111.14:443

78.191.24.189:995

105.198.236.99:995

196.207.140.40:995

41.235.69.115:443

2.222.167.138:443

117.198.156.56:443

24.231.209.2:6881

27.223.92.142:995

96.246.158.154:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Zllmdsd = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Jjcluch = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3940 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1340 schtasks.exe

pid	process
3940	regsvr32.exe

pid	process
1340	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rqxtxfctebrb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rqxtxfctebrb\657ee3df = d88365d4e7edc4bb370ba337cf91bac50daa392fea7ecb63a2344231700079d4c19c93626c1448c7b74224	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rqxtxfctebrb\ddc284ba = 47492ce4f3cb56f3650f2f4f12b7e799be34d422723f87ded52e1896fa8804236e8b6b129b97e8c6aac9fdc145843649423537845a0fc87e4812320237bd46b014d02a5f519b7afdb532867f70f3a1739272421a5b9a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rqxtxfctebrb\a0cacb30 = 8050af837e836044a9a6c26c629729a984194137f40833c4d88628f84b2b973fc393939770a0b54d45c5c60c0d4116	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rqxtxfctebrb\1876ac55 = d851dcdd238e990c98c4b16ed25c5a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rqxtxfctebrb\2de97c1b = 958e9efc6d876e785e10500701222b96072ac59b7107cf058065bea0ce65ea1215b1e27e33b767c971bbfb9719b43e116054d6a2e92102b3cb2d7c94daad3d48440d707b1d6cffba9333a0c94bb9f8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rqxtxfctebrb\52a013ed = afd8affb4cf8efe3cf0dd840cbad338226e529b2b7d39a3c8873d759e40d5bb82cb2c13419e05ee97fac091f0308b4de	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rqxtxfctebrb\52a013ed = afd8b8fb4cf8dab892ed9d30a005715a0f5d176ab33b0e3887eeca	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rqxtxfctebrb\673fc3a3 = 889dec5da3d1226a588383b023477ac9e6b3f835da8d4b784c23389c9227040401a495d942a162ad50bc8622befac7438ebc9d902def809b60b2f57284450060cf76270d06a247422a7da2d7ff7179b650e822844de189bb9a249eb1067f7edefae32179339987929e91dea0b220c344cd38fcccca04e3c628c2f8b7e7fe23eb66a12a621ef5cd6d4f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rqxtxfctebrb\df83a4c6 = acefcd0428ac11b057413799602e0b3cdcbb1955d984	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

5016 rundll32.exe
5016 rundll32.exe
3940 regsvr32.exe
3940 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

5016 rundll32.exe
3940 regsvr32.exe

pid	process
5016	rundll32.exe
5016	rundll32.exe
3940	regsvr32.exe
3940	regsvr32.exe

pid	process
5016	rundll32.exe
3940	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 4904 wrote to memory of 5016	4904	rundll32.exe	rundll32.exe
PID 4904 wrote to memory of 5016	4904	rundll32.exe	rundll32.exe
PID 4904 wrote to memory of 5016	4904	rundll32.exe	rundll32.exe
PID 5016 wrote to memory of 1296	5016	rundll32.exe	explorer.exe
PID 5016 wrote to memory of 1296	5016	rundll32.exe	explorer.exe
PID 5016 wrote to memory of 1296	5016	rundll32.exe	explorer.exe
PID 5016 wrote to memory of 1296	5016	rundll32.exe	explorer.exe
PID 5016 wrote to memory of 1296	5016	rundll32.exe	explorer.exe
PID 1296 wrote to memory of 1340	1296	explorer.exe	schtasks.exe
PID 1296 wrote to memory of 1340	1296	explorer.exe	schtasks.exe
PID 1296 wrote to memory of 1340	1296	explorer.exe	schtasks.exe
PID 3972 wrote to memory of 3940	3972	regsvr32.exe	regsvr32.exe
PID 3972 wrote to memory of 3940	3972	regsvr32.exe	regsvr32.exe
PID 3972 wrote to memory of 3940	3972	regsvr32.exe	regsvr32.exe
PID 3940 wrote to memory of 2560	3940	regsvr32.exe	explorer.exe
PID 3940 wrote to memory of 2560	3940	regsvr32.exe	explorer.exe
PID 3940 wrote to memory of 2560	3940	regsvr32.exe	explorer.exe
PID 3940 wrote to memory of 2560	3940	regsvr32.exe	explorer.exe
PID 3940 wrote to memory of 2560	3940	regsvr32.exe	explorer.exe
PID 2560 wrote to memory of 2044	2560	explorer.exe	reg.exe
PID 2560 wrote to memory of 2044	2560	explorer.exe	reg.exe
PID 2560 wrote to memory of 3692	2560	explorer.exe	reg.exe
PID 2560 wrote to memory of 3692	2560	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44491.6090605324.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44491.6090605324.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5016

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1296

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn icquvpqg /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44491.6090605324.dll\"" /SC ONCE /Z /ST 14:26 /ET 14:38
4⤵
- Creates scheduled task(s)
PID:1340

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44491.6090605324.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3972

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\44491.6090605324.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3940

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2560

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Zllmdsd" /d "0"
4⤵
- Windows security bypass
PID:2044

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Jjcluch" /d "0"
4⤵
- Windows security bypass
PID:3692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44491.6090605324.dll
Filesize
890KB

MD5
fdc89b23e17d46173806407132b2903c

SHA1
e425a2d4cd89cb995a5fbf5e9b6671be8c51774f

SHA256
95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d

SHA512
f2dc346c36a879133cefb2ab5df55c1dcab5287630ccebf70d0baa043b65a2a64698f4083b0c2c8f9f7f83612ac0f3d277b120540d828d99ac3581068b007cda

Download Submit
C:\Users\Admin\AppData\Local\Temp\44491.6090605324.dll
Filesize
890KB

MD5
fdc89b23e17d46173806407132b2903c

SHA1
e425a2d4cd89cb995a5fbf5e9b6671be8c51774f

SHA256
95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d

SHA512
f2dc346c36a879133cefb2ab5df55c1dcab5287630ccebf70d0baa043b65a2a64698f4083b0c2c8f9f7f83612ac0f3d277b120540d828d99ac3581068b007cda

Download Submit
memory/1296-136-0x0000000000000000-mapping.dmp

Download
memory/1296-139-0x0000000001140000-0x0000000001161000-memory.dmp

Filesize
132KB

Download
memory/1296-140-0x0000000001140000-0x0000000001161000-memory.dmp

Filesize
132KB

Download
memory/1340-138-0x0000000000000000-mapping.dmp

Download
memory/2044-151-0x0000000000000000-mapping.dmp

Download
memory/2560-149-0x0000000000000000-mapping.dmp

Download
memory/2560-152-0x0000000001100000-0x0000000001121000-memory.dmp

Filesize
132KB

Download
memory/3692-153-0x0000000000000000-mapping.dmp

Download
memory/3940-142-0x0000000000000000-mapping.dmp

Download
memory/3940-144-0x0000000075100000-0x00000000751F3000-memory.dmp

Filesize
972KB

Download
memory/3940-145-0x0000000075100000-0x0000000075121000-memory.dmp

Filesize
132KB

Download
memory/3940-146-0x0000000075100000-0x00000000751F3000-memory.dmp

Filesize
972KB

Download
memory/3940-148-0x0000000075100000-0x00000000751F3000-memory.dmp

Filesize
972KB

Download
memory/3940-150-0x0000000075100000-0x00000000751F3000-memory.dmp

Filesize
972KB

Download
memory/5016-134-0x0000000075190000-0x0000000075283000-memory.dmp

Filesize
972KB

Download
memory/5016-131-0x0000000075190000-0x0000000075283000-memory.dmp

Filesize
972KB

Download
memory/5016-132-0x0000000075190000-0x0000000075283000-memory.dmp

Filesize
972KB

Download
memory/5016-137-0x0000000075190000-0x0000000075283000-memory.dmp

Filesize
972KB

Download
memory/5016-130-0x0000000000000000-mapping.dmp

Download
memory/5016-133-0x0000000075190000-0x00000000751B1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads