qakbot | efaed060bf01cebf44bb659f76f5c8bf067c97c1f450b2f1281e8ee850cd89d4

General

Target

A.dll
Size

1.0MB
MD5

db6e2f57fbe6af542283e61b991f8255
SHA1

12185f5db0851a5c5b0868d4661bd873aa2ca90e
SHA256

efaed060bf01cebf44bb659f76f5c8bf067c97c1f450b2f1281e8ee850cd89d4
SHA512

237a73b4d28d5a3cc94e55ecd870a549f801d777c00842c5fd82e5abb131d253ec6933c75a3beed004b58596955c00ef03dbae920fed592bdd834656542098a0

Score

10^/10

qakbot aa 1655971687 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

AA

Campaign

1655971687

C2

38.70.253.226:2222

47.23.89.60:993

120.150.218.241:995

117.248.109.38:21

37.34.253.233:443

86.132.14.70:2078

111.125.245.116:995

217.165.85.191:993

176.45.232.204:995

5.32.41.45:443

93.48.80.198:995

100.38.242.113:995

94.59.252.166:2222

74.14.5.179:2222

71.13.93.154:2222

193.253.44.249:2222

108.60.213.141:443

45.241.231.78:993

217.128.122.65:2222

40.134.246.185:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1908 regsvr32.exe

pid	process
1908	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1104 schtasks.exe

pid	process
1104	schtasks.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = d0b77f530c87d801	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hzqhzeufeatek	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeexplorer.exepowershell.exeregsvr32.exe

pid	process
1892	rundll32.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
540	powershell.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
1908	regsvr32.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe
2044	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1892 rundll32.exe
1908 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 540 powershell.exe

description	pid	process
Token: SeDebugPrivilege	540	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2016 wrote to memory of 1892	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1892	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1892	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1892	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1892	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1892	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 1892	2016	rundll32.exe	rundll32.exe
PID 1892 wrote to memory of 2044	1892	rundll32.exe	explorer.exe
PID 1892 wrote to memory of 2044	1892	rundll32.exe	explorer.exe
PID 1892 wrote to memory of 2044	1892	rundll32.exe	explorer.exe
PID 1892 wrote to memory of 2044	1892	rundll32.exe	explorer.exe
PID 1892 wrote to memory of 2044	1892	rundll32.exe	explorer.exe
PID 1892 wrote to memory of 2044	1892	rundll32.exe	explorer.exe
PID 2044 wrote to memory of 1104	2044	explorer.exe	schtasks.exe
PID 2044 wrote to memory of 1104	2044	explorer.exe	schtasks.exe
PID 2044 wrote to memory of 1104	2044	explorer.exe	schtasks.exe
PID 2044 wrote to memory of 1104	2044	explorer.exe	schtasks.exe
PID 568 wrote to memory of 540	568	taskeng.exe	powershell.exe
PID 568 wrote to memory of 540	568	taskeng.exe	powershell.exe
PID 568 wrote to memory of 540	568	taskeng.exe	powershell.exe
PID 540 wrote to memory of 1932	540	powershell.exe	regsvr32.exe
PID 540 wrote to memory of 1932	540	powershell.exe	regsvr32.exe
PID 540 wrote to memory of 1932	540	powershell.exe	regsvr32.exe
PID 540 wrote to memory of 1932	540	powershell.exe	regsvr32.exe
PID 540 wrote to memory of 1932	540	powershell.exe	regsvr32.exe
PID 1932 wrote to memory of 1908	1932	regsvr32.exe	regsvr32.exe
PID 1932 wrote to memory of 1908	1932	regsvr32.exe	regsvr32.exe
PID 1932 wrote to memory of 1908	1932	regsvr32.exe	regsvr32.exe
PID 1932 wrote to memory of 1908	1932	regsvr32.exe	regsvr32.exe
PID 1932 wrote to memory of 1908	1932	regsvr32.exe	regsvr32.exe
PID 1932 wrote to memory of 1908	1932	regsvr32.exe	regsvr32.exe
PID 1932 wrote to memory of 1908	1932	regsvr32.exe	regsvr32.exe
PID 1908 wrote to memory of 1256	1908	regsvr32.exe	explorer.exe
PID 1908 wrote to memory of 1256	1908	regsvr32.exe	explorer.exe
PID 1908 wrote to memory of 1256	1908	regsvr32.exe	explorer.exe
PID 1908 wrote to memory of 1256	1908	regsvr32.exe	explorer.exe
PID 1908 wrote to memory of 1256	1908	regsvr32.exe	explorer.exe
PID 1908 wrote to memory of 1256	1908	regsvr32.exe	explorer.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\A.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\A.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 14:20 /tn zhinxvnhd /ET 14:31 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAQQAuAGQAbABsACIA" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\taskeng.exe
taskeng.exe {730F76EE-A3C6-4D19-AD2E-77B54A1C454F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAQQAuAGQAbABsACIA
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\A.dll
3⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\A.dll
4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- Modifies data under HKEY_USERS
PID:1256

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A.dll
Filesize
1.0MB

MD5
db6e2f57fbe6af542283e61b991f8255

SHA1
12185f5db0851a5c5b0868d4661bd873aa2ca90e

SHA256
efaed060bf01cebf44bb659f76f5c8bf067c97c1f450b2f1281e8ee850cd89d4

SHA512
237a73b4d28d5a3cc94e55ecd870a549f801d777c00842c5fd82e5abb131d253ec6933c75a3beed004b58596955c00ef03dbae920fed592bdd834656542098a0

Download Submit
\Users\Admin\AppData\Local\Temp\A.dll
Filesize
1.0MB

MD5
db6e2f57fbe6af542283e61b991f8255

SHA1
12185f5db0851a5c5b0868d4661bd873aa2ca90e

SHA256
efaed060bf01cebf44bb659f76f5c8bf067c97c1f450b2f1281e8ee850cd89d4

SHA512
237a73b4d28d5a3cc94e55ecd870a549f801d777c00842c5fd82e5abb131d253ec6933c75a3beed004b58596955c00ef03dbae920fed592bdd834656542098a0

Download Submit
memory/540-78-0x00000000011CB000-0x00000000011EA000-memory.dmp

Filesize
124KB

Download
memory/540-74-0x00000000011CB000-0x00000000011EA000-memory.dmp

Filesize
124KB

Download
memory/540-73-0x000007FEF4050000-0x000007FEF4BAD000-memory.dmp

Filesize
11.4MB

Download
memory/540-72-0x00000000011C4000-0x00000000011C7000-memory.dmp

Filesize
12KB

Download
memory/540-77-0x00000000011C4000-0x00000000011C7000-memory.dmp

Filesize
12KB

Download
memory/540-71-0x000007FEF4BB0000-0x000007FEF55D3000-memory.dmp

Filesize
10.1MB

Download
memory/540-70-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Filesize
8KB

Download
memory/540-69-0x0000000000000000-mapping.dmp

Download
memory/1104-67-0x0000000000000000-mapping.dmp

Download
memory/1256-90-0x0000000000000000-mapping.dmp

Download
memory/1892-58-0x0000000000460000-0x0000000000482000-memory.dmp

Filesize
136KB

Download
memory/1892-54-0x0000000000000000-mapping.dmp

Download
memory/1892-65-0x0000000000460000-0x0000000000482000-memory.dmp

Filesize
136KB

Download
memory/1892-61-0x0000000000460000-0x0000000000482000-memory.dmp

Filesize
136KB

Download
memory/1892-60-0x00000000001B0000-0x00000000001D2000-memory.dmp

Filesize
136KB

Download
memory/1892-59-0x0000000000460000-0x0000000000482000-memory.dmp

Filesize
136KB

Download
memory/1892-57-0x0000000000460000-0x0000000000482000-memory.dmp

Filesize
136KB

Download
memory/1892-56-0x0000000000280000-0x000000000038D000-memory.dmp

Filesize
1.1MB

Download
memory/1892-55-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

Filesize
8KB

Download
memory/1908-80-0x0000000000000000-mapping.dmp

Download
memory/1908-83-0x0000000000A90000-0x0000000000B9D000-memory.dmp

Filesize
1.1MB

Download
memory/1908-84-0x0000000000330000-0x0000000000352000-memory.dmp

Filesize
136KB

Download
memory/1908-86-0x0000000000230000-0x0000000000252000-memory.dmp

Filesize
136KB

Download
memory/1908-88-0x0000000000330000-0x0000000000352000-memory.dmp

Filesize
136KB

Download
memory/1908-85-0x0000000000330000-0x0000000000352000-memory.dmp

Filesize
136KB

Download
memory/1908-89-0x0000000000330000-0x0000000000352000-memory.dmp

Filesize
136KB

Download
memory/1908-93-0x0000000000330000-0x0000000000352000-memory.dmp

Filesize
136KB

Download
memory/1932-75-0x0000000000000000-mapping.dmp

Download
memory/2044-68-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/2044-66-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/2044-64-0x0000000075051000-0x0000000075053000-memory.dmp

Filesize
8KB

Download
memory/2044-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads