qakbot | 2ea240adf99e7543c3150937e42358ff619564090760b7c24ca57d66229e9330

General

Target

UP2IOb.IOzv.Zm.dll
Size

707KB
MD5

361394f6442e7b7d795550d072346aaf
SHA1

0a74764295fdda77f32704eb8586a6c9f544634b
SHA256

2ea240adf99e7543c3150937e42358ff619564090760b7c24ca57d66229e9330
SHA512

be848447aa6fefbb98acfe5bae3e72d457c8baaa28096f1914cc34eee22132619abd34ed0400fa53a7d3c8414fc2740ca42120b7c6373b6cba707fe23a4a0c05

Score

10^/10

qakbot aa 1656051427 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

AA

Campaign

1656051427

C2

217.128.122.65:2222

24.43.99.75:443

67.209.195.198:443

208.107.221.224:443

70.46.220.114:443

32.221.224.140:995

88.241.122.55:443

186.90.153.162:2222

148.64.96.100:443

197.87.182.93:443

39.44.30.209:995

67.165.206.193:993

118.161.2.13:995

111.125.245.116:995

104.34.212.7:32103

86.200.151.188:2222

41.228.22.180:443

94.59.15.180:2222

24.178.196.158:2222

182.191.92.203:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

676 regsvr32.exe

pid	process
676	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2020 schtasks.exe

pid	process
2020	schtasks.exe

Modifies data under HKEY_USERS 12 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = f0855a8ef887d801	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cumjbvqa\219182a0 = 4fe4c0fd0b8920be59b8f5b1a1fc8e5e34315e76127d72310c8857dfba9ba37507c61f693f26e1a1775980fba913e5b3cfb116bb6fce8f7374a29b9796fd89f6e1b276f5555b699963f99a486f737262ebbd0d383b7d18219be6ea2a04	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cumjbvqa\164f7292 = 60a21e811b5eeff29b7486c07b19aac77afb9d2a39dd36680995eba4e3818b558f7e07dabeff698bdba7ac8b92	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cumjbvqa\d3fb5a7d = dd0f2971489b5d9e5d42ab4e04e99b5ffec3bebe122b0de9c5ad17e76f3838de88975fcc4029b5730c2762eafe66902bb434434f6aff2c00f0a659c65477671f0275562fe656c4c9d2b250b73581fcfca927da7ad2ea5b5e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cumjbvqa\acb2358b = ee61896b18b2e26febc473963b35394b8f6bf02ccd649f75803c54254e214f0f9977cf65a55af9521360ac34c32ce469e3803e072f3fa76b57dd62d48693d62681665773b667	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cumjbvqa\5ed8ed56 = 4242f4a01c0f0a6ef08407fc00b2bd48e821bad881d97ede78e87ae60f1ecd418d12c4e960a5d88d664cc3810ada6f5350a3555ad35490aff516388c25d681da347fb3aae2c4661945479408a9f55c9f4e66	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cumjbvqa\219182a0 = 4fe4d7fd0b891311cc6b3e76c5ec555b723ddb4bba7e75bf1fbe70f6131cfb01069895b356f27729f1050e49dd2f589a323092f9cc2b2eb7e0261de88f4f010c67800bce4d630c6363caa9c16086cb15a4caada41bc6476d16b9e903c147b303b323b16a288c1a3ec572eac213d6579223c1	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Cumjbvqa	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cumjbvqa\140e52ee = 68eb9233ac8fa49edb5686977c66634decdbc3bd9f76da4e0751525a3076c7c43380ecbf688ff88a7a9e614202180d21f53041642038c4bed548cb811c5d9a3ffefc2a95735664d6b03bd0152cbd6f6048861b7a88bffd3d80593e42df6907c1cd6e9452561678b2137263a18f371cb62102fefaf5c5edb0bc0430ceea4f36a1b3f38b89a5ff0a522c920e2cdd9a93f3e4e3a152622cbd9f854bde4d98f0205cd3ba03addb5b0ad1244f50b08ca0beaec459601e375d47a0356a6726	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cumjbvqa\aef315f7 = eef82a43e4a95b1cef123ce795	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cumjbvqa\6b473d18 = 491b88bfe9359954dcef19c3d5714c167fe3e6699ccebc13e29e067e1ca0ccabfa5d791811012c5d1777eaa7b16052a5d4f8743c1cfef67e2f082fc39ecf51033c074799d05b634db2254a08a0a1950487b8bd931a8023894cdcd61588ba61eb8ab120b3319225	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeexplorer.exepowershell.exeregsvr32.exe

pid	process
1792	rundll32.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
612	powershell.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
676	regsvr32.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1792 rundll32.exe
676 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 612 powershell.exe

description	pid	process
Token: SeDebugPrivilege	612	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1068 wrote to memory of 1792	1068	rundll32.exe	rundll32.exe
PID 1068 wrote to memory of 1792	1068	rundll32.exe	rundll32.exe
PID 1068 wrote to memory of 1792	1068	rundll32.exe	rundll32.exe
PID 1068 wrote to memory of 1792	1068	rundll32.exe	rundll32.exe
PID 1068 wrote to memory of 1792	1068	rundll32.exe	rundll32.exe
PID 1068 wrote to memory of 1792	1068	rundll32.exe	rundll32.exe
PID 1068 wrote to memory of 1792	1068	rundll32.exe	rundll32.exe
PID 1792 wrote to memory of 1244	1792	rundll32.exe	explorer.exe
PID 1792 wrote to memory of 1244	1792	rundll32.exe	explorer.exe
PID 1792 wrote to memory of 1244	1792	rundll32.exe	explorer.exe
PID 1792 wrote to memory of 1244	1792	rundll32.exe	explorer.exe
PID 1792 wrote to memory of 1244	1792	rundll32.exe	explorer.exe
PID 1792 wrote to memory of 1244	1792	rundll32.exe	explorer.exe
PID 1244 wrote to memory of 2020	1244	explorer.exe	schtasks.exe
PID 1244 wrote to memory of 2020	1244	explorer.exe	schtasks.exe
PID 1244 wrote to memory of 2020	1244	explorer.exe	schtasks.exe
PID 1244 wrote to memory of 2020	1244	explorer.exe	schtasks.exe
PID 572 wrote to memory of 612	572	taskeng.exe	powershell.exe
PID 572 wrote to memory of 612	572	taskeng.exe	powershell.exe
PID 572 wrote to memory of 612	572	taskeng.exe	powershell.exe
PID 612 wrote to memory of 1832	612	powershell.exe	regsvr32.exe
PID 612 wrote to memory of 1832	612	powershell.exe	regsvr32.exe
PID 612 wrote to memory of 1832	612	powershell.exe	regsvr32.exe
PID 612 wrote to memory of 1832	612	powershell.exe	regsvr32.exe
PID 612 wrote to memory of 1832	612	powershell.exe	regsvr32.exe
PID 1832 wrote to memory of 676	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 676	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 676	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 676	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 676	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 676	1832	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 676	1832	regsvr32.exe	regsvr32.exe
PID 676 wrote to memory of 832	676	regsvr32.exe	explorer.exe
PID 676 wrote to memory of 832	676	regsvr32.exe	explorer.exe
PID 676 wrote to memory of 832	676	regsvr32.exe	explorer.exe
PID 676 wrote to memory of 832	676	regsvr32.exe	explorer.exe
PID 676 wrote to memory of 832	676	regsvr32.exe	explorer.exe
PID 676 wrote to memory of 832	676	regsvr32.exe	explorer.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UP2IOb.IOzv.Zm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UP2IOb.IOzv.Zm.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1244

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 18:31 /tn zblrzkmfty /ET 18:42 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAVQBQADIASQBPAGIALgBJAE8AegB2AC4AWgBtAC4AZABsAGwAIgA=" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:2020

C:\Windows\system32\taskeng.exe
taskeng.exe {41CB11BC-0901-490C-9992-745570BC09FB} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAVQBQADIASQBPAGIALgBJAE8AegB2AC4AWgBtAC4AZABsAGwAIgA=
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:612

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\UP2IOb.IOzv.Zm.dll
3⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\UP2IOb.IOzv.Zm.dll
4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:676

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- Modifies data under HKEY_USERS
PID:832

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UP2IOb.IOzv.Zm.dll
Filesize
707KB

MD5
361394f6442e7b7d795550d072346aaf

SHA1
0a74764295fdda77f32704eb8586a6c9f544634b

SHA256
2ea240adf99e7543c3150937e42358ff619564090760b7c24ca57d66229e9330

SHA512
be848447aa6fefbb98acfe5bae3e72d457c8baaa28096f1914cc34eee22132619abd34ed0400fa53a7d3c8414fc2740ca42120b7c6373b6cba707fe23a4a0c05

Download Submit
\Users\Admin\AppData\Local\Temp\UP2IOb.IOzv.Zm.dll
Filesize
707KB

MD5
361394f6442e7b7d795550d072346aaf

SHA1
0a74764295fdda77f32704eb8586a6c9f544634b

SHA256
2ea240adf99e7543c3150937e42358ff619564090760b7c24ca57d66229e9330

SHA512
be848447aa6fefbb98acfe5bae3e72d457c8baaa28096f1914cc34eee22132619abd34ed0400fa53a7d3c8414fc2740ca42120b7c6373b6cba707fe23a4a0c05

Download Submit
memory/612-69-0x0000000000000000-mapping.dmp

Download
memory/612-78-0x00000000012FB000-0x000000000131A000-memory.dmp

Filesize
124KB

Download
memory/612-77-0x00000000012F4000-0x00000000012F7000-memory.dmp

Filesize
12KB

Download
memory/612-74-0x00000000012FB000-0x000000000131A000-memory.dmp

Filesize
124KB

Download
memory/612-73-0x00000000012F4000-0x00000000012F7000-memory.dmp

Filesize
12KB

Download
memory/612-72-0x000007FEF3DB0000-0x000007FEF490D000-memory.dmp

Filesize
11.4MB

Download
memory/612-71-0x000007FEF4910000-0x000007FEF5333000-memory.dmp

Filesize
10.1MB

Download
memory/612-70-0x000007FEFC3E1000-0x000007FEFC3E3000-memory.dmp

Filesize
8KB

Download
memory/676-80-0x0000000000000000-mapping.dmp

Download
memory/676-87-0x00000000002D0000-0x0000000000306000-memory.dmp

Filesize
216KB

Download
memory/676-84-0x0000000000370000-0x0000000000392000-memory.dmp

Filesize
136KB

Download
memory/676-86-0x0000000000370000-0x0000000000392000-memory.dmp

Filesize
136KB

Download
memory/676-92-0x0000000000370000-0x0000000000392000-memory.dmp

Filesize
136KB

Download
memory/676-85-0x0000000000370000-0x0000000000392000-memory.dmp

Filesize
136KB

Download
memory/676-83-0x0000000000420000-0x00000000004D0000-memory.dmp

Filesize
704KB

Download
memory/676-88-0x0000000000370000-0x0000000000392000-memory.dmp

Filesize
136KB

Download
memory/832-89-0x0000000000000000-mapping.dmp

Download
memory/832-93-0x0000000000320000-0x0000000000342000-memory.dmp

Filesize
136KB

Download
memory/1244-66-0x0000000000320000-0x0000000000342000-memory.dmp

Filesize
136KB

Download
memory/1244-62-0x0000000000000000-mapping.dmp

Download
memory/1244-64-0x0000000074F11000-0x0000000074F13000-memory.dmp

Filesize
8KB

Download
memory/1244-68-0x0000000000320000-0x0000000000342000-memory.dmp

Filesize
136KB

Download
memory/1792-61-0x00000000003C0000-0x00000000003E2000-memory.dmp

Filesize
136KB

Download
memory/1792-55-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1792-54-0x0000000000000000-mapping.dmp

Download
memory/1792-56-0x0000000000270000-0x0000000000320000-memory.dmp

Filesize
704KB

Download
memory/1792-57-0x00000000003C0000-0x00000000003E2000-memory.dmp

Filesize
136KB

Download
memory/1792-58-0x00000000003C0000-0x00000000003E2000-memory.dmp

Filesize
136KB

Download
memory/1792-59-0x00000000003C0000-0x00000000003E2000-memory.dmp

Filesize
136KB

Download
memory/1792-60-0x0000000000340000-0x0000000000376000-memory.dmp

Filesize
216KB

Download
memory/1792-65-0x00000000003C0000-0x00000000003E2000-memory.dmp

Filesize
136KB

Download
memory/1832-75-0x0000000000000000-mapping.dmp

Download
memory/2020-67-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads