qakbot | 1b64ce64b4aa35ebe9259cf56cd159f0cd3220dc0cceb8c0ed5eec14a25a1963

General

Target

J.dll
Size

700KB
MD5

3bfc926058e162af3b5302b22a83fd9c
SHA1

83aa84133fac2d8069dceb21c803d93394512dde
SHA256

1b64ce64b4aa35ebe9259cf56cd159f0cd3220dc0cceb8c0ed5eec14a25a1963
SHA512

db94313d4fa4272ff9611326ec9407d78782c04dbbf5051b288f1b290901f9a950c7d62b133254a07d52318e71a6dae17911cb904db2b6b13e8441d1ec58760d

Score

10^/10

qakbot aa 1656051427 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

AA

Campaign

1656051427

C2

217.128.122.65:2222

24.43.99.75:443

67.209.195.198:443

208.107.221.224:443

70.46.220.114:443

32.221.224.140:995

88.241.122.55:443

186.90.153.162:2222

148.64.96.100:443

197.87.182.93:443

39.44.30.209:995

67.165.206.193:993

118.161.2.13:995

111.125.245.116:995

104.34.212.7:32103

86.200.151.188:2222

41.228.22.180:443

94.59.15.180:2222

24.178.196.158:2222

182.191.92.203:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1928 regsvr32.exe

pid	process
1928	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2032 schtasks.exe

pid	process
2032	schtasks.exe

Modifies data under HKEY_USERS 12 IoCs

Processes:

explorer.exepowershell.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iixnqdiuyezs\48cf38ce = aa5789d6e4f1d76273f2800b4f884679e1d6a92abc1985779f41a42d91b315a80ade4e01df23485548fcc5ace04fd365641c122b7ccbd2f20e2ac22fa5e3bb3c1e73d93698bf962b0cd3324c0074f25ebc53073783eaa57be6290ced1b9cf71b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iixnqdiuyezs\7d50e880 = 307dac6405103cb150ea388fcb7bd52c7e3eb29840160777577b2f2cc052eeff5d2fdbc199fc12ff01cf0e78194ee94b27d2d4214752e1683bda251b211e83611b37a62eafca06250a9d918bd1819ebac05ffa7a3a0ec9cf675ef093abefabe94a8e10921c79531573136d6f239f5d4f7878848d3120c6863d5106076beb041991775ae0b915aacd534ca6310902ee2c6ac4d418709b900b29adc937fef6671c4e84a4daf8e9a2b893aa1ea433b09b123650ef714d0685808c36414b2b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iixnqdiuyezs\baa5e013 = 90d08ee14c9899baad24f8e127dd82be8c6ed9a72207fc9de66eb88939ebf9157dc4fe7c01cdd21dbe54581a8bb5abebb0d9a420090c20c3e5d2a74b57e398f3e1414f4b9bfda7058964b45a79cda8a9ea83877a8a3eb680a1535db32a43bd1db2cfbe	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iixnqdiuyezs\2198776 = d04933bd1878846306c180ae6ab75b2dfd9e7d77c52b954f00900be09a2c65b04e19ee21	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iixnqdiuyezs\48cf38ce = aa579ed6e4f1e424c1a0392697c18b7d20b9886e59a9bc1351671aeb467b7d93cdd789ee78529afce159570d7e2c5584bf89cac21037da89d54dc8d97e6fde2b69ffd70e9bd1f3ebe6cae0a3505e12ade0cc2e9632fa9ebbf8f63a976d8959dec883aafc913b040b54c78006398a315f1083ccb7c5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iixnqdiuyezs\37865738 = 338a9a0135af828c0f77fe16a2f7569789	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 90edfa3cb489d801	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iixnqdiuyezs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iixnqdiuyezs\7f11c8fc = 523049712851f578d1a003e3e95599245ea2c276fb676949668d8569826cb61ed13ad68b2504790d376d752d35f71bcb33485daea027c7df2b77dd47584619e61dbfab2371cfd41124e85cf2f2bf75e72ed45b06e9a9c3b069455c3e268791fa1bbea8d863fdd6b358f7c05d65ffea	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iixnqdiuyezs\c7adaf99 = 16fd4e715badc97d3578b831	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iixnqdiuyezs\c5ec8fe5 = 967d524637551e53cb6c2ffc4b21be9c660475b9252c4a	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeexplorer.exepowershell.exeregsvr32.exe

pid	process
1944	rundll32.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
320	powershell.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1928	regsvr32.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe
1168	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1944 rundll32.exe
1928 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 320 powershell.exe

description	pid	process
Token: SeDebugPrivilege	320	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 596 wrote to memory of 1944	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1944	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1944	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1944	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1944	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1944	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1944	596	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1168	1944	rundll32.exe	explorer.exe
PID 1944 wrote to memory of 1168	1944	rundll32.exe	explorer.exe
PID 1944 wrote to memory of 1168	1944	rundll32.exe	explorer.exe
PID 1944 wrote to memory of 1168	1944	rundll32.exe	explorer.exe
PID 1944 wrote to memory of 1168	1944	rundll32.exe	explorer.exe
PID 1944 wrote to memory of 1168	1944	rundll32.exe	explorer.exe
PID 1168 wrote to memory of 2032	1168	explorer.exe	schtasks.exe
PID 1168 wrote to memory of 2032	1168	explorer.exe	schtasks.exe
PID 1168 wrote to memory of 2032	1168	explorer.exe	schtasks.exe
PID 1168 wrote to memory of 2032	1168	explorer.exe	schtasks.exe
PID 892 wrote to memory of 320	892	taskeng.exe	powershell.exe
PID 892 wrote to memory of 320	892	taskeng.exe	powershell.exe
PID 892 wrote to memory of 320	892	taskeng.exe	powershell.exe
PID 320 wrote to memory of 1388	320	powershell.exe	regsvr32.exe
PID 320 wrote to memory of 1388	320	powershell.exe	regsvr32.exe
PID 320 wrote to memory of 1388	320	powershell.exe	regsvr32.exe
PID 320 wrote to memory of 1388	320	powershell.exe	regsvr32.exe
PID 320 wrote to memory of 1388	320	powershell.exe	regsvr32.exe
PID 1388 wrote to memory of 1928	1388	regsvr32.exe	regsvr32.exe
PID 1388 wrote to memory of 1928	1388	regsvr32.exe	regsvr32.exe
PID 1388 wrote to memory of 1928	1388	regsvr32.exe	regsvr32.exe
PID 1388 wrote to memory of 1928	1388	regsvr32.exe	regsvr32.exe
PID 1388 wrote to memory of 1928	1388	regsvr32.exe	regsvr32.exe
PID 1388 wrote to memory of 1928	1388	regsvr32.exe	regsvr32.exe
PID 1388 wrote to memory of 1928	1388	regsvr32.exe	regsvr32.exe
PID 1928 wrote to memory of 1884	1928	regsvr32.exe	explorer.exe
PID 1928 wrote to memory of 1884	1928	regsvr32.exe	explorer.exe
PID 1928 wrote to memory of 1884	1928	regsvr32.exe	explorer.exe
PID 1928 wrote to memory of 1884	1928	regsvr32.exe	explorer.exe
PID 1928 wrote to memory of 1884	1928	regsvr32.exe	explorer.exe
PID 1928 wrote to memory of 1884	1928	regsvr32.exe	explorer.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\J.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:596

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\J.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 23:27 /tn kqhuuluh /ET 23:38 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwASgAuAGQAbABsACIA" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:2032

C:\Windows\system32\taskeng.exe
taskeng.exe {461035F3-B649-43D1-BC7C-7660C622B458} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwASgAuAGQAbABsACIA
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\J.dll
3⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\J.dll
4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- Modifies data under HKEY_USERS
PID:1884

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\J.dll
Filesize
700KB

MD5
3bfc926058e162af3b5302b22a83fd9c

SHA1
83aa84133fac2d8069dceb21c803d93394512dde

SHA256
1b64ce64b4aa35ebe9259cf56cd159f0cd3220dc0cceb8c0ed5eec14a25a1963

SHA512
db94313d4fa4272ff9611326ec9407d78782c04dbbf5051b288f1b290901f9a950c7d62b133254a07d52318e71a6dae17911cb904db2b6b13e8441d1ec58760d

Download Submit
\Users\Admin\AppData\Local\Temp\J.dll
Filesize
700KB

MD5
3bfc926058e162af3b5302b22a83fd9c

SHA1
83aa84133fac2d8069dceb21c803d93394512dde

SHA256
1b64ce64b4aa35ebe9259cf56cd159f0cd3220dc0cceb8c0ed5eec14a25a1963

SHA512
db94313d4fa4272ff9611326ec9407d78782c04dbbf5051b288f1b290901f9a950c7d62b133254a07d52318e71a6dae17911cb904db2b6b13e8441d1ec58760d

Download Submit
memory/320-72-0x0000000000ED4000-0x0000000000ED7000-memory.dmp

Filesize
12KB

Download
memory/320-70-0x000007FEF4730000-0x000007FEF5153000-memory.dmp

Filesize
10.1MB

Download
memory/320-71-0x000007FEF3BD0000-0x000007FEF472D000-memory.dmp

Filesize
11.4MB

Download
memory/320-77-0x0000000000EDB000-0x0000000000EFA000-memory.dmp

Filesize
124KB

Download
memory/320-76-0x0000000000ED4000-0x0000000000ED7000-memory.dmp

Filesize
12KB

Download
memory/320-73-0x0000000000EDB000-0x0000000000EFA000-memory.dmp

Filesize
124KB

Download
memory/320-68-0x0000000000000000-mapping.dmp

Download
memory/320-69-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Filesize
8KB

Download
memory/1168-61-0x0000000000000000-mapping.dmp

Download
memory/1168-63-0x0000000074D41000-0x0000000074D43000-memory.dmp

Filesize
8KB

Download
memory/1168-65-0x00000000000D0000-0x00000000000F2000-memory.dmp

Filesize
136KB

Download
memory/1168-67-0x00000000000D0000-0x00000000000F2000-memory.dmp

Filesize
136KB

Download
memory/1388-74-0x0000000000000000-mapping.dmp

Download
memory/1884-91-0x00000000000C0000-0x00000000000E2000-memory.dmp

Filesize
136KB

Download
memory/1884-87-0x0000000000000000-mapping.dmp

Download
memory/1928-82-0x0000000000320000-0x0000000000342000-memory.dmp

Filesize
136KB

Download
memory/1928-90-0x0000000000320000-0x0000000000342000-memory.dmp

Filesize
136KB

Download
memory/1928-86-0x0000000000320000-0x0000000000342000-memory.dmp

Filesize
136KB

Download
memory/1928-85-0x00000000004B0000-0x00000000004E6000-memory.dmp

Filesize
216KB

Download
memory/1928-83-0x0000000000320000-0x0000000000342000-memory.dmp

Filesize
136KB

Download
memory/1928-84-0x0000000000320000-0x0000000000342000-memory.dmp

Filesize
136KB

Download
memory/1928-79-0x0000000000000000-mapping.dmp

Download
memory/1944-60-0x00000000002C0000-0x00000000002E2000-memory.dmp

Filesize
136KB

Download
memory/1944-55-0x00000000765C1000-0x00000000765C3000-memory.dmp

Filesize
8KB

Download
memory/1944-56-0x00000000002C0000-0x00000000002E2000-memory.dmp

Filesize
136KB

Download
memory/1944-59-0x0000000000280000-0x00000000002B6000-memory.dmp

Filesize
216KB

Download
memory/1944-57-0x00000000002C0000-0x00000000002E2000-memory.dmp

Filesize
136KB

Download
memory/1944-64-0x00000000002C0000-0x00000000002E2000-memory.dmp

Filesize
136KB

Download
memory/1944-58-0x00000000002C0000-0x00000000002E2000-memory.dmp

Filesize
136KB

Download
memory/1944-54-0x0000000000000000-mapping.dmp

Download
memory/2032-66-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads