qakbot | 870475779d35088d746aafdab1d205e7dceddf9d236d97e049ecee760dd87508

General

Target

870475779d35088d746aafdab1d205e7dceddf9d236d97e049ecee760dd87508.dll
Size

1.7MB
MD5

1c3839d314110e032334339ac20ee785
SHA1

a5dd1679c30f444e8d8369cbf5c94840cdac987f
SHA256

870475779d35088d746aafdab1d205e7dceddf9d236d97e049ecee760dd87508
SHA512

3b5112eef7baad4ced7557fbd0bb96d6385d0b6767596b1450dae72773d113d5bffd42f6a881f20eda65c6c1a4a898f48dcf4d2600445d1b2150f147e27d48eb
SSDEEP

24576:nKtpZm23yqec9S5hZqT5/ZMoK3EHBCTFvfrr+E+OLzO9AO4k17vvoA+rXBxQHKbC:nC3LoqNG0HBi1X+5OmmPA7Hj+hb

Score

10^/10

qakbot aa 1649273304 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.573

Botnet

AA

Campaign

1649273304

C2

83.110.75.97:2222

47.23.89.62:993

187.207.48.194:61202

45.63.1.12:995

140.82.63.183:995

45.76.167.26:995

140.82.63.183:443

144.202.2.175:995

144.202.3.39:443

149.28.238.199:443

144.202.3.39:995

45.63.1.12:443

149.28.238.199:995

45.76.167.26:443

144.202.2.175:443

100.1.108.246:443

32.221.224.140:995

24.55.67.176:443

31.35.28.29:443

70.51.134.168:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1576 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2012 schtasks.exe
Modifies data under HKEY_USERS 1 IoCs

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Hifyeoyflfv explorer.exe

pid	process
1576	regsvr32.exe

pid	process
2012	schtasks.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hifyeoyflfv	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeexplorer.exeregsvr32.exe

pid	process
1240	rundll32.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1576	regsvr32.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe
1344	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1240 rundll32.exe
1576 regsvr32.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1832 wrote to memory of 1240	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1240	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1240	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1240	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1240	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1240	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1240	1832	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1344	1240	rundll32.exe	explorer.exe
PID 1240 wrote to memory of 1344	1240	rundll32.exe	explorer.exe
PID 1240 wrote to memory of 1344	1240	rundll32.exe	explorer.exe
PID 1240 wrote to memory of 1344	1240	rundll32.exe	explorer.exe
PID 1240 wrote to memory of 1344	1240	rundll32.exe	explorer.exe
PID 1240 wrote to memory of 1344	1240	rundll32.exe	explorer.exe
PID 1344 wrote to memory of 2012	1344	explorer.exe	schtasks.exe
PID 1344 wrote to memory of 2012	1344	explorer.exe	schtasks.exe
PID 1344 wrote to memory of 2012	1344	explorer.exe	schtasks.exe
PID 1344 wrote to memory of 2012	1344	explorer.exe	schtasks.exe
PID 1772 wrote to memory of 1196	1772	taskeng.exe	regsvr32.exe
PID 1772 wrote to memory of 1196	1772	taskeng.exe	regsvr32.exe
PID 1772 wrote to memory of 1196	1772	taskeng.exe	regsvr32.exe
PID 1772 wrote to memory of 1196	1772	taskeng.exe	regsvr32.exe
PID 1772 wrote to memory of 1196	1772	taskeng.exe	regsvr32.exe
PID 1196 wrote to memory of 1576	1196	regsvr32.exe	regsvr32.exe
PID 1196 wrote to memory of 1576	1196	regsvr32.exe	regsvr32.exe
PID 1196 wrote to memory of 1576	1196	regsvr32.exe	regsvr32.exe
PID 1196 wrote to memory of 1576	1196	regsvr32.exe	regsvr32.exe
PID 1196 wrote to memory of 1576	1196	regsvr32.exe	regsvr32.exe
PID 1196 wrote to memory of 1576	1196	regsvr32.exe	regsvr32.exe
PID 1196 wrote to memory of 1576	1196	regsvr32.exe	regsvr32.exe
PID 1576 wrote to memory of 764	1576	regsvr32.exe	explorer.exe
PID 1576 wrote to memory of 764	1576	regsvr32.exe	explorer.exe
PID 1576 wrote to memory of 764	1576	regsvr32.exe	explorer.exe
PID 1576 wrote to memory of 764	1576	regsvr32.exe	explorer.exe
PID 1576 wrote to memory of 764	1576	regsvr32.exe	explorer.exe
PID 1576 wrote to memory of 764	1576	regsvr32.exe	explorer.exe
PID 764 wrote to memory of 2028	764	explorer.exe	reg.exe
PID 764 wrote to memory of 2028	764	explorer.exe	reg.exe
PID 764 wrote to memory of 2028	764	explorer.exe	reg.exe
PID 764 wrote to memory of 2028	764	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\870475779d35088d746aafdab1d205e7dceddf9d236d97e049ecee760dd87508.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\870475779d35088d746aafdab1d205e7dceddf9d236d97e049ecee760dd87508.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pfekmhgcj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\870475779d35088d746aafdab1d205e7dceddf9d236d97e049ecee760dd87508.dll\"" /SC ONCE /Z /ST 15:50 /ET 16:02
4⤵
- Creates scheduled task(s)
PID:2012

C:\Windows\system32\taskeng.exe
taskeng.exe {D91CD439-5C8F-423C-BEC4-C74900BC770B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\870475779d35088d746aafdab1d205e7dceddf9d236d97e049ecee760dd87508.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1196

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\870475779d35088d746aafdab1d205e7dceddf9d236d97e049ecee760dd87508.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Tlqimmunlg" /d "0"
5⤵
PID:2028

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\870475779d35088d746aafdab1d205e7dceddf9d236d97e049ecee760dd87508.dll
Filesize
1.7MB

MD5
1c3839d314110e032334339ac20ee785

SHA1
a5dd1679c30f444e8d8369cbf5c94840cdac987f

SHA256
870475779d35088d746aafdab1d205e7dceddf9d236d97e049ecee760dd87508

SHA512
3b5112eef7baad4ced7557fbd0bb96d6385d0b6767596b1450dae72773d113d5bffd42f6a881f20eda65c6c1a4a898f48dcf4d2600445d1b2150f147e27d48eb

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\870475779d35088d746aafdab1d205e7dceddf9d236d97e049ecee760dd87508.dll
Filesize
1.7MB

MD5
1c3839d314110e032334339ac20ee785

SHA1
a5dd1679c30f444e8d8369cbf5c94840cdac987f

SHA256
870475779d35088d746aafdab1d205e7dceddf9d236d97e049ecee760dd87508

SHA512
3b5112eef7baad4ced7557fbd0bb96d6385d0b6767596b1450dae72773d113d5bffd42f6a881f20eda65c6c1a4a898f48dcf4d2600445d1b2150f147e27d48eb

Download Submit
memory/764-89-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download
memory/764-83-0x0000000000000000-mapping.dmp

Download
memory/1196-70-0x0000000000000000-mapping.dmp

Download
memory/1196-71-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Filesize
8KB

Download
memory/1240-62-0x00000000023C0000-0x000000000244F000-memory.dmp

Filesize
572KB

Download
memory/1240-59-0x00000000023C0000-0x000000000244F000-memory.dmp

Filesize
572KB

Download
memory/1240-54-0x0000000000000000-mapping.dmp

Download
memory/1240-58-0x00000000023C0000-0x000000000244F000-memory.dmp

Filesize
572KB

Download
memory/1240-66-0x00000000023C0000-0x000000000244F000-memory.dmp

Filesize
572KB

Download
memory/1240-56-0x0000000001F40000-0x00000000020EE000-memory.dmp

Filesize
1.7MB

Download
memory/1240-55-0x0000000075AF1000-0x0000000075AF3000-memory.dmp

Filesize
8KB

Download
memory/1240-57-0x00000000023C0000-0x000000000244F000-memory.dmp

Filesize
572KB

Download
memory/1240-61-0x00000000004B0000-0x000000000053B000-memory.dmp

Filesize
556KB

Download
memory/1240-60-0x00000000023C0000-0x000000000244F000-memory.dmp

Filesize
572KB

Download
memory/1344-69-0x00000000000C0000-0x000000000014F000-memory.dmp

Filesize
572KB

Download
memory/1344-67-0x00000000000C0000-0x000000000014F000-memory.dmp

Filesize
572KB

Download
memory/1344-65-0x0000000074981000-0x0000000074983000-memory.dmp

Filesize
8KB

Download
memory/1344-63-0x0000000000000000-mapping.dmp

Download
memory/1576-76-0x00000000009A0000-0x0000000000B4E000-memory.dmp

Filesize
1.7MB

Download
memory/1576-77-0x0000000001140000-0x00000000011CF000-memory.dmp

Filesize
572KB

Download
memory/1576-79-0x0000000001140000-0x00000000011CF000-memory.dmp

Filesize
572KB

Download
memory/1576-80-0x0000000001140000-0x00000000011CF000-memory.dmp

Filesize
572KB

Download
memory/1576-81-0x0000000001020000-0x00000000010AB000-memory.dmp

Filesize
556KB

Download
memory/1576-82-0x0000000001140000-0x00000000011CF000-memory.dmp

Filesize
572KB

Download
memory/1576-78-0x0000000001140000-0x00000000011CF000-memory.dmp

Filesize
572KB

Download
memory/1576-73-0x0000000000000000-mapping.dmp

Download
memory/1576-87-0x0000000001140000-0x00000000011CF000-memory.dmp

Filesize
572KB

Download
memory/2012-68-0x0000000000000000-mapping.dmp

Download
memory/2028-88-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads