qakbot | 8e9fe7e5c784f21faa30ebb22c971446035c7d83069eac3d0bbe85f23542fda9

General

Target

qbot.dll
Size

443KB
MD5

c5580f721f826a8ecdb86826c4f3a056
SHA1

07d78105110f6d1657785f606a9f5fdf9742c256
SHA256

8e9fe7e5c784f21faa30ebb22c971446035c7d83069eac3d0bbe85f23542fda9
SHA512

529e5af530450742f82944a6375dd00594cd199938b632ce585913f1aaa7eb8101ec5e2b500bda943954d19069cf31bc517f07779dbf02de9e2ef4cbfc636937
SSDEEP

12288:nDFhSg4nkx/LMw27kcmgexU51plXKixdvKXsmR:nD3S1T6YhxlNqf

Score

10^/10

qakbot bb 1662650043 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.860

Botnet

BB

Campaign

1662650043

C2

191.97.234.238:995

81.131.161.131:2078

197.94.210.133:443

193.3.19.37:443

70.51.153.182:2222

99.232.140.205:2222

123.240.131.1:443

177.102.84.28:32101

105.156.152.227:443

190.59.247.136:995

89.211.218.88:2222

81.214.220.237:443

85.99.62.74:443

217.165.68.122:993

219.69.103.199:443

37.210.148.30:995

64.207.215.69:443

113.169.57.104:443

179.225.221.169:32101

151.234.94.35:990

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1368 regsvr32.exe

pid	process
1368	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1860 schtasks.exe

pid	process
1860	schtasks.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

explorer.exepowershell.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktmhwwzvz\776aa08e = b2dd0d9e42d6ef49e1ab6da03e36b1554ea18ccd21e4f0353fbbd0aa776303ecf32572565037745234017c	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktmhwwzvz	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktmhwwzvz\f80837d9 = ea305ea63192313ad5fc161a39afbad6b92083212b0aa6a3c04f8b44600452	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktmhwwzvz\cfd6c7eb = 3e5e286459bd4e2052d1b74581c704d49cb846efa790bd57fb539996f661077d17fb38aa1aea02eac172cfd66116688b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktmhwwzvz\752b80f2 = 1594c706883565fad34654d568f8	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktmhwwzvz\8741582f = dfc4af62e7435a853b5c1e64cce3d9f7947c11cc32590bed60f973d731304d0b2d2349bfc2105b2f8dfd41d167c3babd382f2c68f23c719376465cc405cdfccde82417627a4880fc10aa3faa1070a1835168d96e97b8f3a78e51ca939b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktmhwwzvz\f80837d9 = ea3049a631920245c32c7f86b4ebee2f1567bca4ca10cb0f524d5c33a949d62b55147fd7401caa4e583fca6761224b593d2bf584	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktmhwwzvz\cd97e797 = e6fed95d87ea348db1e8c7553589ca285403d7405dde5d96c252e9bb37b1e1f970c04beff53ce3d1c877299778890cd5e38536f222d94cd427cefaa7f473fe9c63b64543d7c248891cfdbae4abfc173feceb6e8f964cc505471013207d84701092c71ba3ed0ef06448	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktmhwwzvz\a62ef04 = 490b9edee1a22a6303685bc1c78eca1593	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktmhwwzvz\b2de8861 = 8021f5b930793b705725ee173e691c5cfca3934a129322ca41ac68522a17df41290666514cc4e8a9942e9a	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
632	regsvr32.exe
632	regsvr32.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe
1244	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

632 regsvr32.exe
1368 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2924 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2924	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4960 wrote to memory of 632	4960	regsvr32.exe	regsvr32.exe
PID 4960 wrote to memory of 632	4960	regsvr32.exe	regsvr32.exe
PID 4960 wrote to memory of 632	4960	regsvr32.exe	regsvr32.exe
PID 632 wrote to memory of 1244	632	regsvr32.exe	explorer.exe
PID 632 wrote to memory of 1244	632	regsvr32.exe	explorer.exe
PID 632 wrote to memory of 1244	632	regsvr32.exe	explorer.exe
PID 632 wrote to memory of 1244	632	regsvr32.exe	explorer.exe
PID 632 wrote to memory of 1244	632	regsvr32.exe	explorer.exe
PID 1244 wrote to memory of 1860	1244	explorer.exe	schtasks.exe
PID 1244 wrote to memory of 1860	1244	explorer.exe	schtasks.exe
PID 1244 wrote to memory of 1860	1244	explorer.exe	schtasks.exe
PID 2924 wrote to memory of 4320	2924	powershell.exe	regsvr32.exe
PID 2924 wrote to memory of 4320	2924	powershell.exe	regsvr32.exe
PID 4320 wrote to memory of 1368	4320	regsvr32.exe	regsvr32.exe
PID 4320 wrote to memory of 1368	4320	regsvr32.exe	regsvr32.exe
PID 4320 wrote to memory of 1368	4320	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 3128	1368	regsvr32.exe	explorer.exe
PID 1368 wrote to memory of 3128	1368	regsvr32.exe	explorer.exe
PID 1368 wrote to memory of 3128	1368	regsvr32.exe	explorer.exe
PID 1368 wrote to memory of 3128	1368	regsvr32.exe	explorer.exe
PID 1368 wrote to memory of 3128	1368	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\qbot.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4960

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\qbot.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:632

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1244

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 15:45 /tn zbemqsp /ET 15:56 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcQBiAG8AdAAuAGQAbABsACIA" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:1860

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcQBiAG8AdAAuAGQAbABsACIA
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\qbot.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4320

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\qbot.dll
3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
PID:3128

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\qbot.dll
Filesize
443KB

MD5
c5580f721f826a8ecdb86826c4f3a056

SHA1
07d78105110f6d1657785f606a9f5fdf9742c256

SHA256
8e9fe7e5c784f21faa30ebb22c971446035c7d83069eac3d0bbe85f23542fda9

SHA512
529e5af530450742f82944a6375dd00594cd199938b632ce585913f1aaa7eb8101ec5e2b500bda943954d19069cf31bc517f07779dbf02de9e2ef4cbfc636937

Download Submit
C:\Users\Admin\AppData\Local\Temp\qbot.dll
Filesize
443KB

MD5
c5580f721f826a8ecdb86826c4f3a056

SHA1
07d78105110f6d1657785f606a9f5fdf9742c256

SHA256
8e9fe7e5c784f21faa30ebb22c971446035c7d83069eac3d0bbe85f23542fda9

SHA512
529e5af530450742f82944a6375dd00594cd199938b632ce585913f1aaa7eb8101ec5e2b500bda943954d19069cf31bc517f07779dbf02de9e2ef4cbfc636937

Download Submit
memory/632-132-0x0000000000000000-mapping.dmp

Download
memory/632-133-0x00000000014F0000-0x0000000001512000-memory.dmp

Filesize
136KB

Download
memory/632-135-0x00000000014F0000-0x0000000001512000-memory.dmp

Filesize
136KB

Download
memory/1244-134-0x0000000000000000-mapping.dmp

Download
memory/1244-137-0x00000000006E0000-0x0000000000702000-memory.dmp

Filesize
136KB

Download
memory/1244-138-0x00000000006E0000-0x0000000000702000-memory.dmp

Filesize
136KB

Download
memory/1368-147-0x00000000016C0000-0x00000000016E2000-memory.dmp

Filesize
136KB

Download
memory/1368-145-0x00000000016C0000-0x00000000016E2000-memory.dmp

Filesize
136KB

Download
memory/1368-142-0x0000000000000000-mapping.dmp

Download
memory/1860-136-0x0000000000000000-mapping.dmp

Download
memory/2924-144-0x00007FFA78FD0000-0x00007FFA79A91000-memory.dmp

Filesize
10.8MB

Download
memory/2924-139-0x00000274BC160000-0x00000274BC182000-memory.dmp

Filesize
136KB

Download
memory/3128-146-0x0000000000000000-mapping.dmp

Download
memory/3128-148-0x0000000000990000-0x00000000009B2000-memory.dmp

Filesize
136KB

Download
memory/3128-149-0x0000000000990000-0x00000000009B2000-memory.dmp

Filesize
136KB

Download
memory/4320-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads