qakbot | ee14270f6fd443edaea6a7e4a12d67b8f1a3debe3c3e5f280480db40672c6b26

General

Target

0509.dll
Size

444KB
MD5

cf78caca1237dcc03fec8737d201df91
SHA1

2e840ef80f40a64a6f2d02e58d560a1692d90466
SHA256

ee14270f6fd443edaea6a7e4a12d67b8f1a3debe3c3e5f280480db40672c6b26
SHA512

45dab7158bb45644174ac577233c0011744b7b53b09b7eeb24fca34562f1fdb5e20dd6434f7018234d4b2ccbab8f043562b8fa125891e4f238831b82d99d1833
SSDEEP

12288:nDFhSg4nkx/LMw27kcmgexU51plXKixdvKXsmR:nD3S1T6YhxlNqf

Score

10^/10

qakbot bb 1662650043 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.860

Botnet

BB

Campaign

1662650043

C2

191.97.234.238:995

81.131.161.131:2078

197.94.210.133:443

193.3.19.37:443

70.51.153.182:2222

99.232.140.205:2222

123.240.131.1:443

177.102.84.28:32101

105.156.152.227:443

190.59.247.136:995

89.211.218.88:2222

81.214.220.237:443

85.99.62.74:443

217.165.68.122:993

219.69.103.199:443

37.210.148.30:995

64.207.215.69:443

113.169.57.104:443

179.225.221.169:32101

151.234.94.35:990

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

920 regsvr32.exe

pid	process
920	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2992 schtasks.exe

pid	process
2992	schtasks.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tuktqieboycxfv\964c20fe = 10bd00589764b2f77f240a52ec1453d1fe	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tuktqieboycxfv\6426f823 = 0af874e188222905b0b0e56bd1e4632827c5568e7e14aed985c570b0685bb7d1c5d6df914499c6a12182f3	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tuktqieboycxfv	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tuktqieboycxfv\dedbbf3a = 1574d353c7b647ac4fbb93280d0672c40ce4e6db66a71e1a671b78e6c0c41e7ed0486993f659556ff6544c4b7c98b52635e7839a77eee28d1d7d38d67b970fd5fee24dc6ca79	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tuktqieboycxfv\e9054f08 = c9613eb7f7aad64a0f47757767f568101644996c87a520268c6b37c010be45ed5eadcf5b83de57e74bc4c5ca0ffdfc09d8946e576503e6394043585de724a39cf711db41c0827932ffe5674113b46886bc5d4b65af5a030e32423430f7d543c0d9af717635e5799c5981e4841b50080f813c098d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tuktqieboycxfv\1b6f97d5 = 67aded5d1fa4764c9ec67df86ba8214ec61aad15bbadf294d1c184925796e6c893a9b8c13f72061969e23b4c4721b0519d52185a5f25cb473ee38e119d6d3a8ac162b65923b107d4624b508e2c7aa18b28026165974915b036e3afd688150bae18b7f6fb660c8791d5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tuktqieboycxfv\dc9a9f46 = 93f64e8ef8ea85da6b1510e25435eb5eef41c5dfff6f8222b84e1893c60b5eb122d9e7849e8c368fbaa3705312ec6d3baf784e6882e40200728eb41d80fe9ca45cac4ea94606e1b01022e26fef5de967d9d45501557999349aeb434638a35df4236957bf3b47ce6d6f6ba15af3b97f183e1af5ee3b058ee897240b185af4502a17c1614311067e5e334c452f110b40b8fab3be4424329cf374fab6fabd4aab5b77dbd875cd66563f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tuktqieboycxfv\6667d85f = 40f6068a6b4a997d5ad4a1316c88d7b5645250c3bdd659e1fcc0028624194e59a11263cc5fb5acaf5e705bfa69c3b5f80288e0bdf5b0bc40992744892ff6d156f51e160c5116e9d633b4b163f15a976b78ee4003a7fa1c1391a3a59db9c10479abe42706e9d57f352ae9	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tuktqieboycxfv\e9054f08 = c96129b7f7aae56042be5e7d5ba4469d17b0f521db064f420e9c0465b3f6e00d0f9eeb4787e2dfa4a8ba841aa56ee9e9ee4edd60617b960efbb4d65a1a21239b9c2af187fbad5bc4c20561e6fcca53f1b7ab41a74fb938f23bd27548e67e00	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tuktqieboycxfv\a3d3f0b0 = 3932eeb8a90b6ecde8e45af1d049cfa1f262776e58ba526f055ab4a3dfb5cd0c2211275250cab20c012ed5d16ad053087a93a7cebacf017ecba9	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
4860	regsvr32.exe
4860	regsvr32.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe
4900	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

4860 regsvr32.exe
920 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4908 powershell.exe

description	pid	process
Token: SeDebugPrivilege	4908	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4896 wrote to memory of 4860	4896	regsvr32.exe	regsvr32.exe
PID 4896 wrote to memory of 4860	4896	regsvr32.exe	regsvr32.exe
PID 4896 wrote to memory of 4860	4896	regsvr32.exe	regsvr32.exe
PID 4860 wrote to memory of 4900	4860	regsvr32.exe	explorer.exe
PID 4860 wrote to memory of 4900	4860	regsvr32.exe	explorer.exe
PID 4860 wrote to memory of 4900	4860	regsvr32.exe	explorer.exe
PID 4860 wrote to memory of 4900	4860	regsvr32.exe	explorer.exe
PID 4860 wrote to memory of 4900	4860	regsvr32.exe	explorer.exe
PID 4900 wrote to memory of 2992	4900	explorer.exe	schtasks.exe
PID 4900 wrote to memory of 2992	4900	explorer.exe	schtasks.exe
PID 4900 wrote to memory of 2992	4900	explorer.exe	schtasks.exe
PID 4908 wrote to memory of 3660	4908	powershell.exe	regsvr32.exe
PID 4908 wrote to memory of 3660	4908	powershell.exe	regsvr32.exe
PID 3660 wrote to memory of 920	3660	regsvr32.exe	regsvr32.exe
PID 3660 wrote to memory of 920	3660	regsvr32.exe	regsvr32.exe
PID 3660 wrote to memory of 920	3660	regsvr32.exe	regsvr32.exe
PID 920 wrote to memory of 2968	920	regsvr32.exe	explorer.exe
PID 920 wrote to memory of 2968	920	regsvr32.exe	explorer.exe
PID 920 wrote to memory of 2968	920	regsvr32.exe	explorer.exe
PID 920 wrote to memory of 2968	920	regsvr32.exe	explorer.exe
PID 920 wrote to memory of 2968	920	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0509.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4896

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\0509.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4860

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4900

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 15:40 /tn euwfpxfx /ET 15:51 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMAA1ADAAOQAuAGQAbABsACIA" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:2992

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMAA1ADAAOQAuAGQAbABsACIA
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\0509.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3660

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\0509.dll
3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:920

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
PID:2968

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0509.dll
Filesize
444KB

MD5
cf78caca1237dcc03fec8737d201df91

SHA1
2e840ef80f40a64a6f2d02e58d560a1692d90466

SHA256
ee14270f6fd443edaea6a7e4a12d67b8f1a3debe3c3e5f280480db40672c6b26

SHA512
45dab7158bb45644174ac577233c0011744b7b53b09b7eeb24fca34562f1fdb5e20dd6434f7018234d4b2ccbab8f043562b8fa125891e4f238831b82d99d1833

Download Submit
C:\Users\Admin\AppData\Local\Temp\0509.dll
Filesize
444KB

MD5
cf78caca1237dcc03fec8737d201df91

SHA1
2e840ef80f40a64a6f2d02e58d560a1692d90466

SHA256
ee14270f6fd443edaea6a7e4a12d67b8f1a3debe3c3e5f280480db40672c6b26

SHA512
45dab7158bb45644174ac577233c0011744b7b53b09b7eeb24fca34562f1fdb5e20dd6434f7018234d4b2ccbab8f043562b8fa125891e4f238831b82d99d1833

Download Submit
memory/920-147-0x0000000000E60000-0x0000000000E82000-memory.dmp

Filesize
136KB

Download
memory/920-145-0x0000000000E60000-0x0000000000E82000-memory.dmp

Filesize
136KB

Download
memory/920-142-0x0000000000000000-mapping.dmp

Download
memory/2968-149-0x0000000000330000-0x0000000000352000-memory.dmp

Filesize
136KB

Download
memory/2968-148-0x0000000000330000-0x0000000000352000-memory.dmp

Filesize
136KB

Download
memory/2968-146-0x0000000000000000-mapping.dmp

Download
memory/2992-136-0x0000000000000000-mapping.dmp

Download
memory/3660-140-0x0000000000000000-mapping.dmp

Download
memory/4860-132-0x0000000000000000-mapping.dmp

Download
memory/4860-135-0x0000000001770000-0x0000000001792000-memory.dmp

Filesize
136KB

Download
memory/4860-133-0x0000000001770000-0x0000000001792000-memory.dmp

Filesize
136KB

Download
memory/4900-138-0x0000000000CB0000-0x0000000000CD2000-memory.dmp

Filesize
136KB

Download
memory/4900-137-0x0000000000CB0000-0x0000000000CD2000-memory.dmp

Filesize
136KB

Download
memory/4900-134-0x0000000000000000-mapping.dmp

Download
memory/4908-139-0x000001BB7D2B0000-0x000001BB7D2D2000-memory.dmp

Filesize
136KB

Download
memory/4908-144-0x00007FFC857A0000-0x00007FFC86261000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads