qakbot | 57e28579e8cd60487ca71115bd4367ba45bee5a7e3ea78023bc817d4699c3c9f

General

Target

_Vkc.dll
Size

401KB
MD5

44255200f634646100d6e71e8f5ae7d7
SHA1

ecb47e47e31247d8969ab48a629f2bc2e6cfecec
SHA256

57e28579e8cd60487ca71115bd4367ba45bee5a7e3ea78023bc817d4699c3c9f
SHA512

575e1e4057573df904c34da51ddeb100ec56f762b6f034f6ecb9f938384606e58fb507b4b8a75cdb6ece8ed8a09578f84f0cbf4b269e00a3e7fcc2df2ec04229
SSDEEP

12288:9zlWXAEum0intq9k7PPsVcELe8IrHpDzl/qlhgs:9zQXAEujEQu7Iu8IrHTylhg

Score

10^/10

qakbot bb 1663053540 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

BB

Campaign

1663053540

C2

194.49.79.231:443

193.3.19.37:443

99.232.140.205:2222

47.146.182.110:443

84.38.133.191:443

191.97.234.238:995

37.210.148.30:995

64.207.215.69:443

200.161.62.126:32101

88.245.103.132:2222

86.98.156.176:993

175.110.231.67:443

78.100.254.17:2222

191.84.204.214:995

123.240.131.1:443

197.94.210.133:443

196.92.172.24:8443

186.50.245.74:995

70.51.132.197:2222

100.1.5.250:995

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

876 regsvr32.exe

pid	process
876	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2088 schtasks.exe

pid	process
2088	schtasks.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xyrpbub\3d00d425 = 827ad1830aab8104ac06435bcb6cdfb8e88b78e615a1c039d314739b356d777cc5f16e865ddfd814bdf19bb39cd6b4811d8cdf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xyrpbub\faf5dcb6 = 948b23a2a6b5a70723e9054a5eef3a21afbe45d21bb39ac477b65923eb32792dbf0a22d08863f9726ac0693b916fa33f1c3e1cc1950e99df15d83df7faa03fb504c78e4007ecfeab849b89f0fbdd7939de1acec9572604e01c30098c4e457ff0c970a4380070c04baae3	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xyrpbub\4249bbd3 = 8e8a5683b6fbff0d5498407120d048433bc389c186cd2da1523dc9284622b4392b98c2c0d47228fb8280dac882e4f51ac66178efe1dfe8948c1c996929eda2287356a03e86a0b1b5e0a77493a213f53e4a28976f1ecd23c4e5d9ab90555d28a6f4e8b4943d563d0e329ff1fc0097	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xyrpbub\85bcb340 = 6835cfa6d7e443cb06b2880585d642379265a81407a88d2f9936c02ef66230fe12539834b9c10956b4674397b7c9c38f1d0767ae03b83150ee0198c549f5b500ae968154afaf7ee42802c0b863e2351fd1	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xyrpbub\77d66b9d = 53ac9eee1684ce5b339feaea08d189629a2ab690d73dabb271483a8883ab679788ce832db8358a442a86192b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xyrpbub\89f046b = 0cc592f9f82cc184bb7465951a9b6b999dc4165bcce62e994bf5f070c281847fa78aa9f773b79cdb1d1078f5942cd045d234f20a7364644798c148e96ed6a815b8bf8f06d19c6ce75e5f88a4978a14a475fcd2119fbe17c8c42d5ef471e8772d8a6c62bc0cfb398d0cd3c174066155ff80	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xyrpbub	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xyrpbub\40089baf = d96101a9cae29a4c0f4cd3a319dfff65f4600157157c7f61c43192e04d1c3bef99a96bf0d7ec282e9e554bc4f9de332bfb537881cb52e085dd217d3b0316875bb5f099db4547b46c270f0305f31ee33018ac23ed174109cbcf673b652b24407cb5b8c374f592	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xyrpbub\f8b4fcca = 31c942d69cd799cffe4ea1607bdb6fc58db5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xyrpbub\77d66b9d = 53ac89ee1684fd6e4bbf6ee84ff8ab5ce10cb32921c0f2b81db0b1276b63a4d9ae661f956d7513f4776bcec53d59386a9ac5191ea891aa3c900d1b6a409164b893	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
4260	regsvr32.exe
4260	regsvr32.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe
1484	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

4260 regsvr32.exe
876 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1932 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1932	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4828 wrote to memory of 4260	4828	regsvr32.exe	regsvr32.exe
PID 4828 wrote to memory of 4260	4828	regsvr32.exe	regsvr32.exe
PID 4828 wrote to memory of 4260	4828	regsvr32.exe	regsvr32.exe
PID 4260 wrote to memory of 1484	4260	regsvr32.exe	explorer.exe
PID 4260 wrote to memory of 1484	4260	regsvr32.exe	explorer.exe
PID 4260 wrote to memory of 1484	4260	regsvr32.exe	explorer.exe
PID 4260 wrote to memory of 1484	4260	regsvr32.exe	explorer.exe
PID 4260 wrote to memory of 1484	4260	regsvr32.exe	explorer.exe
PID 1484 wrote to memory of 2088	1484	explorer.exe	schtasks.exe
PID 1484 wrote to memory of 2088	1484	explorer.exe	schtasks.exe
PID 1484 wrote to memory of 2088	1484	explorer.exe	schtasks.exe
PID 1932 wrote to memory of 4584	1932	powershell.exe	regsvr32.exe
PID 1932 wrote to memory of 4584	1932	powershell.exe	regsvr32.exe
PID 4584 wrote to memory of 876	4584	regsvr32.exe	regsvr32.exe
PID 4584 wrote to memory of 876	4584	regsvr32.exe	regsvr32.exe
PID 4584 wrote to memory of 876	4584	regsvr32.exe	regsvr32.exe
PID 876 wrote to memory of 4748	876	regsvr32.exe	explorer.exe
PID 876 wrote to memory of 4748	876	regsvr32.exe	explorer.exe
PID 876 wrote to memory of 4748	876	regsvr32.exe	explorer.exe
PID 876 wrote to memory of 4748	876	regsvr32.exe	explorer.exe
PID 876 wrote to memory of 4748	876	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\_Vkc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4828

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\_Vkc.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4260

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 13:17 /tn gdaprvip /ET 13:28 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAXwBWAGsAYwAuAGQAbABsACIA" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:2088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAXwBWAGsAYwAuAGQAbABsACIA
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\_Vkc.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4584

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\_Vkc.dll
3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:876

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
PID:4748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_Vkc.dll
Filesize
401KB

MD5
44255200f634646100d6e71e8f5ae7d7

SHA1
ecb47e47e31247d8969ab48a629f2bc2e6cfecec

SHA256
57e28579e8cd60487ca71115bd4367ba45bee5a7e3ea78023bc817d4699c3c9f

SHA512
575e1e4057573df904c34da51ddeb100ec56f762b6f034f6ecb9f938384606e58fb507b4b8a75cdb6ece8ed8a09578f84f0cbf4b269e00a3e7fcc2df2ec04229

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Vkc.dll
Filesize
401KB

MD5
44255200f634646100d6e71e8f5ae7d7

SHA1
ecb47e47e31247d8969ab48a629f2bc2e6cfecec

SHA256
57e28579e8cd60487ca71115bd4367ba45bee5a7e3ea78023bc817d4699c3c9f

SHA512
575e1e4057573df904c34da51ddeb100ec56f762b6f034f6ecb9f938384606e58fb507b4b8a75cdb6ece8ed8a09578f84f0cbf4b269e00a3e7fcc2df2ec04229

Download Submit
memory/876-142-0x0000000000000000-mapping.dmp

Download
memory/876-147-0x00000000007A0000-0x00000000007C2000-memory.dmp

Filesize
136KB

Download
memory/876-145-0x00000000007A0000-0x00000000007C2000-memory.dmp

Filesize
136KB

Download
memory/1484-134-0x0000000000000000-mapping.dmp

Download
memory/1484-137-0x0000000000830000-0x0000000000852000-memory.dmp

Filesize
136KB

Download
memory/1484-138-0x0000000000830000-0x0000000000852000-memory.dmp

Filesize
136KB

Download
memory/1932-144-0x00007FFB84590000-0x00007FFB85051000-memory.dmp

Filesize
10.8MB

Download
memory/1932-139-0x000001F251DD0000-0x000001F251DF2000-memory.dmp

Filesize
136KB

Download
memory/2088-136-0x0000000000000000-mapping.dmp

Download
memory/4260-132-0x0000000000000000-mapping.dmp

Download
memory/4260-135-0x0000000000BE0000-0x0000000000C02000-memory.dmp

Filesize
136KB

Download
memory/4260-133-0x0000000000BE0000-0x0000000000C02000-memory.dmp

Filesize
136KB

Download
memory/4584-140-0x0000000000000000-mapping.dmp

Download
memory/4748-146-0x0000000000000000-mapping.dmp

Download
memory/4748-148-0x0000000000490000-0x00000000004B2000-memory.dmp

Filesize
136KB

Download
memory/4748-149-0x0000000000490000-0x00000000004B2000-memory.dmp

Filesize
136KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads