qakbot | 95682615b30f5ea299b4e60dba79f83b6d09052acab3cb9e1730b480b7dab340

General

Target

folkzaha.dll
Size

440KB
MD5

117820c96b9443cdf6f8b32051ce40ae
SHA1

abd58883ca721f4796b24c788c5f76d36f191b4f
SHA256

95682615b30f5ea299b4e60dba79f83b6d09052acab3cb9e1730b480b7dab340
SHA512

007fc72e96edf72dc3429a0fdfa5d21dbafec0b40eb99f30e2cecc7e23ebfef3bb5f036a22606d10481dc85031414c9acd163aa96adb90654ebea83c1a73bd18
SSDEEP

6144:pnO4pVZMiTaRCLldgZO1nRY4DAOS/+gFlv4K0r1IppzNKRaqaBy0354:qiTa8nY/+gX4fWLzNKYrBy035

Score

10^/10

qakbot bb 1663053540 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

BB

Campaign

1663053540

C2

194.49.79.231:443

193.3.19.37:443

99.232.140.205:2222

47.146.182.110:443

84.38.133.191:443

191.97.234.238:995

37.210.148.30:995

64.207.215.69:443

200.161.62.126:32101

88.245.103.132:2222

86.98.156.176:993

175.110.231.67:443

78.100.254.17:2222

191.84.204.214:995

123.240.131.1:443

197.94.210.133:443

196.92.172.24:8443

186.50.245.74:995

70.51.132.197:2222

100.1.5.250:995

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3644 regsvr32.exe

pid	process
3644	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

684 schtasks.exe

pid	process
684	schtasks.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

explorer.exepowershell.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aopuhcsigq\d3175 = 04b3bad6eb80cd3b6801f628222398d55d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aopuhcsigq\c5b9199a = 6df6a11f35f7ddbb1b3831cb93a0db76a7ca08d1	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aopuhcsigq\7d057eff = b6ee141b08c51137cc5efb52952a2d0767a6285ea77729c8f475990e8d281fbcfc58c083f20b54fd66640dff53f8a90413055d498d537c05173d5121f9	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aopuhcsigq\8d2e865e = c4b076f0d3c4acbdf0423531968ba729b9cd6fc2bcc4ba33b0d36735b41d570f0aff59641e84bb1140732d6a7d55a6757323c6cf0f00ecd1c54c03bd996933c50eed5be85ee7fd35d03bc2917ab072d5828084e8a7	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aopuhcsigq\c7f839e6 = cf351889a1db4f077881994939cc973c992bcf6cbd77829c93aed712f8cdaa8462912a3f7232d28ae890619cba8db28535cb841048b8948cf3076f17e21fccf1f42ca9de65f29b0ea076990b4f85be8dc4577452155af8ce6adc26edaaa876b554606e63a9cdcaa5f034f5ed2f35	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aopuhcsigq\7f445e83 = 2e3391133d5e5882c22dfb7edcf74a8e5b0df1e261877ff0d12a75f15ae4d4c91b488762d336198e48b5807549e7cb	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aopuhcsigq	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aopuhcsigq\f267e9a8 = bbe132c5ae632d5ecd525ff5fc24e05b7f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aopuhcsigq\b8b15610 = ddf0becf37420d7e29a5c35d16111d1f5a4e9348a768a917d71d7bdcffefe2d1f249ae4b01f3cd0b05874a114f08972918	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aopuhcsigq\f267e9a8 = bbe125c5ae631ede6250bda498e9aeef1db9e75484908d717969096480b8b811c7a31442268f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
1556	regsvr32.exe
1556	regsvr32.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe
752	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1556 regsvr32.exe
3644 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3964 powershell.exe

description	pid	process
Token: SeDebugPrivilege	3964	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4468 wrote to memory of 1556	4468	regsvr32.exe	regsvr32.exe
PID 4468 wrote to memory of 1556	4468	regsvr32.exe	regsvr32.exe
PID 4468 wrote to memory of 1556	4468	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 752	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 752	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 752	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 752	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 752	1556	regsvr32.exe	explorer.exe
PID 752 wrote to memory of 684	752	explorer.exe	schtasks.exe
PID 752 wrote to memory of 684	752	explorer.exe	schtasks.exe
PID 752 wrote to memory of 684	752	explorer.exe	schtasks.exe
PID 3964 wrote to memory of 3712	3964	powershell.exe	regsvr32.exe
PID 3964 wrote to memory of 3712	3964	powershell.exe	regsvr32.exe
PID 3712 wrote to memory of 3644	3712	regsvr32.exe	regsvr32.exe
PID 3712 wrote to memory of 3644	3712	regsvr32.exe	regsvr32.exe
PID 3712 wrote to memory of 3644	3712	regsvr32.exe	regsvr32.exe
PID 3644 wrote to memory of 3504	3644	regsvr32.exe	explorer.exe
PID 3644 wrote to memory of 3504	3644	regsvr32.exe	explorer.exe
PID 3644 wrote to memory of 3504	3644	regsvr32.exe	explorer.exe
PID 3644 wrote to memory of 3504	3644	regsvr32.exe	explorer.exe
PID 3644 wrote to memory of 3504	3644	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\folkzaha.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4468

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\folkzaha.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 01:21 /tn xhvwdxtdlx /ET 01:32 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAZgBvAGwAawB6AGEAaABhAC4AZABsAGwAIgA=" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:684

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAZgBvAGwAawB6AGEAaABhAC4AZABsAGwAIgA=
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3964

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\folkzaha.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3712

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\folkzaha.dll
3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
PID:3504

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\folkzaha.dll
Filesize
440KB

MD5
117820c96b9443cdf6f8b32051ce40ae

SHA1
abd58883ca721f4796b24c788c5f76d36f191b4f

SHA256
95682615b30f5ea299b4e60dba79f83b6d09052acab3cb9e1730b480b7dab340

SHA512
007fc72e96edf72dc3429a0fdfa5d21dbafec0b40eb99f30e2cecc7e23ebfef3bb5f036a22606d10481dc85031414c9acd163aa96adb90654ebea83c1a73bd18

Download Submit
C:\Users\Admin\AppData\Local\Temp\folkzaha.dll
Filesize
440KB

MD5
117820c96b9443cdf6f8b32051ce40ae

SHA1
abd58883ca721f4796b24c788c5f76d36f191b4f

SHA256
95682615b30f5ea299b4e60dba79f83b6d09052acab3cb9e1730b480b7dab340

SHA512
007fc72e96edf72dc3429a0fdfa5d21dbafec0b40eb99f30e2cecc7e23ebfef3bb5f036a22606d10481dc85031414c9acd163aa96adb90654ebea83c1a73bd18

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/684-138-0x0000000000000000-mapping.dmp

Download
memory/752-137-0x00000000009D0000-0x00000000009F2000-memory.dmp

Filesize
136KB

Download
memory/752-139-0x00000000009D0000-0x00000000009F2000-memory.dmp

Filesize
136KB

Download
memory/752-135-0x0000000000000000-mapping.dmp

Download
memory/1556-133-0x0000000000EC0000-0x0000000000F03000-memory.dmp

Filesize
268KB

Download
memory/1556-136-0x0000000000F10000-0x0000000000F32000-memory.dmp

Filesize
136KB

Download
memory/1556-132-0x0000000000000000-mapping.dmp

Download
memory/1556-134-0x0000000000F10000-0x0000000000F32000-memory.dmp

Filesize
136KB

Download
memory/3504-151-0x0000000000110000-0x0000000000132000-memory.dmp

Filesize
136KB

Download
memory/3504-150-0x0000000000110000-0x0000000000132000-memory.dmp

Filesize
136KB

Download
memory/3504-148-0x0000000000000000-mapping.dmp

Download
memory/3644-143-0x0000000000000000-mapping.dmp

Download
memory/3644-147-0x0000000000CA0000-0x0000000000CC2000-memory.dmp

Filesize
136KB

Download
memory/3644-149-0x0000000000CA0000-0x0000000000CC2000-memory.dmp

Filesize
136KB

Download
memory/3712-141-0x0000000000000000-mapping.dmp

Download
memory/3964-144-0x00007FFB85760000-0x00007FFB86221000-memory.dmp

Filesize
10.8MB

Download
memory/3964-140-0x0000023B9EDC0000-0x0000023B9EDE2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads