qakbot | 706e30064528a8b9c32c95d389e54ee26efd52c8a2f696cd0412e8ed76f6fec8

General

Target

REPORT_Tc3Od_ySUb.Bf.dll
Size

428KB
MD5

0ff34513541f9c842a6df1358ab1c8dc
SHA1

fe0c7ef17144b03f609910f4a1f3e4584728b14a
SHA256

706e30064528a8b9c32c95d389e54ee26efd52c8a2f696cd0412e8ed76f6fec8
SHA512

3c58bd049746228feaeb8da8a132075891062b377fd2d6d7474921ce9bc5dec985981b5d437d59953972812aabfea80b051d6ffdd3059dab9120acb801079dbc
SSDEEP

6144:36N5XNlCfcqFhOdpwNzM2a3gfwp3NkOWuzv/24bktfTGoH:KrducqxNzbaP3WOWuLTCfThH

Score

10^/10

qakbot bb 1663148750 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

BB

Campaign

1663148750

C2

193.3.19.37:443

99.232.140.205:2222

99.253.251.74:443

197.94.210.133:443

37.210.148.30:995

14.161.194.86:443

154.181.203.230:995

200.161.62.126:32101

134.35.10.122:443

64.207.215.69:443

81.131.161.131:2078

217.165.85.223:993

78.100.225.34:2222

85.114.110.108:443

102.38.96.108:995

123.240.131.1:443

109.158.159.179:993

186.105.182.127:443

190.44.40.48:995

88.233.194.154:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3272 regsvr32.exe

pid	process
3272	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1820 schtasks.exe

pid	process
1820	schtasks.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

explorer.exepowershell.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Voaiaosmna\f36b20c6 = 4687c9bda75b89e8d1db223e3a1ce9a945675ae1ba11ad59a5d12768611b09a66576690dc0e4ee4140b7e05cc2c9bd30e99493ffc9a562d7ff17912106cad231ad19db24b8d0a6c6a02b48e7f8fd73f0868c4a40b001818df27b66828183ab719918ed80a289b2b38b5ac2a3d053422f4443ad7a543d26e2b79a7010d45ed2c563eceb5f3f69b6af4904439014dbe208b49a8a1976efa75a079cca9e3bc26df37dc913	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Voaiaosmna	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Voaiaosmna\8c224f30 = 596cfd71d2238cb069e6ad8dec895e15133b68e9aaf07b8e69105c01c9ad00940ce1f4cb7db9f47c70399f69fac5fdb15880771a81b35113bcf31a1c906f6327493179329bf07914acc5980122117fbb	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Voaiaosmna\499667df = 5684c500013bb92296d7ac3c0dc119c7c6f58756c46375616d091c3f2434544ac0c4ecbf96b1ed132e8346fd4a9b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Voaiaosmna\4bd747a3 = 0b740e3a010a135c2f314923c3ba1599092069b7528ddd2a9bb43f976f5a14c7d95fcf5f63a37396	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Voaiaosmna\c6f4f088 = 0f900df06dee7b982f996d397f373de944188f112d2cd350f4845ee223cb55d1ebc51f37978350b0ca409e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Voaiaosmna\b9bd9f7e = ffd99debe2b32efe4796af56204f707e91718a9dbad776e5aa31d09d90280055	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Voaiaosmna\f12a00ba = 47a2bc037a3022a22c7c4af7daffc97a8b0d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Voaiaosmna\349e2855 = 22e4717affec2e2639e1bc22e9f942920afb236e6a461f0b2541a66ab503a666ba3bbc3eb3e261528098265b6edd3a5bc8a9944e42732e74d489857723	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Voaiaosmna\c6f4f088 = 0f901af06dee48fdc400545b00672a5b899ce1c17cde	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
204	regsvr32.exe
204	regsvr32.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe
4460	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

204 regsvr32.exe
3272 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 5060 powershell.exe

description	pid	process
Token: SeDebugPrivilege	5060	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2332 wrote to memory of 204	2332	regsvr32.exe	regsvr32.exe
PID 2332 wrote to memory of 204	2332	regsvr32.exe	regsvr32.exe
PID 2332 wrote to memory of 204	2332	regsvr32.exe	regsvr32.exe
PID 204 wrote to memory of 4460	204	regsvr32.exe	explorer.exe
PID 204 wrote to memory of 4460	204	regsvr32.exe	explorer.exe
PID 204 wrote to memory of 4460	204	regsvr32.exe	explorer.exe
PID 204 wrote to memory of 4460	204	regsvr32.exe	explorer.exe
PID 204 wrote to memory of 4460	204	regsvr32.exe	explorer.exe
PID 4460 wrote to memory of 1820	4460	explorer.exe	schtasks.exe
PID 4460 wrote to memory of 1820	4460	explorer.exe	schtasks.exe
PID 4460 wrote to memory of 1820	4460	explorer.exe	schtasks.exe
PID 5060 wrote to memory of 3568	5060	powershell.exe	regsvr32.exe
PID 5060 wrote to memory of 3568	5060	powershell.exe	regsvr32.exe
PID 3568 wrote to memory of 3272	3568	regsvr32.exe	regsvr32.exe
PID 3568 wrote to memory of 3272	3568	regsvr32.exe	regsvr32.exe
PID 3568 wrote to memory of 3272	3568	regsvr32.exe	regsvr32.exe
PID 3272 wrote to memory of 3888	3272	regsvr32.exe	explorer.exe
PID 3272 wrote to memory of 3888	3272	regsvr32.exe	explorer.exe
PID 3272 wrote to memory of 3888	3272	regsvr32.exe	explorer.exe
PID 3272 wrote to memory of 3888	3272	regsvr32.exe	explorer.exe
PID 3272 wrote to memory of 3888	3272	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\REPORT_Tc3Od_ySUb.Bf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\REPORT_Tc3Od_ySUb.Bf.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:204

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4460

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 17:23 /tn fzprppcro /ET 17:34 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgBFAFAATwBSAFQAXwBUAGMAMwBPAGQAXwB5AFMAVQBiAC4AQgBmAC4AZABsAGwAIgA=" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:1820

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgBFAFAATwBSAFQAXwBUAGMAMwBPAGQAXwB5AFMAVQBiAC4AQgBmAC4AZABsAGwAIgA=
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\REPORT_Tc3Od_ySUb.Bf.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3568

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\REPORT_Tc3Od_ySUb.Bf.dll
3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3272

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
PID:3888

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\REPORT_Tc3Od_ySUb.Bf.dll
Filesize
428KB

MD5
0ff34513541f9c842a6df1358ab1c8dc

SHA1
fe0c7ef17144b03f609910f4a1f3e4584728b14a

SHA256
706e30064528a8b9c32c95d389e54ee26efd52c8a2f696cd0412e8ed76f6fec8

SHA512
3c58bd049746228feaeb8da8a132075891062b377fd2d6d7474921ce9bc5dec985981b5d437d59953972812aabfea80b051d6ffdd3059dab9120acb801079dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\REPORT_Tc3Od_ySUb.Bf.dll
Filesize
428KB

MD5
0ff34513541f9c842a6df1358ab1c8dc

SHA1
fe0c7ef17144b03f609910f4a1f3e4584728b14a

SHA256
706e30064528a8b9c32c95d389e54ee26efd52c8a2f696cd0412e8ed76f6fec8

SHA512
3c58bd049746228feaeb8da8a132075891062b377fd2d6d7474921ce9bc5dec985981b5d437d59953972812aabfea80b051d6ffdd3059dab9120acb801079dbc

Download Submit
memory/204-133-0x0000000000DE0000-0x0000000000E02000-memory.dmp

Filesize
136KB

Download
memory/204-135-0x0000000000DE0000-0x0000000000E02000-memory.dmp

Filesize
136KB

Download
memory/204-132-0x0000000000000000-mapping.dmp

Download
memory/1820-136-0x0000000000000000-mapping.dmp

Download
memory/3272-147-0x00000000012B0000-0x00000000012D2000-memory.dmp

Filesize
136KB

Download
memory/3272-145-0x00000000012B0000-0x00000000012D2000-memory.dmp

Filesize
136KB

Download
memory/3272-142-0x0000000000000000-mapping.dmp

Download
memory/3568-140-0x0000000000000000-mapping.dmp

Download
memory/3888-146-0x0000000000000000-mapping.dmp

Download
memory/3888-148-0x0000000000570000-0x0000000000592000-memory.dmp

Filesize
136KB

Download
memory/3888-149-0x0000000000570000-0x0000000000592000-memory.dmp

Filesize
136KB

Download
memory/4460-138-0x0000000000CB0000-0x0000000000CD2000-memory.dmp

Filesize
136KB

Download
memory/4460-137-0x0000000000CB0000-0x0000000000CD2000-memory.dmp

Filesize
136KB

Download
memory/4460-134-0x0000000000000000-mapping.dmp

Download
memory/5060-139-0x0000020CF2670000-0x0000020CF2692000-memory.dmp

Filesize
136KB

Download
memory/5060-144-0x00007FF9836E0000-0x00007FF9841A1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads