qakbot | c0d3dfc1e72066434b51f0d18d4b94adb6d7dbc03dfd4dc4955b1ed3487700ee

Analysis

max time kernel
150s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-09-2022 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

one/aboutNo.dll
Size

370KB
MD5

3af4a4a28dafbb10a6637e59059015fe
SHA1

224443e988d68a3e020d539854f609b32c5067e7
SHA256

8b59e2de999068c78d352cb591dbae7e4495ce989615eb35607475648356ef11
SHA512

dac98357101162a38de5fb3ff0bfaa2399f3b28288d7a99cb19719fd287070b0dbedf6b7fc6e39649c15e29826f3ad6d1e07e502358bb46340ec8714e64c202a
SSDEEP

6144:0W94f4+mWoAwI55fMC/sLv2S2UBNlAzm+LNq6mpPh9HTk3upTfCUp:D4w1AwSpZ1S2kNWzmjDh9zk3gD

Score

10^/10

qakbot bb 1663053540 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

Campaign

1663053540

194.49.79.231:443

193.3.19.37:443

99.232.140.205:2222

47.146.182.110:443

84.38.133.191:443

191.97.234.238:995

37.210.148.30:995

64.207.215.69:443

200.161.62.126:32101

88.245.103.132:2222

86.98.156.176:993

175.110.231.67:443

78.100.254.17:2222

191.84.204.214:995

123.240.131.1:443

197.94.210.133:443

196.92.172.24:8443

186.50.245.74:995

70.51.132.197:2222

100.1.5.250:995

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

300 regsvr32.exe

pid	process
300	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1392 schtasks.exe

pid	process
1392	schtasks.exe

Modifies data under HKEY_USERS 12 IoCs

Processes:

explorer.exepowershell.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qfiocqdmifcwj\df9d7e8 = 2952e639a7fd6fdb8e5b832d3dba874bddd0162f8ac64d333fb70e2823a3105119d3f1d35088eb25e80a58c8914a78681dc5e15198a8c4149a6770bf2b81a5d7d8f208547f25bd395ee23d4e8bdf2106268158a70f842d91f0f334a6	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 509e9fb612c9d801	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qfiocqdmifcwj\80da60c3 = 652dc1ddbc4aadd84a96abf1a93439d60743d0ae51b031db3a181d0d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qfiocqdmifcwj\b545b08d = 231f813592316138719f8569d608f6c9095577af6db8e6e702cfe5f6bd59ffd72cab5e09dac53826d5b48e0c2db375eeef69cf9ba78c28516228b15228420e94fa21427fc3f9cef2bbb1f751be42b5fea15a08577f9df435b3f5550ed8d7744f77db7c0f545efc190d80a9357e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qfiocqdmifcwj\b70490f1 = 30e4b01d05b30f7cc68f5bcb7ab7cdedd6d82a77	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qfiocqdmifcwj\72b0b81e = 49f1bb0a6f4ed33b05be83f1625c7c2fd86ce9f144ed2a7dc95aadf85b77969308a9f3aec598ff107e4c7dff6332b033d34131f812916fb993c18c1c026002	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qfiocqdmifcwj\ca0cdf7b = a01c2973114d83168709a1372704e3c8bb60b8e8e14a5ef5856e4b99a164f8b2040ecf3cb17683fab9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qfiocqdmifcwj\ff930f35 = 088d32e2a8dda50ef676d7841761e9ccf040d9440c25faa580f2945038ebaaacc0	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qfiocqdmifcwj	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qfiocqdmifcwj\fb8f794 = 62b6afbe27f49c70930b25dc8823db97c4946721edd3d0ee214629f0c83d1a47191d37ef9ad1955757f98fd8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qfiocqdmifcwj\80da60c3 = 652dd6ddbc4a9e5e1d8727e4e4360eb9e8da8da990800064c65bbfec42cdad6dfdcafb82ace6fff5fe8c1be561cac13387	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exepowershell.exeregsvr32.exe

pid	process
1956	regsvr32.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
908	powershell.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
300	regsvr32.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe
1664	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1956 regsvr32.exe
300 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 908 powershell.exe

description	pid	process
Token: SeDebugPrivilege	908	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2044 wrote to memory of 1956	2044	regsvr32.exe	regsvr32.exe
PID 2044 wrote to memory of 1956	2044	regsvr32.exe	regsvr32.exe
PID 2044 wrote to memory of 1956	2044	regsvr32.exe	regsvr32.exe
PID 2044 wrote to memory of 1956	2044	regsvr32.exe	regsvr32.exe
PID 2044 wrote to memory of 1956	2044	regsvr32.exe	regsvr32.exe
PID 2044 wrote to memory of 1956	2044	regsvr32.exe	regsvr32.exe
PID 2044 wrote to memory of 1956	2044	regsvr32.exe	regsvr32.exe
PID 1956 wrote to memory of 1664	1956	regsvr32.exe	explorer.exe
PID 1956 wrote to memory of 1664	1956	regsvr32.exe	explorer.exe
PID 1956 wrote to memory of 1664	1956	regsvr32.exe	explorer.exe
PID 1956 wrote to memory of 1664	1956	regsvr32.exe	explorer.exe
PID 1956 wrote to memory of 1664	1956	regsvr32.exe	explorer.exe
PID 1956 wrote to memory of 1664	1956	regsvr32.exe	explorer.exe
PID 1664 wrote to memory of 1392	1664	explorer.exe	schtasks.exe
PID 1664 wrote to memory of 1392	1664	explorer.exe	schtasks.exe
PID 1664 wrote to memory of 1392	1664	explorer.exe	schtasks.exe
PID 1664 wrote to memory of 1392	1664	explorer.exe	schtasks.exe
PID 900 wrote to memory of 908	900	taskeng.exe	powershell.exe
PID 900 wrote to memory of 908	900	taskeng.exe	powershell.exe
PID 900 wrote to memory of 908	900	taskeng.exe	powershell.exe
PID 908 wrote to memory of 1076	908	powershell.exe	regsvr32.exe
PID 908 wrote to memory of 1076	908	powershell.exe	regsvr32.exe
PID 908 wrote to memory of 1076	908	powershell.exe	regsvr32.exe
PID 908 wrote to memory of 1076	908	powershell.exe	regsvr32.exe
PID 908 wrote to memory of 1076	908	powershell.exe	regsvr32.exe
PID 1076 wrote to memory of 300	1076	regsvr32.exe	regsvr32.exe
PID 1076 wrote to memory of 300	1076	regsvr32.exe	regsvr32.exe
PID 1076 wrote to memory of 300	1076	regsvr32.exe	regsvr32.exe
PID 1076 wrote to memory of 300	1076	regsvr32.exe	regsvr32.exe
PID 1076 wrote to memory of 300	1076	regsvr32.exe	regsvr32.exe
PID 1076 wrote to memory of 300	1076	regsvr32.exe	regsvr32.exe
PID 1076 wrote to memory of 300	1076	regsvr32.exe	regsvr32.exe
PID 300 wrote to memory of 2012	300	regsvr32.exe	explorer.exe
PID 300 wrote to memory of 2012	300	regsvr32.exe	explorer.exe
PID 300 wrote to memory of 2012	300	regsvr32.exe	explorer.exe
PID 300 wrote to memory of 2012	300	regsvr32.exe	explorer.exe
PID 300 wrote to memory of 2012	300	regsvr32.exe	explorer.exe
PID 300 wrote to memory of 2012	300	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\one\aboutNo.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\one\aboutNo.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 14:52 /tn gokxxira /ET 15:03 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbwBuAGUAXABhAGIAbwB1AHQATgBvAC4AZABsAGwAIgA=" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:1392

C:\Windows\system32\taskeng.exe
taskeng.exe {FCD45B74-650C-409F-B37E-6AF0268EB0A2} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbwBuAGUAXABhAGIAbwB1AHQATgBvAC4AZABsAGwAIgA=
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\one\aboutNo.dll
3⤵
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\one\aboutNo.dll
4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:300

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- Modifies data under HKEY_USERS
PID:2012

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\one\aboutNo.dll
Filesize
370KB

MD5
3af4a4a28dafbb10a6637e59059015fe

SHA1
224443e988d68a3e020d539854f609b32c5067e7

SHA256
8b59e2de999068c78d352cb591dbae7e4495ce989615eb35607475648356ef11

SHA512
dac98357101162a38de5fb3ff0bfaa2399f3b28288d7a99cb19719fd287070b0dbedf6b7fc6e39649c15e29826f3ad6d1e07e502358bb46340ec8714e64c202a

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\one\aboutNo.dll
Filesize
370KB

MD5
3af4a4a28dafbb10a6637e59059015fe

SHA1
224443e988d68a3e020d539854f609b32c5067e7

SHA256
8b59e2de999068c78d352cb591dbae7e4495ce989615eb35607475648356ef11

SHA512
dac98357101162a38de5fb3ff0bfaa2399f3b28288d7a99cb19719fd287070b0dbedf6b7fc6e39649c15e29826f3ad6d1e07e502358bb46340ec8714e64c202a

Download Submit
memory/300-88-0x0000000000200000-0x0000000000222000-memory.dmp

Filesize
136KB

Download
memory/300-83-0x0000000000200000-0x0000000000222000-memory.dmp

Filesize
136KB

Download
memory/300-81-0x0000000000200000-0x0000000000222000-memory.dmp

Filesize
136KB

Download
memory/300-78-0x0000000000000000-mapping.dmp

Download
memory/908-72-0x0000000001064000-0x0000000001067000-memory.dmp

Filesize
12KB

Download
memory/908-75-0x0000000001064000-0x0000000001067000-memory.dmp

Filesize
12KB

Download
memory/908-77-0x000000000106B000-0x000000000108A000-memory.dmp

Filesize
124KB

Download
memory/908-71-0x000007FEF2CC0000-0x000007FEF381D000-memory.dmp

Filesize
11.4MB

Download
memory/908-70-0x000007FEF3EF0000-0x000007FEF4913000-memory.dmp

Filesize
10.1MB

Download
memory/908-68-0x0000000000000000-mapping.dmp

Download
memory/1076-73-0x0000000000000000-mapping.dmp

Download
memory/1392-66-0x0000000000000000-mapping.dmp

Download
memory/1664-65-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1664-63-0x0000000074BE1000-0x0000000074BE3000-memory.dmp

Filesize
8KB

Download
memory/1664-67-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1664-61-0x0000000000000000-mapping.dmp

Download
memory/1956-64-0x00000000001D0000-0x00000000001F2000-memory.dmp

Filesize
136KB

Download
memory/1956-60-0x00000000001D0000-0x0000000000250000-memory.dmp

Filesize
512KB

Download
memory/1956-59-0x00000000001D0000-0x0000000000250000-memory.dmp

Filesize
512KB

Download
memory/1956-57-0x00000000001D0000-0x00000000001F2000-memory.dmp

Filesize
136KB

Download
memory/1956-56-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/1956-55-0x0000000000000000-mapping.dmp

Download
memory/2012-84-0x0000000000000000-mapping.dmp

Download
memory/2012-89-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/2044-54-0x000007FEFC251000-0x000007FEFC253000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads