qakbot | c0d3dfc1e72066434b51f0d18d4b94adb6d7dbc03dfd4dc4955b1ed3487700ee

Analysis

max time kernel
150s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-09-2022 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

him/whatAt.dll
Size

370KB
MD5

3af4a4a28dafbb10a6637e59059015fe
SHA1

224443e988d68a3e020d539854f609b32c5067e7
SHA256

8b59e2de999068c78d352cb591dbae7e4495ce989615eb35607475648356ef11
SHA512

dac98357101162a38de5fb3ff0bfaa2399f3b28288d7a99cb19719fd287070b0dbedf6b7fc6e39649c15e29826f3ad6d1e07e502358bb46340ec8714e64c202a
SSDEEP

6144:0W94f4+mWoAwI55fMC/sLv2S2UBNlAzm+LNq6mpPh9HTk3upTfCUp:D4w1AwSpZ1S2kNWzmjDh9zk3gD

Score

10^/10

qakbot bb 1663053540 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

Campaign

1663053540

194.49.79.231:443

193.3.19.37:443

99.232.140.205:2222

47.146.182.110:443

84.38.133.191:443

191.97.234.238:995

37.210.148.30:995

64.207.215.69:443

200.161.62.126:32101

88.245.103.132:2222

86.98.156.176:993

175.110.231.67:443

78.100.254.17:2222

191.84.204.214:995

123.240.131.1:443

197.94.210.133:443

196.92.172.24:8443

186.50.245.74:995

70.51.132.197:2222

100.1.5.250:995

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

588 regsvr32.exe

pid	process
588	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1648 schtasks.exe

pid	process
1648	schtasks.exe

Modifies data under HKEY_USERS 12 IoCs

Processes:

explorer.exepowershell.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bmgyjtiwxx\3cc23f43 = d93f99d5871390633cba49a66fdacf10f4268d9c1cfc7451335c1740a0a14399573895c261acca2efb6fdf8b542037615f9f53748f99e0a7eda520a5ff48ea7bf1936b1b06349d83aa3e14976facec82d97e998fe0f8ded48967dc301c750eab1ea0065bc3d82ea7a48f202a00b68e6e82624ddc977f0904064193c1577e729a3020c255dc1a57beb4bb02ad2cb0a994aa8375e84259f53cb08e39503ad855e42a8545608842d6d3521708b67dd6c46675546e7dd6ef5c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bmgyjtiwxx\3e831f3f = b2626c23f4b06cb2185d07b1a3d0fa430f6b7bb685aed45639ed176cb4dfa22054229b17e1469070c3f30d95928a640eefadf8cbf08efc5e17a69ad02a796495a1ce40bc906a0e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bmgyjtiwxx\863f785a = b4d6db09fa74564dc05d92c65b56a930b4ad778c5142a5cbe7087fbf0ca54ff8c6abb6a6ef0b0848ccd79f43bed9c17e4b149fa8572321c7fc68cd64576c2177e84ac9c4c9a188de413ff7bf03055cf0572ae466	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bmgyjtiwxx\438b50b5 = 76eb346b20ee89eaedc9a5fc67fa60ed0b7bb87c5def7ed44ea83152e54e895dcb5a4b8b778a170ff56fe79140fe64947877e1ba1329cc6d67cc6f581df15c136ec0f01fc01f827ef59f97db48e82843b3eb5cdf8c08466a61e7fc73	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bmgyjtiwxx\847e5826 = eaedd601ab197e5ae345e357c983f42f930e8704	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bmgyjtiwxx	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bmgyjtiwxx\95def0d = 9880663f3cfced7849b4804795b5888bafcd29c372b6038cd23f734ada7d955c9a2fb3b8c177ab2d08	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bmgyjtiwxx\95def0d = 9880713f3cfcde4471208ac03850f29894f5b70b62cf7570281f270b4add2ac633ed59cf2468ec3cfadd9f8d2a3d0b5188b40240f6d0ecfebfe7e1326e29	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 905e9ab612c9d801	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bmgyjtiwxx\fb3737d0 = b301c550de15a4d84be03835da685acbed26b61f4848ca197b7e86d839bffbe6527ebe925cd5d2eaf34233776aa1d0614309a670110b190c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bmgyjtiwxx\761480fb = bd9a424ca39eb4f972d39f034af8c008243bee024ae75e7d3f46f41957e609b7712696e6eab49b92ffae4d00ff3136beb2ac6f8c940ec6984df6b3677d343a	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exepowershell.exeregsvr32.exe

pid	process
1268	regsvr32.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1368	powershell.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
588	regsvr32.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe
1272	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1268 regsvr32.exe
588 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1368 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1368	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1096 wrote to memory of 1268	1096	regsvr32.exe	regsvr32.exe
PID 1096 wrote to memory of 1268	1096	regsvr32.exe	regsvr32.exe
PID 1096 wrote to memory of 1268	1096	regsvr32.exe	regsvr32.exe
PID 1096 wrote to memory of 1268	1096	regsvr32.exe	regsvr32.exe
PID 1096 wrote to memory of 1268	1096	regsvr32.exe	regsvr32.exe
PID 1096 wrote to memory of 1268	1096	regsvr32.exe	regsvr32.exe
PID 1096 wrote to memory of 1268	1096	regsvr32.exe	regsvr32.exe
PID 1268 wrote to memory of 1272	1268	regsvr32.exe	explorer.exe
PID 1268 wrote to memory of 1272	1268	regsvr32.exe	explorer.exe
PID 1268 wrote to memory of 1272	1268	regsvr32.exe	explorer.exe
PID 1268 wrote to memory of 1272	1268	regsvr32.exe	explorer.exe
PID 1268 wrote to memory of 1272	1268	regsvr32.exe	explorer.exe
PID 1268 wrote to memory of 1272	1268	regsvr32.exe	explorer.exe
PID 1272 wrote to memory of 1648	1272	explorer.exe	schtasks.exe
PID 1272 wrote to memory of 1648	1272	explorer.exe	schtasks.exe
PID 1272 wrote to memory of 1648	1272	explorer.exe	schtasks.exe
PID 1272 wrote to memory of 1648	1272	explorer.exe	schtasks.exe
PID 788 wrote to memory of 1368	788	taskeng.exe	powershell.exe
PID 788 wrote to memory of 1368	788	taskeng.exe	powershell.exe
PID 788 wrote to memory of 1368	788	taskeng.exe	powershell.exe
PID 1368 wrote to memory of 1780	1368	powershell.exe	regsvr32.exe
PID 1368 wrote to memory of 1780	1368	powershell.exe	regsvr32.exe
PID 1368 wrote to memory of 1780	1368	powershell.exe	regsvr32.exe
PID 1368 wrote to memory of 1780	1368	powershell.exe	regsvr32.exe
PID 1368 wrote to memory of 1780	1368	powershell.exe	regsvr32.exe
PID 1780 wrote to memory of 588	1780	regsvr32.exe	regsvr32.exe
PID 1780 wrote to memory of 588	1780	regsvr32.exe	regsvr32.exe
PID 1780 wrote to memory of 588	1780	regsvr32.exe	regsvr32.exe
PID 1780 wrote to memory of 588	1780	regsvr32.exe	regsvr32.exe
PID 1780 wrote to memory of 588	1780	regsvr32.exe	regsvr32.exe
PID 1780 wrote to memory of 588	1780	regsvr32.exe	regsvr32.exe
PID 1780 wrote to memory of 588	1780	regsvr32.exe	regsvr32.exe
PID 588 wrote to memory of 2020	588	regsvr32.exe	explorer.exe
PID 588 wrote to memory of 2020	588	regsvr32.exe	explorer.exe
PID 588 wrote to memory of 2020	588	regsvr32.exe	explorer.exe
PID 588 wrote to memory of 2020	588	regsvr32.exe	explorer.exe
PID 588 wrote to memory of 2020	588	regsvr32.exe	explorer.exe
PID 588 wrote to memory of 2020	588	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\him\whatAt.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\him\whatAt.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 14:52 /tn emoulpcg /ET 15:03 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAaABpAG0AXAB3AGgAYQB0AEEAdAAuAGQAbABsACIA" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:1648

C:\Windows\system32\taskeng.exe
taskeng.exe {79050C00-9A15-40DD-A0E1-4F9B56EEA6FE} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAaABpAG0AXAB3AGgAYQB0AEEAdAAuAGQAbABsACIA
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\him\whatAt.dll
3⤵
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\him\whatAt.dll
4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:588

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- Modifies data under HKEY_USERS
PID:2020

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\him\whatAt.dll
Filesize
370KB

MD5
3af4a4a28dafbb10a6637e59059015fe

SHA1
224443e988d68a3e020d539854f609b32c5067e7

SHA256
8b59e2de999068c78d352cb591dbae7e4495ce989615eb35607475648356ef11

SHA512
dac98357101162a38de5fb3ff0bfaa2399f3b28288d7a99cb19719fd287070b0dbedf6b7fc6e39649c15e29826f3ad6d1e07e502358bb46340ec8714e64c202a

Download Submit
\Users\Admin\AppData\Local\Temp\him\whatAt.dll
Filesize
370KB

MD5
3af4a4a28dafbb10a6637e59059015fe

SHA1
224443e988d68a3e020d539854f609b32c5067e7

SHA256
8b59e2de999068c78d352cb591dbae7e4495ce989615eb35607475648356ef11

SHA512
dac98357101162a38de5fb3ff0bfaa2399f3b28288d7a99cb19719fd287070b0dbedf6b7fc6e39649c15e29826f3ad6d1e07e502358bb46340ec8714e64c202a

Download Submit
memory/588-85-0x0000000000220000-0x0000000000242000-memory.dmp

Filesize
136KB

Download
memory/588-81-0x0000000000220000-0x0000000000242000-memory.dmp

Filesize
136KB

Download
memory/588-79-0x0000000000220000-0x0000000000242000-memory.dmp

Filesize
136KB

Download
memory/588-74-0x0000000000000000-mapping.dmp

Download
memory/1096-54-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

Filesize
8KB

Download
memory/1268-55-0x0000000000000000-mapping.dmp

Download
memory/1268-56-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1268-57-0x0000000000190000-0x00000000001B2000-memory.dmp

Filesize
136KB

Download
memory/1268-59-0x0000000000190000-0x0000000000210000-memory.dmp

Filesize
512KB

Download
memory/1268-63-0x0000000000190000-0x00000000001B2000-memory.dmp

Filesize
136KB

Download
memory/1272-62-0x0000000074641000-0x0000000074643000-memory.dmp

Filesize
8KB

Download
memory/1272-66-0x00000000000C0000-0x00000000000E2000-memory.dmp

Filesize
136KB

Download
memory/1272-64-0x00000000000C0000-0x00000000000E2000-memory.dmp

Filesize
136KB

Download
memory/1272-60-0x0000000000000000-mapping.dmp

Download
memory/1368-70-0x000007FEF3680000-0x000007FEF41DD000-memory.dmp

Filesize
11.4MB

Download
memory/1368-69-0x000007FEF41E0000-0x000007FEF4C03000-memory.dmp

Filesize
10.1MB

Download
memory/1368-75-0x0000000001204000-0x0000000001207000-memory.dmp

Filesize
12KB

Download
memory/1368-76-0x000000000120B000-0x000000000122A000-memory.dmp

Filesize
124KB

Download
memory/1368-67-0x0000000000000000-mapping.dmp

Download
memory/1648-65-0x0000000000000000-mapping.dmp

Download
memory/1780-71-0x0000000000000000-mapping.dmp

Download
memory/2020-82-0x0000000000000000-mapping.dmp

Download
memory/2020-86-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads