qakbot | dc764193f2334bc4732faba024df4f9cfc3afbe5ed39ea7badef5ad7d31084cc

General

Target

unvaccinated.dll
Size

372KB
MD5

8fa817ddd8e19d41d5475a213e19e5a9
SHA1

386acf59345e8141d171dcfc655c446536abf0e0
SHA256

dc764193f2334bc4732faba024df4f9cfc3afbe5ed39ea7badef5ad7d31084cc
SHA512

f8acc47acb2fe8858380f79391c4dd8eb5f9cb5400690b44edf8e440af9d4237881df32adca5ccb3149cfd8522dd9d407c65cad559f4aa034cc425198692090f
SSDEEP

6144:l1eKK1u77wiWjvM9gaYhWawPSxipTR9K1/XseDA+sqKD9oqHs9Dz/RJhKXuz:mKzMD2gaSWcxITi/XsZ+s7pohvRJhr

Score

10^/10

qakbot bb06 1668752705 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668752705

C2

98.147.155.235:443

49.175.72.56:443

82.31.37.241:443

73.36.196.11:443

2.84.98.228:2222

188.54.79.88:995

184.153.132.82:443

74.66.134.24:443

172.117.139.142:995

12.172.173.82:990

24.64.114.59:3389

12.172.173.82:2087

78.92.133.215:443

24.64.114.59:2222

50.68.204.71:995

105.184.161.242:443

12.172.173.82:22

221.161.103.6:443

98.145.23.67:443

73.161.176.218:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58DFF851-69DF-11ED-95AE-5A5CFA1077B6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af000000000200000000001066000000010000200000001274bc9a9679ba3886d9f7c687f12de5e02a6788225a75342dcabb84a009d180000000000e8000000002000020000000c74a73549f8e0e76958fd3ca67eee2850c114c28b472fa2a7dc301e0e494eedc90000000d7264f19fd3eccc8c084eefe75b73c3dd97be441aed0c9debf2d5ce8492b3cf493e06c323827f5059172e1c3df7cf4135414750f4a7176d59d809bf6262df1411a64064d3e83f591893256711214a3f64387eb270ec9c9a9dab6e7e037cb609dd030b2fb4d27215365f59998a56d67ecc04ece651f86827a72e57a90c08edc6c15382d4918a2f4bc0b1fb1dfcfdb9a2640000000ad69828dc2c645bdc01b8ac71363f0b5d832c083bf8af243af7eaa9b3ee82d26acc1501044de78174e1508e78f394588dab7d80efe490052a296eb36e8a8b802	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000097015bcb757ab975bbf93a5eaf6d554106957ac4828f24cc05642ff567b2b82000000000e8000000002000020000000fb3a232ca2abc7d1555d043c608abdacd1316056fca5329329cf2fbe07dc711b20000000919f6c10e2720d78a2004f1a9d9a9fb5b298234ea7c2080d4763ac90c06db7bc40000000a7d49667fc77466c1d2e505214a2717946543a3e97630c530d2584142e6f39b767fab1217d276b360630df46eb0cecc91eef71d36d3de0ddc4ad0acf089a2f06	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07dec35ecfdd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exewermgr.exe

pid	process
1792	regsvr32.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe
588	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1792 regsvr32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1684 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1684 iexplore.exe
1684 iexplore.exe
936 IEXPLORE.EXE
936 IEXPLORE.EXE
936 IEXPLORE.EXE
936 IEXPLORE.EXE

pid	process
1684	iexplore.exe

pid	process
1684	iexplore.exe
1684	iexplore.exe
936	IEXPLORE.EXE
936	IEXPLORE.EXE
936	IEXPLORE.EXE
936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

regsvr32.exeregsvr32.exeiexplore.exe

description	pid	process	target process
PID 1292 wrote to memory of 1792	1292	regsvr32.exe	regsvr32.exe
PID 1292 wrote to memory of 1792	1292	regsvr32.exe	regsvr32.exe
PID 1292 wrote to memory of 1792	1292	regsvr32.exe	regsvr32.exe
PID 1292 wrote to memory of 1792	1292	regsvr32.exe	regsvr32.exe
PID 1292 wrote to memory of 1792	1292	regsvr32.exe	regsvr32.exe
PID 1292 wrote to memory of 1792	1292	regsvr32.exe	regsvr32.exe
PID 1292 wrote to memory of 1792	1292	regsvr32.exe	regsvr32.exe
PID 1792 wrote to memory of 588	1792	regsvr32.exe	wermgr.exe
PID 1792 wrote to memory of 588	1792	regsvr32.exe	wermgr.exe
PID 1792 wrote to memory of 588	1792	regsvr32.exe	wermgr.exe
PID 1792 wrote to memory of 588	1792	regsvr32.exe	wermgr.exe
PID 1792 wrote to memory of 588	1792	regsvr32.exe	wermgr.exe
PID 1792 wrote to memory of 588	1792	regsvr32.exe	wermgr.exe
PID 1684 wrote to memory of 936	1684	iexplore.exe	IEXPLORE.EXE
PID 1684 wrote to memory of 936	1684	iexplore.exe	IEXPLORE.EXE
PID 1684 wrote to memory of 936	1684	iexplore.exe	IEXPLORE.EXE
PID 1684 wrote to memory of 936	1684	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\unvaccinated.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\unvaccinated.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:588

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\ExitEnter.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/588-61-0x0000000000000000-mapping.dmp

Download
memory/588-64-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/588-65-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/1292-54-0x000007FEFBCA1000-0x000007FEFBCA3000-memory.dmp

Filesize
8KB

Download
memory/1792-55-0x0000000000000000-mapping.dmp

Download
memory/1792-56-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download
memory/1792-57-0x00000000001B0000-0x00000000001DA000-memory.dmp

Filesize
168KB

Download
memory/1792-58-0x00000000001B0000-0x00000000001DA000-memory.dmp

Filesize
168KB

Download
memory/1792-59-0x0000000000140000-0x000000000016E000-memory.dmp

Filesize
184KB

Download
memory/1792-60-0x00000000001B0000-0x00000000001DA000-memory.dmp

Filesize
168KB

Download
memory/1792-63-0x00000000001B0000-0x00000000001DA000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads