qakbot | 9957c0358ae3b68fc13747b67c4f16182e0b5a8a7aa4ae09d195aa9069dad931

General

Target

f5c7f0df31478fb32e6aae768f63fd1d47e0a796714d10bb61ead7f5da2e9739.dll
Size

449KB
MD5

608ee678216475648b40a347326bf995
SHA1

78d25f6565242a193213e7c4489534bc28eeb2a2
SHA256

f5c7f0df31478fb32e6aae768f63fd1d47e0a796714d10bb61ead7f5da2e9739
SHA512

196d416df395dbe3517dece54bf1b783c63851d67f9d89d797ace4d458c04fc2d3f7a47443dec29f228bacbdf5d863d6e7b3663a5ad647451a1eb86a06240219
SSDEEP

6144:36N5XNlCfcqFhOdpwNzM2a3gfwp3NkOWuzv/24bktfTGoH:KrducqxNzbaP3WOWuLTCfThH

Score

10^/10

qakbot bb 1663148750 banker persistence stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

BB

Campaign

1663148750

C2

193.3.19.37:443

99.232.140.205:2222

99.253.251.74:443

197.94.210.133:443

37.210.148.30:995

14.161.194.86:443

154.181.203.230:995

200.161.62.126:32101

134.35.10.122:443

64.207.215.69:443

81.131.161.131:2078

217.165.85.223:993

78.100.225.34:2222

85.114.110.108:443

102.38.96.108:995

123.240.131.1:443

109.158.159.179:993

186.105.182.127:443

190.44.40.48:995

88.233.194.154:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4780 regsvr32.exe

pid	process
4780	regsvr32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fzjtqdhh = "regsvr32.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Qtxxgp\\obbiykidbm.dll\""	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

5028 schtasks.exe

pid	process
5028	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
1560	regsvr32.exe
1560	regsvr32.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe
5076	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1560 regsvr32.exe
4780 regsvr32.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 884 wrote to memory of 1560	884	regsvr32.exe	regsvr32.exe
PID 884 wrote to memory of 1560	884	regsvr32.exe	regsvr32.exe
PID 884 wrote to memory of 1560	884	regsvr32.exe	regsvr32.exe
PID 1560 wrote to memory of 5076	1560	regsvr32.exe	explorer.exe
PID 1560 wrote to memory of 5076	1560	regsvr32.exe	explorer.exe
PID 1560 wrote to memory of 5076	1560	regsvr32.exe	explorer.exe
PID 1560 wrote to memory of 5076	1560	regsvr32.exe	explorer.exe
PID 1560 wrote to memory of 5076	1560	regsvr32.exe	explorer.exe
PID 5076 wrote to memory of 5028	5076	explorer.exe	schtasks.exe
PID 5076 wrote to memory of 5028	5076	explorer.exe	schtasks.exe
PID 5076 wrote to memory of 5028	5076	explorer.exe	schtasks.exe
PID 5076 wrote to memory of 4780	5076	explorer.exe	regsvr32.exe
PID 5076 wrote to memory of 4780	5076	explorer.exe	regsvr32.exe
PID 5076 wrote to memory of 4780	5076	explorer.exe	regsvr32.exe
PID 4780 wrote to memory of 3632	4780	regsvr32.exe	explorer.exe
PID 4780 wrote to memory of 3632	4780	regsvr32.exe	explorer.exe
PID 4780 wrote to memory of 3632	4780	regsvr32.exe	explorer.exe
PID 4780 wrote to memory of 3632	4780	regsvr32.exe	explorer.exe
PID 4780 wrote to memory of 3632	4780	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f5c7f0df31478fb32e6aae768f63fd1d47e0a796714d10bb61ead7f5da2e9739.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\f5c7f0df31478fb32e6aae768f63fd1d47e0a796714d10bb61ead7f5da2e9739.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5076

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 09:34 /tn fiyiksqth /ET 09:45 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAZgA1AGMANwBmADAAZABmADMAMQA0ADcAOABmAGIAMwAyAGUANgBhAGEAZQA3ADYAOABmADYAMwBmAGQAMQBkADQANwBlADAAYQA3ADkANgA3ADEANABkADEAMABiAGIANgAxAGUAYQBkADcAZgA1AGQAYQAyAGUAOQA3ADMAOQAuAGQAbABsACIA" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:5028

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Qtxxgp\obbiykidbm.dll"
4⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4780

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
PID:3632

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Qtxxgp\obbiykidbm.dll
Filesize
449KB

MD5
608ee678216475648b40a347326bf995

SHA1
78d25f6565242a193213e7c4489534bc28eeb2a2

SHA256
f5c7f0df31478fb32e6aae768f63fd1d47e0a796714d10bb61ead7f5da2e9739

SHA512
196d416df395dbe3517dece54bf1b783c63851d67f9d89d797ace4d458c04fc2d3f7a47443dec29f228bacbdf5d863d6e7b3663a5ad647451a1eb86a06240219

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Qtxxgp\obbiykidbm.dll
Filesize
449KB

MD5
608ee678216475648b40a347326bf995

SHA1
78d25f6565242a193213e7c4489534bc28eeb2a2

SHA256
f5c7f0df31478fb32e6aae768f63fd1d47e0a796714d10bb61ead7f5da2e9739

SHA512
196d416df395dbe3517dece54bf1b783c63851d67f9d89d797ace4d458c04fc2d3f7a47443dec29f228bacbdf5d863d6e7b3663a5ad647451a1eb86a06240219

Download Submit
memory/1560-133-0x0000000000EB0000-0x0000000000ED2000-memory.dmp

Filesize
136KB

Download
memory/1560-135-0x0000000000EB0000-0x0000000000ED2000-memory.dmp

Filesize
136KB

Download
memory/1560-132-0x0000000000000000-mapping.dmp

Download
memory/3632-147-0x0000000000E30000-0x0000000000E52000-memory.dmp

Filesize
136KB

Download
memory/3632-145-0x0000000000E30000-0x0000000000E52000-memory.dmp

Filesize
136KB

Download
memory/3632-143-0x0000000000000000-mapping.dmp

Download
memory/4780-144-0x0000000001160000-0x0000000001182000-memory.dmp

Filesize
136KB

Download
memory/4780-139-0x0000000000000000-mapping.dmp

Download
memory/4780-142-0x0000000001160000-0x0000000001182000-memory.dmp

Filesize
136KB

Download
memory/5028-136-0x0000000000000000-mapping.dmp

Download
memory/5076-138-0x0000000000E40000-0x0000000000E62000-memory.dmp

Filesize
136KB

Download
memory/5076-137-0x0000000000E40000-0x0000000000E62000-memory.dmp

Filesize
136KB

Download
memory/5076-146-0x0000000000E40000-0x0000000000E62000-memory.dmp

Filesize
136KB

Download
memory/5076-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads