qakbot | 956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85

General

Target

956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85.dll
Size

819KB
MD5

2897721785645ad5b2a8fb524ed650c0
SHA1

d836fa75f0682b4c393418231aefca97169d551e
SHA256

956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85
SHA512

f40e3cd7ab855c3d5513efb0c84b831a538226a8baa7d743368989dcb5461b3d0ef7dd5cdd9a538a48835aebe60044e9bfdc063e5fb19cce7fecabe213c2786a
SSDEEP

24576:Fg/lh7rH/i9rz+hwKzyUj/JGzwMgNx1EWsrbw4iaZ4gRrb4:Fg9h7e9rz+t/JGz5gXuWsrbw4iaqgRrM

Score

10^/10

qakbot tr 1633597626 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633597626

C2

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Qifeatsgiby = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Gjykcaix = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3588 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2812 schtasks.exe

pid	process
3588	regsvr32.exe

pid	process
2812	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kbiyywxndoii	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kbiyywxndoii\d0c4a1a6 = 7f28d358a1256c4bb527fe340d01368d799f584b89447a83cc3d8756bf061c7bea1cbc47e46f4aa349fbaea02205ce9b0cd1817a5de92f8e0a28a8a7fbe66f32f8e283f481e4acac2475db5075140a19ced47d2d0106a35ebd589b31756ed8864b761190a27b63e50bf60d5484a248fe1e31318a8cdc2906b2b7555613a44d0ab4d6ff4f770b4959f5aafa5b71af5b65301642a7adbea9e7fa	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kbiyywxndoii\d28581da = 7533069fea2ed7584d2bfa7cb15e45415fb392b317e370443b00e491296d7a8c2dc452df68	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kbiyywxndoii\1731a935 = e4c220e0375cefed478a8d31bf578a71e2a7c520bf7f3a20b468d5ec54d3538a8f29c871e28fa9d7f808f0c792b08eb128dcc85bcf648a46676dd8e1463088f5989f4afc91cfe65e47bcd8aef7f420	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kbiyywxndoii\6878c6c3 = 4a601d459b24f6a17ec2352082c14bcb90b0bfd1312dd42c961b769162c1baab8665d5055dec3debba9de1b23ad83ac51e85d968c6794527a756a01f2470e09441c9f39c55	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kbiyywxndoii\e55b71e8 = b3a2ff4d97ea38721ace7abc6cc647acfa2ee8ff9419790d7ae4a41b7781bd73294892fce0629053c8eff87640fc08398a776c236abac99758f3596c890a369fbc0e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kbiyywxndoii\e55b71e8 = b3a2e84d97ea0d9acb840d07c641638213ed55657fc056e6c01369637dcc1e2eb0ef98a925ab403f861fe1c8cd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kbiyywxndoii\6a39e6bf = f3239d694f3a665dcd9a5139c125a6f1a5ee7b1d953bd796c5b2e21b47b706139c21936a74d97757b826dde9b9240dac9f188159708686fd945ad7d6b685f4e8d9ed71292bf7c6b1f5f593ee669e81	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kbiyywxndoii\af8dce50 = 7b20bf51d1767009c8338d55593b07bed4b1620908f6581a715cc16aa4d9babedd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kbiyywxndoii\9a121e1e = 73c63c0933bebb345ff1c2d3b50d0d9ce485b6dc7f37fb62b570b3551c2550647ac7ef01e24b42809dbb9f6181f28621b96aaf2831fb94dab52d2854baf714e239904af520a4ce008dfc19ab252cf50699156d9adcb2976fb09a	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2948 rundll32.exe
2948 rundll32.exe
3588 regsvr32.exe
3588 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2948 rundll32.exe
3588 regsvr32.exe

pid	process
2948	rundll32.exe
2948	rundll32.exe
3588	regsvr32.exe
3588	regsvr32.exe

pid	process
2948	rundll32.exe
3588	regsvr32.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.execmd.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1080 wrote to memory of 2948	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 2948	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 2948	1080	rundll32.exe	rundll32.exe
PID 2948 wrote to memory of 4928	2948	rundll32.exe	explorer.exe
PID 2948 wrote to memory of 4928	2948	rundll32.exe	explorer.exe
PID 2948 wrote to memory of 4928	2948	rundll32.exe	explorer.exe
PID 2948 wrote to memory of 4928	2948	rundll32.exe	explorer.exe
PID 2948 wrote to memory of 4928	2948	rundll32.exe	explorer.exe
PID 4928 wrote to memory of 2812	4928	explorer.exe	schtasks.exe
PID 4928 wrote to memory of 2812	4928	explorer.exe	schtasks.exe
PID 4928 wrote to memory of 2812	4928	explorer.exe	schtasks.exe
PID 5044 wrote to memory of 3588	5044	regsvr32.exe	regsvr32.exe
PID 5044 wrote to memory of 3588	5044	regsvr32.exe	regsvr32.exe
PID 5044 wrote to memory of 3588	5044	regsvr32.exe	regsvr32.exe
PID 3528 wrote to memory of 1276	3528	cmd.exe	regsvr32.exe
PID 3528 wrote to memory of 1276	3528	cmd.exe	regsvr32.exe
PID 3588 wrote to memory of 4208	3588	regsvr32.exe	explorer.exe
PID 3588 wrote to memory of 4208	3588	regsvr32.exe	explorer.exe
PID 3588 wrote to memory of 4208	3588	regsvr32.exe	explorer.exe
PID 3588 wrote to memory of 4208	3588	regsvr32.exe	explorer.exe
PID 3588 wrote to memory of 4208	3588	regsvr32.exe	explorer.exe
PID 4208 wrote to memory of 3336	4208	explorer.exe	reg.exe
PID 4208 wrote to memory of 3336	4208	explorer.exe	reg.exe
PID 4208 wrote to memory of 1788	4208	explorer.exe	reg.exe
PID 4208 wrote to memory of 1788	4208	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2948

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4928

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fitpihfy /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85.dll\"" /SC ONCE /Z /ST 12:41 /ET 12:53
4⤵
- Creates scheduled task(s)
PID:2812

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3528

C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe C:\Users\Admin\AppData\Local\Temp\956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85.dll
2⤵
PID:1276

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:5044

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3588

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4208

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Qifeatsgiby" /d "0"
4⤵
- Windows security bypass
PID:3336

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Gjykcaix" /d "0"
4⤵
- Windows security bypass
PID:1788

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85.dll
Filesize
819KB

MD5
2897721785645ad5b2a8fb524ed650c0

SHA1
d836fa75f0682b4c393418231aefca97169d551e

SHA256
956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85

SHA512
f40e3cd7ab855c3d5513efb0c84b831a538226a8baa7d743368989dcb5461b3d0ef7dd5cdd9a538a48835aebe60044e9bfdc063e5fb19cce7fecabe213c2786a

Download Submit
C:\Users\Admin\AppData\Local\Temp\956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85.dll
Filesize
819KB

MD5
2897721785645ad5b2a8fb524ed650c0

SHA1
d836fa75f0682b4c393418231aefca97169d551e

SHA256
956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85

SHA512
f40e3cd7ab855c3d5513efb0c84b831a538226a8baa7d743368989dcb5461b3d0ef7dd5cdd9a538a48835aebe60044e9bfdc063e5fb19cce7fecabe213c2786a

Download Submit
memory/2948-137-0x0000000074AE0000-0x0000000074C51000-memory.dmp

Filesize
1.4MB

Download
memory/2948-133-0x0000000074AE0000-0x0000000074C51000-memory.dmp

Filesize
1.4MB

Download
memory/2948-136-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download
memory/2948-134-0x0000000074AE0000-0x0000000074C51000-memory.dmp

Filesize
1.4MB

Download
memory/3588-153-0x0000000073300000-0x0000000073471000-memory.dmp

Filesize
1.4MB

Download
memory/3588-149-0x0000000073300000-0x0000000073471000-memory.dmp

Filesize
1.4MB

Download
memory/3588-150-0x0000000073300000-0x0000000073471000-memory.dmp

Filesize
1.4MB

Download
memory/3588-152-0x0000000073300000-0x0000000073471000-memory.dmp

Filesize
1.4MB

Download
memory/4208-159-0x0000000001290000-0x00000000012B1000-memory.dmp

Filesize
132KB

Download
memory/4208-156-0x0000000001290000-0x00000000012B1000-memory.dmp

Filesize
132KB

Download
memory/4208-157-0x0000000001290000-0x00000000012B1000-memory.dmp

Filesize
132KB

Download
memory/4208-155-0x0000000001290000-0x00000000012B1000-memory.dmp

Filesize
132KB

Download
memory/4928-140-0x0000000001000000-0x0000000001021000-memory.dmp

Filesize
132KB

Download
memory/4928-145-0x0000000001000000-0x0000000001021000-memory.dmp

Filesize
132KB

Download
memory/4928-143-0x0000000001000000-0x0000000001021000-memory.dmp

Filesize
132KB

Download
memory/4928-142-0x0000000001000000-0x0000000001021000-memory.dmp

Filesize
132KB

Download
memory/4928-141-0x0000000001000000-0x0000000001021000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads