qakbot | c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166

General

Target

c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166.dll
Size

1.1MB
MD5

8f24a209d47eae18b6f6b5b3b5806982
SHA1

c9dfcb0ea4efd3920c8f89d9ba0ad6ce0df3dbd6
SHA256

c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166
SHA512

49d9adb4ad98e4dadaf092df7921c3b08cb93965ba9d486e7767a81689d501deb9cc187f5fff61beed29dd35daf9e94bfa7439e84dc28766f80acddeb807cc39
SSDEEP

24576:YNYPpKOW1hcoHTQ9XbkX0YuSw7zMYQ0a4lFbk:YwkrzQXYXXuSoWx+

Score

10^/10

qakbot aa 1651213605 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.573

Botnet

AA

Campaign

1651213605

C2

74.14.7.71:2222

1.161.104.149:443

1.161.104.149:995

24.152.219.253:995

180.129.20.164:995

46.107.48.202:443

118.172.250.162:443

102.65.38.74:443

76.25.142.196:443

93.48.80.198:995

47.23.89.62:995

2.34.12.8:443

38.70.253.226:2222

47.23.89.62:993

75.99.168.194:443

41.228.22.180:443

148.64.96.100:443

108.60.213.141:443

172.114.160.81:443

140.82.49.12:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Unposfyg = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Oyvecpjgm = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1892 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

580 schtasks.exe

pid	process
1892	regsvr32.exe

pid	process
580	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Esguqpltrme	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esguqpltrme\b857f64f = 192096032c70d5de13a78fd30d998bbfe03a70734e3741283c2201a0830e96c3346ce7a4a5fcb18063427b736cb1a844170aad8d67e8a1f0e17faa52c47d217a470b50def34e2338be1d7a23088c5ad9846a982824fb6a5f8db4269d0faebf6403b571aa39287fb1d8ab69b12a6a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esguqpltrme\ba16d633 = 93ba06443a51e10813ac4872f8b59d328780ae81c5d7a9f66ecebc2a7315	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esguqpltrme\7fa2fedc = 5ff6e3ed297635111e562d441970849c058d671fd3c5f465ad7a0318b233c606af1a851303aa7f7d7a4b7710ee205ef03166caa83e371b92cd9414b418ca1c42cfbf2cb9c5f2d12b80c2c2a1d275ed9e3fd4eab31473adb7027fe96dd3d53427284c1c77a37d173073e0327b5260d0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esguqpltrme\c71e99b9 = 2fb25fa888cd299bef54417ea2f683d4cf243c91	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esguqpltrme\8dc82601 = f0ff3e930f50c5b4778b60f729cda7496fed74f0685392e9a8eebca2e567205e46a14f935383c62ed8fd1a9e2574464c18789dd612e28398a9a7faea229b19bc7814d48353a1c9ff6ba976f211eb21cc6799a53e6ea523c3b184ced76915bf7036916c875b9e7b79fc3c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esguqpltrme\2aab156 = e9532de64fcee3c6d0500a90b4799d093a3dec627d7e20d6f3b4f9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esguqpltrme\eb912a = 6ea8084f2ddc9799df9866947cd2bdc4b9884499569fb2e739dfc6e86c354fe9cd2c115130e77b277406fa87d8c941e4937044ec33c7b6434958c8de40204664aaaca4aeb2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esguqpltrme\f28149f7 = c548a20209dd20726eec6b51044478128a47262b1d664091fa5e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esguqpltrme\8dc82601 = f0ff29930f50f0e060832ab34aeb2b6a8cfa466b5501c4931cbc262eca2e30822695f89766181f998f652b789d094a4ca156e306b1b6902449074c8c416af7979335731e3bb98c63b852c4711875ccd11733bdcb80cbae449065996f646358675c991a5dea630c1e67c3e3d2c56cf663de7a767c5ddb453f0398f234cb2434	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeexplorer.exeregsvr32.exe

pid	process
1508	rundll32.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
1892	regsvr32.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe
560	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1508 rundll32.exe
1892 regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 528 wrote to memory of 1508	528	rundll32.exe	rundll32.exe
PID 528 wrote to memory of 1508	528	rundll32.exe	rundll32.exe
PID 528 wrote to memory of 1508	528	rundll32.exe	rundll32.exe
PID 528 wrote to memory of 1508	528	rundll32.exe	rundll32.exe
PID 528 wrote to memory of 1508	528	rundll32.exe	rundll32.exe
PID 528 wrote to memory of 1508	528	rundll32.exe	rundll32.exe
PID 528 wrote to memory of 1508	528	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 560	1508	rundll32.exe	explorer.exe
PID 1508 wrote to memory of 560	1508	rundll32.exe	explorer.exe
PID 1508 wrote to memory of 560	1508	rundll32.exe	explorer.exe
PID 1508 wrote to memory of 560	1508	rundll32.exe	explorer.exe
PID 1508 wrote to memory of 560	1508	rundll32.exe	explorer.exe
PID 1508 wrote to memory of 560	1508	rundll32.exe	explorer.exe
PID 560 wrote to memory of 580	560	explorer.exe	schtasks.exe
PID 560 wrote to memory of 580	560	explorer.exe	schtasks.exe
PID 560 wrote to memory of 580	560	explorer.exe	schtasks.exe
PID 560 wrote to memory of 580	560	explorer.exe	schtasks.exe
PID 108 wrote to memory of 576	108	taskeng.exe	regsvr32.exe
PID 108 wrote to memory of 576	108	taskeng.exe	regsvr32.exe
PID 108 wrote to memory of 576	108	taskeng.exe	regsvr32.exe
PID 108 wrote to memory of 576	108	taskeng.exe	regsvr32.exe
PID 108 wrote to memory of 576	108	taskeng.exe	regsvr32.exe
PID 576 wrote to memory of 1892	576	regsvr32.exe	regsvr32.exe
PID 576 wrote to memory of 1892	576	regsvr32.exe	regsvr32.exe
PID 576 wrote to memory of 1892	576	regsvr32.exe	regsvr32.exe
PID 576 wrote to memory of 1892	576	regsvr32.exe	regsvr32.exe
PID 576 wrote to memory of 1892	576	regsvr32.exe	regsvr32.exe
PID 576 wrote to memory of 1892	576	regsvr32.exe	regsvr32.exe
PID 576 wrote to memory of 1892	576	regsvr32.exe	regsvr32.exe
PID 1892 wrote to memory of 1940	1892	regsvr32.exe	explorer.exe
PID 1892 wrote to memory of 1940	1892	regsvr32.exe	explorer.exe
PID 1892 wrote to memory of 1940	1892	regsvr32.exe	explorer.exe
PID 1892 wrote to memory of 1940	1892	regsvr32.exe	explorer.exe
PID 1892 wrote to memory of 1940	1892	regsvr32.exe	explorer.exe
PID 1892 wrote to memory of 1940	1892	regsvr32.exe	explorer.exe
PID 1940 wrote to memory of 844	1940	explorer.exe	reg.exe
PID 1940 wrote to memory of 844	1940	explorer.exe	reg.exe
PID 1940 wrote to memory of 844	1940	explorer.exe	reg.exe
PID 1940 wrote to memory of 844	1940	explorer.exe	reg.exe
PID 1940 wrote to memory of 928	1940	explorer.exe	reg.exe
PID 1940 wrote to memory of 928	1940	explorer.exe	reg.exe
PID 1940 wrote to memory of 928	1940	explorer.exe	reg.exe
PID 1940 wrote to memory of 928	1940	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn owuecfzhc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166.dll\"" /SC ONCE /Z /ST 08:48 /ET 09:00
4⤵
- Creates scheduled task(s)
PID:580

C:\Windows\system32\taskeng.exe
taskeng.exe {58803928-68FA-43D3-97A7-651191E75FD6} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:108

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Unposfyg" /d "0"
5⤵
- Windows security bypass
PID:844

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Oyvecpjgm" /d "0"
5⤵
- Windows security bypass
PID:928

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166.dll
Filesize
1.1MB

MD5
8f24a209d47eae18b6f6b5b3b5806982

SHA1
c9dfcb0ea4efd3920c8f89d9ba0ad6ce0df3dbd6

SHA256
c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166

SHA512
49d9adb4ad98e4dadaf092df7921c3b08cb93965ba9d486e7767a81689d501deb9cc187f5fff61beed29dd35daf9e94bfa7439e84dc28766f80acddeb807cc39

Download Submit
\Users\Admin\AppData\Local\Temp\c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166.dll
Filesize
1.1MB

MD5
8f24a209d47eae18b6f6b5b3b5806982

SHA1
c9dfcb0ea4efd3920c8f89d9ba0ad6ce0df3dbd6

SHA256
c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166

SHA512
49d9adb4ad98e4dadaf092df7921c3b08cb93965ba9d486e7767a81689d501deb9cc187f5fff61beed29dd35daf9e94bfa7439e84dc28766f80acddeb807cc39

Download Submit
memory/560-64-0x0000000000110000-0x0000000000112000-memory.dmp

Filesize
8KB

Download
memory/560-75-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download
memory/560-73-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download
memory/560-72-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download
memory/560-71-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download
memory/560-70-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download
memory/560-68-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download
memory/1508-63-0x0000000000980000-0x0000000000A9D000-memory.dmp

Filesize
1.1MB

Download
memory/1508-54-0x0000000000980000-0x0000000000A9D000-memory.dmp

Filesize
1.1MB

Download
memory/1508-65-0x0000000002140000-0x00000000021CF000-memory.dmp

Filesize
572KB

Download
memory/1508-62-0x0000000002140000-0x00000000021CF000-memory.dmp

Filesize
572KB

Download
memory/1508-61-0x0000000000310000-0x000000000039A000-memory.dmp

Filesize
552KB

Download
memory/1508-60-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1508-58-0x0000000002140000-0x00000000021CF000-memory.dmp

Filesize
572KB

Download
memory/1508-59-0x0000000002140000-0x00000000021CF000-memory.dmp

Filesize
572KB

Download
memory/1508-56-0x0000000002140000-0x00000000021CF000-memory.dmp

Filesize
572KB

Download
memory/1508-57-0x0000000002140000-0x00000000021CF000-memory.dmp

Filesize
572KB

Download
memory/1508-55-0x0000000002140000-0x00000000021CF000-memory.dmp

Filesize
572KB

Download
memory/1892-82-0x00000000010D0000-0x000000000115F000-memory.dmp

Filesize
572KB

Download
memory/1892-89-0x00000000010D0000-0x000000000115F000-memory.dmp

Filesize
572KB

Download
memory/1892-80-0x0000000000AC0000-0x0000000000BDD000-memory.dmp

Filesize
1.1MB

Download
memory/1892-83-0x00000000010D0000-0x000000000115F000-memory.dmp

Filesize
572KB

Download
memory/1892-84-0x00000000010D0000-0x000000000115F000-memory.dmp

Filesize
572KB

Download
memory/1892-85-0x00000000010D0000-0x000000000115F000-memory.dmp

Filesize
572KB

Download
memory/1892-86-0x00000000010D0000-0x000000000115F000-memory.dmp

Filesize
572KB

Download
memory/1892-87-0x0000000000AC0000-0x0000000000BDD000-memory.dmp

Filesize
1.1MB

Download
memory/1892-88-0x0000000000FB0000-0x000000000103A000-memory.dmp

Filesize
552KB

Download
memory/1892-81-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1892-92-0x00000000010D0000-0x000000000115F000-memory.dmp

Filesize
572KB

Download
memory/1940-93-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download
memory/1940-96-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download
memory/1940-97-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download
memory/1940-98-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download
memory/1940-99-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download
memory/1940-101-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads