qakbot | 0e06e9585cc9db33ee999ca4de668ab64ef6e9fa928ae6541b2f1ec68ff09da8

max time kernel
748s
max time network
753s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
31-07-2024 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71e2483b2d36765651132c9c1f935784a2008a91159b0ee3bbfb94193d0d644e.dll
Size

402KB
MD5

74d8ec87fcc6d4fb65dea95cbf0b7ed0
SHA1

0907206e93cbf8492e673c59855965bb6bd9d6aa
SHA256

71e2483b2d36765651132c9c1f935784a2008a91159b0ee3bbfb94193d0d644e
SHA512

5fff54384cf81a4fb2b27b25bd574630b85dbf8d1b9a9f94188720e92ee3ba8e9ed0e921922e2bba29748a2d5892330faa3780595c6977ae645170e94fb5438b
SSDEEP

6144:jI80K7rRaixyrkYTj4tO8eptRnyFWo2NZTLmdJdWqF83kdE0WPQ2:N0K7rRaUuTj/8eC6H8JZZdE3

Score

10^/10

qakbot tr02 1607427512 banker discovery stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.62

Botnet

tr02

Campaign

1607427512

73.32.115.251:443

161.199.180.159:443

185.163.221.77:2222

197.161.154.132:443

105.198.236.99:443

83.196.50.197:2222

96.225.88.23:443

156.222.27.207:995

81.214.126.173:2222

83.110.13.182:2222

85.121.42.12:443

67.82.244.199:2222

172.87.157.235:3389

86.176.133.145:2222

72.186.1.237:443

80.11.5.65:2222

94.59.236.155:995

81.150.181.168:2222

184.98.97.227:995

149.28.101.90:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Loads dropped DLL 2 IoCs

pid	Process
3020	regsvr32.exe
1064	regsvr32.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1624	4652	WerFault.exe	73
5016	3020	WerFault.exe	80
2072	1064	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Service	regsvr32.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4652	regsvr32.exe
4652	regsvr32.exe
4652	regsvr32.exe
4652	regsvr32.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4652	regsvr32.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 4652	3040	regsvr32.exe	73
PID 3040 wrote to memory of 4652	3040	regsvr32.exe	73
PID 3040 wrote to memory of 4652	3040	regsvr32.exe	73
PID 4652 wrote to memory of 3700	4652	regsvr32.exe	74
PID 4652 wrote to memory of 3700	4652	regsvr32.exe	74
PID 4652 wrote to memory of 3700	4652	regsvr32.exe	74
PID 4652 wrote to memory of 3700	4652	regsvr32.exe	74
PID 4652 wrote to memory of 3700	4652	regsvr32.exe	74
PID 3700 wrote to memory of 3376	3700	explorer.exe	77
PID 3700 wrote to memory of 3376	3700	explorer.exe	77
PID 3700 wrote to memory of 3376	3700	explorer.exe	77
PID 4808 wrote to memory of 3020	4808	regsvr32.exe	80
PID 4808 wrote to memory of 3020	4808	regsvr32.exe	80
PID 4808 wrote to memory of 3020	4808	regsvr32.exe	80
PID 1704 wrote to memory of 1064	1704	regsvr32.exe	83
PID 1704 wrote to memory of 1064	1704	regsvr32.exe	83
PID 1704 wrote to memory of 1064	1704	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\71e2483b2d36765651132c9c1f935784a2008a91159b0ee3bbfb94193d0d644e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\71e2483b2d36765651132c9c1f935784a2008a91159b0ee3bbfb94193d0d644e.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cdddvmzq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\71e2483b2d36765651132c9c1f935784a2008a91159b0ee3bbfb94193d0d644e.dll\"" /SC ONCE /Z /ST 19:42 /ET 19:54
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 764
    3⤵
    - Program crash
    PID:1624

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\71e2483b2d36765651132c9c1f935784a2008a91159b0ee3bbfb94193d0d644e.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\71e2483b2d36765651132c9c1f935784a2008a91159b0ee3bbfb94193d0d644e.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 596
    3⤵
    - Program crash
    PID:5016

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\71e2483b2d36765651132c9c1f935784a2008a91159b0ee3bbfb94193d0d644e.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\71e2483b2d36765651132c9c1f935784a2008a91159b0ee3bbfb94193d0d644e.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 596
    3⤵
    - Program crash
    PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\71e2483b2d36765651132c9c1f935784a2008a91159b0ee3bbfb94193d0d644e.dll

Filesize
402KB

MD5
1b19895b97a55c26e3c4095ead06f24a

SHA1
c49fe662b6c7c7dbd514bb31d3f30e77aba793c2

SHA256
c4320df7798e30db962467c4710c01209938204a50c2d397b69d02da1cff53b4

SHA512
680ba52ae07ee3eb9aaa588fa1fb13837b50e1466cb92d0e2e7d692e244adc0b90b632064d9fa5dc8517add6c4ebd6d51d6003b88ae29c3c881a289e89789818

Download Submit
memory/3700-29-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-9-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-28-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-50-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-8-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-51-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-49-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-14-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-48-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-19-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-21-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-22-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-23-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-25-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-26-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-27-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-10-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-30-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-2-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-32-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-31-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-33-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-34-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-35-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-38-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-39-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-40-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-42-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-41-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-44-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-43-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3700-46-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/4652-1-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4652-13-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4652-12-0x000000000040A000-0x000000000040C000-memory.dmp

Filesize
8KB

Download
memory/4652-0-0x000000000040A000-0x000000000040C000-memory.dmp

Filesize
8KB

Download