qakbot | fbd89e3475759ccc31884bd0d1e4aacd528a6f2ea736511d3ae5a83cc678a0b3

General

Target

34e4c5e56024313a23dc1e6df0e742559e378dfe3c47e20cb1d2f739b71ab96d.dll
Size

836KB
MD5

2df42d2e20e3d91a380fe98845d02b10
SHA1

7556ad1a1319921a06dfafd44e40b5e851b4a578
SHA256

34e4c5e56024313a23dc1e6df0e742559e378dfe3c47e20cb1d2f739b71ab96d
SHA512

e268cf4d6db9323041677e76ab6d4f6a4ae84ccef289eaa2e407cddb22c5be69ab33dc865d7bc33ca8b2b3bcf13376dc15c8f523c519f5673904075002bba01f
SSDEEP

24576:IL8cabX4zXsvdilerHJI6NIH1E2C4Nl4Z:cybX4XslKCBIH1E2C4

Score

10^/10

qakbot tr 1633943125 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633943125

C2

140.82.49.12:443

89.137.52.44:443

24.107.165.50:443

66.216.193.114:443

75.131.217.182:443

41.86.42.158:995

24.119.214.7:443

67.166.233.75:443

105.198.236.99:443

120.151.47.189:443

2.222.167.138:443

41.228.22.180:443

78.105.213.151:995

5.193.125.67:995

41.86.42.158:443

96.57.188.174:2078

120.150.218.241:995

66.177.215.152:0

122.11.220.212:2222

73.52.50.32:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Retseo = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Halhuej = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

560 regsvr32.exe

pid	process
560	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rundll32.exeexplorer.exeschtasks.exeregsvr32.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Icmozaa	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icmozaa\d764bae3 = e7c72ebc2fe3582adfaed395d887180c0d8c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icmozaa\aa6cf569 = b0bcf22f81778d1e7295569a1e410819c1692f22bdcacbdb810f2688af269d450272f3034dd10afbfd0a605b83e7f9d76fed9064174e483564c7319aaa4499020b4779cbe45241657f70239eedcb65f7e524d3a079e460b3ff9275106276a2be8b9efd04b516	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icmozaa\6d99fdfa = 15d97e9b9d9010ee30e7dec40c980452f51d35f80512d39536a165f689ee6b64fa2fb9c12d4c8a04d0cbd61ad2129d4c873e82b5bcfa6161c78cd7f456b88d71d69b0124da15c35a807dbd977a8e027556a2127994f584cb6b92b3c4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icmozaa\9ff32527 = 74caa6908fb4aabd022dc68b6e8daeba1829aeefe10c0b4d93613ee44f775be267aba21717b8858bf969f80f39eb5d819e8baeb0c8260f4804a28c52d95fa374d7eccd736eff1a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icmozaa\e0ba4ad1 = 3f1710ecd15ad750fef7f1670211b7f14096bc422ddd3c10e0eb2da8fa30cf1ebf377bc999a89711032f51fad2d8f2c5c544920ca38f4750fdea5e663a08299f6d9598993027e65c5502ed2e6ddc2a81d96320	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icmozaa\d5259a9f = 0293a74366b6171497cbdcc47511ce72c2bb2abda659634a0c7d3fe2f5b4519a1dcea535ef6a515972c0283a29638cad3a68a8b1ed5782e87cca5359d9e7ed29fae29f22d8c2ab9429f9506db0c5c4626f1e8626c7c847ac3ea99f87d56701c33c27798dc924b77739b6c5bef54c947c67d698ab79da8c2705fa74051ec5e7802c230fe9b0194262b2c13b92480535a656f76fd2b00901cc48b3b14051fdbcafa3402c9ae9fad7332b1f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icmozaa\6fd8dd86 = 9535f296c136ea2a2eebd56374057c81	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icmozaa\12d0920c = db2835e048e2e7d48e2ba1c8bfc9d9001babdbe99de9f17f7ccb83c3757812374371a690cb36d04b25d1e87b09840bb65f6a03b881873adc104f3d8a685ce52e9683d10cb7de59c3c83f3d7bb0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icmozaa\e0ba4ad1 = 3f1707ecd15ae2c146654c9107d5c31111ae461a25871fb8ab4b6594e16bb374a2ac2b2162f84d69375b992481422045409665f5f34b1c436dfd4fd6a7c512298d49394d3b1035a36b4b4c88f98b4e58d17b5432d2673ec5f9ac7a3c9f4c6bc3cd65a787c9e23b53	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2704 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2520 rundll32.exe
560 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2520 rundll32.exe
560 regsvr32.exe

pid	process
2704	schtasks.exe

pid	process
2520	rundll32.exe
560	regsvr32.exe

pid	process
2520	rundll32.exe
560	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2448 wrote to memory of 2520	2448	rundll32.exe	rundll32.exe
PID 2448 wrote to memory of 2520	2448	rundll32.exe	rundll32.exe
PID 2448 wrote to memory of 2520	2448	rundll32.exe	rundll32.exe
PID 2448 wrote to memory of 2520	2448	rundll32.exe	rundll32.exe
PID 2448 wrote to memory of 2520	2448	rundll32.exe	rundll32.exe
PID 2448 wrote to memory of 2520	2448	rundll32.exe	rundll32.exe
PID 2448 wrote to memory of 2520	2448	rundll32.exe	rundll32.exe
PID 2520 wrote to memory of 484	2520	rundll32.exe	explorer.exe
PID 2520 wrote to memory of 484	2520	rundll32.exe	explorer.exe
PID 2520 wrote to memory of 484	2520	rundll32.exe	explorer.exe
PID 2520 wrote to memory of 484	2520	rundll32.exe	explorer.exe
PID 2520 wrote to memory of 484	2520	rundll32.exe	explorer.exe
PID 2520 wrote to memory of 484	2520	rundll32.exe	explorer.exe
PID 484 wrote to memory of 2704	484	explorer.exe	schtasks.exe
PID 484 wrote to memory of 2704	484	explorer.exe	schtasks.exe
PID 484 wrote to memory of 2704	484	explorer.exe	schtasks.exe
PID 484 wrote to memory of 2704	484	explorer.exe	schtasks.exe
PID 1660 wrote to memory of 2740	1660	taskeng.exe	regsvr32.exe
PID 1660 wrote to memory of 2740	1660	taskeng.exe	regsvr32.exe
PID 1660 wrote to memory of 2740	1660	taskeng.exe	regsvr32.exe
PID 1660 wrote to memory of 2740	1660	taskeng.exe	regsvr32.exe
PID 1660 wrote to memory of 2740	1660	taskeng.exe	regsvr32.exe
PID 2740 wrote to memory of 560	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 560	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 560	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 560	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 560	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 560	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 560	2740	regsvr32.exe	regsvr32.exe
PID 560 wrote to memory of 1116	560	regsvr32.exe	explorer.exe
PID 560 wrote to memory of 1116	560	regsvr32.exe	explorer.exe
PID 560 wrote to memory of 1116	560	regsvr32.exe	explorer.exe
PID 560 wrote to memory of 1116	560	regsvr32.exe	explorer.exe
PID 560 wrote to memory of 1116	560	regsvr32.exe	explorer.exe
PID 560 wrote to memory of 1116	560	regsvr32.exe	explorer.exe
PID 1116 wrote to memory of 2912	1116	explorer.exe	reg.exe
PID 1116 wrote to memory of 2912	1116	explorer.exe	reg.exe
PID 1116 wrote to memory of 2912	1116	explorer.exe	reg.exe
PID 1116 wrote to memory of 2912	1116	explorer.exe	reg.exe
PID 1116 wrote to memory of 3008	1116	explorer.exe	reg.exe
PID 1116 wrote to memory of 3008	1116	explorer.exe	reg.exe
PID 1116 wrote to memory of 3008	1116	explorer.exe	reg.exe
PID 1116 wrote to memory of 3008	1116	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34e4c5e56024313a23dc1e6df0e742559e378dfe3c47e20cb1d2f739b71ab96d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\34e4c5e56024313a23dc1e6df0e742559e378dfe3c47e20cb1d2f739b71ab96d.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:484
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wrwnndaqj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\34e4c5e56024313a23dc1e6df0e742559e378dfe3c47e20cb1d2f739b71ab96d.dll\"" /SC ONCE /Z /ST 20:56 /ET 21:08
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2704

C:\Windows\system32\taskeng.exe
taskeng.exe {069A0C23-FB45-4ACB-80E2-AA073A6B43A2} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\34e4c5e56024313a23dc1e6df0e742559e378dfe3c47e20cb1d2f739b71ab96d.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\34e4c5e56024313a23dc1e6df0e742559e378dfe3c47e20cb1d2f739b71ab96d.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1116
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Retseo" /d "0"
        5⤵
        Windows security bypass
        
        PID:2912
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Halhuej" /d "0"
        5⤵
        Windows security bypass
        
        PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\34e4c5e56024313a23dc1e6df0e742559e378dfe3c47e20cb1d2f739b71ab96d.dll

Filesize
836KB

MD5
2df42d2e20e3d91a380fe98845d02b10

SHA1
7556ad1a1319921a06dfafd44e40b5e851b4a578

SHA256
34e4c5e56024313a23dc1e6df0e742559e378dfe3c47e20cb1d2f739b71ab96d

SHA512
e268cf4d6db9323041677e76ab6d4f6a4ae84ccef289eaa2e407cddb22c5be69ab33dc865d7bc33ca8b2b3bcf13376dc15c8f523c519f5673904075002bba01f

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/484-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/484-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/484-7-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/484-5-0x0000000000340000-0x0000000000342000-memory.dmp

Filesize
8KB

Download
memory/484-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/484-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/560-20-0x0000000073D60000-0x0000000073ECE000-memory.dmp

Filesize
1.4MB

Download
memory/560-21-0x0000000073D60000-0x0000000073ECE000-memory.dmp

Filesize
1.4MB

Download
memory/560-24-0x0000000073D60000-0x0000000073ECE000-memory.dmp

Filesize
1.4MB

Download
memory/560-26-0x0000000073D60000-0x0000000073ECE000-memory.dmp

Filesize
1.4MB

Download
memory/1116-28-0x0000000000350000-0x0000000000371000-memory.dmp

Filesize
132KB

Download
memory/1116-29-0x0000000000350000-0x0000000000371000-memory.dmp

Filesize
132KB

Download
memory/1116-30-0x0000000000350000-0x0000000000371000-memory.dmp

Filesize
132KB

Download
memory/2520-0-0x0000000074790000-0x00000000748FE000-memory.dmp

Filesize
1.4MB

Download
memory/2520-3-0x0000000074862000-0x0000000074868000-memory.dmp

Filesize
24KB

Download
memory/2520-6-0x0000000074790000-0x00000000748FE000-memory.dmp

Filesize
1.4MB

Download
memory/2520-4-0x0000000074790000-0x00000000748FE000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads