qakbot | a8a24ff6f2021b620eeb073eef6549a4408014835883bebfadfad28887067aa2

General

Target

a8a24ff6f2021b620eeb073eef6549a4408014835883bebfadfad28887067aa2.dll
Size

1.6MB
MD5

2f24812ec4d8c7a26a71f58b922db523
SHA1

4c44eb5006e99bc72d728a31929461a3a500b2a7
SHA256

a8a24ff6f2021b620eeb073eef6549a4408014835883bebfadfad28887067aa2
SHA512

35dac3271667b2087ae9724d018dff96ba4eba8229e12e61f952d8434cc06e67830bb6dd4b76e2976394d228ec858b15cfb58d9dd1aa20500a9f26ac78df1206
SSDEEP

24576:W9mB+XxJ7zUqNS8KqCx2ffNrC0O60+bPzTk1wK7TpKsVv:WUBav7zbS8JCx2fftCv6JLwJ7FKsVv

Score

10^/10

qakbot tr 1634541613 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Umkgzcrot = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Eroluhwur = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2856 regsvr32.exe

pid	process
2856	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rundll32.exeexplorer.exeschtasks.exeregsvr32.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Imjvqptucuqdpg\2662b186 = ccb72fd1acb608f277ad6ef3080c5de876d04bc7a8251299b7c886834e468cc71cb1c770d2a9a35b83	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Imjvqptucuqdpg	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Imjvqptucuqdpg\6cb40e3e = 1f1457c5b55977464faa0a273675498778643dedcf099d283920c1b98bc191da24ab8c43c860989735d32bd1539c9b915605b9c2dfd14175afbdff66e9b36d7aa0fa5e3d9e0fd96d22f4bc22d97b4a43cc3d80bf1d9ed71ad93efebda181e42e22a458931216e540a201d1a686746304066d1fea6525a49391608827bcd767ad33ecad5d9f7ff38f86161186b8539b6318e54735c6a3b3742b30f0fe9aac920fc52be0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Imjvqptucuqdpg\d6494927 = eb1043d9deed0b131c2965f72178faa627a8430b916f016c29c2d51d445e11df749f6f680658e9ed424b606aa3ef0b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Imjvqptucuqdpg\ab4106ad = 8bbff41bf833cbfba0405f907d89ab9f3e1bccf25d3b18e233e3d61b1dba315444771b3e3652c694ea8fe770addf1fcf1c0111b7204bdacb986c487e17f47e2cf969de0c55b0e80a565e317e2725484bb9b69216d0532542aeea04ac436958	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Imjvqptucuqdpg\592bde70 = 2ff80728a5baad57f83be029587ca1514e0516cfeaa4c909ebdcb6f78a841a19e0b70f9b48f2da7dde246228662d2c2e17ff6b58c1d84b3281c8fb94768bace0df416b16963835b30a11f9ba638488b68f447887bb986382f3eff948087f5c5f409b622b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Imjvqptucuqdpg\592bde70 = 2ff81028a5ba9876ceb945548e3d791bf5d4fba9298ed1fc5a529c713ef26f5a853cad7a99d540eaf0c69f21eca2dd380b0213d921af6e39f155e630377b58d95ef256599cc378da848592f7105ecc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Imjvqptucuqdpg\6ef52e42 = 9ceeb79bfb8297b647b751671012d8fd41edd455049020827502b7d182aff720fecd55	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Imjvqptucuqdpg\13fd61c8 = 67307f7dfa2bc2a1f360486645c01dd0d844e23eea4eddbe0d3224b4ec7aae961ddd59c409fbb4dbb0021c5c6c0c930251b31371161c4e804f1cc1e07697d67b0f161281	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Imjvqptucuqdpg\d408695b = b09f2fdcd055791beb47a84fab9a1c3d2da014b28b5d1080af3b067d66fec25ec9202eb1d693b2d71f83228ab44439d3c116d3feb49d3b4b00f5b7e168f2c5ae02ca448de2311d4f402391803fa277b0ecfabef8aaa597fc78fde38bf69b17f2e8d36481f7552f	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2572 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2508 rundll32.exe
2856 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2508 rundll32.exe
2856 regsvr32.exe

pid	process
2572	schtasks.exe

pid	process
2508	rundll32.exe
2856	regsvr32.exe

pid	process
2508	rundll32.exe
2856	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2960 wrote to memory of 2508	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 2508	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 2508	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 2508	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 2508	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 2508	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 2508	2960	rundll32.exe	rundll32.exe
PID 2508 wrote to memory of 2576	2508	rundll32.exe	explorer.exe
PID 2508 wrote to memory of 2576	2508	rundll32.exe	explorer.exe
PID 2508 wrote to memory of 2576	2508	rundll32.exe	explorer.exe
PID 2508 wrote to memory of 2576	2508	rundll32.exe	explorer.exe
PID 2508 wrote to memory of 2576	2508	rundll32.exe	explorer.exe
PID 2508 wrote to memory of 2576	2508	rundll32.exe	explorer.exe
PID 2576 wrote to memory of 2572	2576	explorer.exe	schtasks.exe
PID 2576 wrote to memory of 2572	2576	explorer.exe	schtasks.exe
PID 2576 wrote to memory of 2572	2576	explorer.exe	schtasks.exe
PID 2576 wrote to memory of 2572	2576	explorer.exe	schtasks.exe
PID 2596 wrote to memory of 2832	2596	taskeng.exe	regsvr32.exe
PID 2596 wrote to memory of 2832	2596	taskeng.exe	regsvr32.exe
PID 2596 wrote to memory of 2832	2596	taskeng.exe	regsvr32.exe
PID 2596 wrote to memory of 2832	2596	taskeng.exe	regsvr32.exe
PID 2596 wrote to memory of 2832	2596	taskeng.exe	regsvr32.exe
PID 2832 wrote to memory of 2856	2832	regsvr32.exe	regsvr32.exe
PID 2832 wrote to memory of 2856	2832	regsvr32.exe	regsvr32.exe
PID 2832 wrote to memory of 2856	2832	regsvr32.exe	regsvr32.exe
PID 2832 wrote to memory of 2856	2832	regsvr32.exe	regsvr32.exe
PID 2832 wrote to memory of 2856	2832	regsvr32.exe	regsvr32.exe
PID 2832 wrote to memory of 2856	2832	regsvr32.exe	regsvr32.exe
PID 2832 wrote to memory of 2856	2832	regsvr32.exe	regsvr32.exe
PID 2856 wrote to memory of 2864	2856	regsvr32.exe	explorer.exe
PID 2856 wrote to memory of 2864	2856	regsvr32.exe	explorer.exe
PID 2856 wrote to memory of 2864	2856	regsvr32.exe	explorer.exe
PID 2856 wrote to memory of 2864	2856	regsvr32.exe	explorer.exe
PID 2856 wrote to memory of 2864	2856	regsvr32.exe	explorer.exe
PID 2856 wrote to memory of 2864	2856	regsvr32.exe	explorer.exe
PID 2864 wrote to memory of 1956	2864	explorer.exe	reg.exe
PID 2864 wrote to memory of 1956	2864	explorer.exe	reg.exe
PID 2864 wrote to memory of 1956	2864	explorer.exe	reg.exe
PID 2864 wrote to memory of 1956	2864	explorer.exe	reg.exe
PID 2864 wrote to memory of 1944	2864	explorer.exe	reg.exe
PID 2864 wrote to memory of 1944	2864	explorer.exe	reg.exe
PID 2864 wrote to memory of 1944	2864	explorer.exe	reg.exe
PID 2864 wrote to memory of 1944	2864	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a8a24ff6f2021b620eeb073eef6549a4408014835883bebfadfad28887067aa2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a8a24ff6f2021b620eeb073eef6549a4408014835883bebfadfad28887067aa2.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lhtykwp /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a8a24ff6f2021b620eeb073eef6549a4408014835883bebfadfad28887067aa2.dll\"" /SC ONCE /Z /ST 00:52 /ET 01:04
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2572

C:\Windows\system32\taskeng.exe
taskeng.exe {0BE45D7F-1C7D-4959-8945-8A678111ED1E} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a8a24ff6f2021b620eeb073eef6549a4408014835883bebfadfad28887067aa2.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\a8a24ff6f2021b620eeb073eef6549a4408014835883bebfadfad28887067aa2.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2864
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Umkgzcrot" /d "0"
        5⤵
        Windows security bypass
        
        PID:1956
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Eroluhwur" /d "0"
        5⤵
        Windows security bypass
        
        PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a8a24ff6f2021b620eeb073eef6549a4408014835883bebfadfad28887067aa2.dll

Filesize
1.6MB

MD5
2f24812ec4d8c7a26a71f58b922db523

SHA1
4c44eb5006e99bc72d728a31929461a3a500b2a7

SHA256
a8a24ff6f2021b620eeb073eef6549a4408014835883bebfadfad28887067aa2

SHA512
35dac3271667b2087ae9724d018dff96ba4eba8229e12e61f952d8434cc06e67830bb6dd4b76e2976394d228ec858b15cfb58d9dd1aa20500a9f26ac78df1206

Download Submit
memory/2508-8-0x00000000744C0000-0x000000007466B000-memory.dmp

Filesize
1.7MB

Download
memory/2508-1-0x00000000744C0000-0x000000007466B000-memory.dmp

Filesize
1.7MB

Download
memory/2508-4-0x00000000744C0000-0x000000007466B000-memory.dmp

Filesize
1.7MB

Download
memory/2508-3-0x0000000074650000-0x0000000074656000-memory.dmp

Filesize
24KB

Download
memory/2508-0-0x00000000744C0000-0x000000007466B000-memory.dmp

Filesize
1.7MB

Download
memory/2576-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2576-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2576-7-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2576-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2576-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2576-5-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2856-20-0x0000000073BF0000-0x0000000073D9B000-memory.dmp

Filesize
1.7MB

Download
memory/2856-21-0x0000000073BF0000-0x0000000073D9B000-memory.dmp

Filesize
1.7MB

Download
memory/2856-24-0x0000000073BF0000-0x0000000073D9B000-memory.dmp

Filesize
1.7MB

Download
memory/2864-27-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2864-28-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2864-26-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads