qakbot | 76cf544349c4d0d62a70dadc232db5cc83b76b91ba2d83397397065d3493f421

Analysis

max time kernel
112s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76cf544349c4d0d62a70dadc232db5cc83b76b91ba2d83397397065d3493f421.dll
Size

512KB
MD5

ac2cec3f240393f9015b7c6754bdef59
SHA1

36c5790aae838a0fc04f81da8c364bdb04208707
SHA256

76cf544349c4d0d62a70dadc232db5cc83b76b91ba2d83397397065d3493f421
SHA512

3447a336e0b2e8206e77d874abc9b0c2d01c5ea87172b25b707d90a9d1837b903a69deaf09879278156d03852b35a57613b248b84ff9700c9b53f49af091942a
SSDEEP

6144:bHEeraRbpt5e3JVAfqX+2Rr+nxQDBO03yDLC:rEk6z5mvAfLf0

Score

10^/10

qakbot star01 1634935795 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

star01

Campaign

1634935795

45.9.20.200:443

96.246.158.154:995

67.165.206.193:993

207.246.112.221:443

37.208.181.198:61202

77.255.12.88:443

79.160.207.214:443

216.201.162.158:443

185.53.147.51:443

187.250.109.250:443

173.21.10.71:2222

108.4.67.252:443

93.175.84.127:443

84.117.135.69:443

87.64.241.207:995

207.246.112.221:995

188.50.34.167:995

73.25.109.183:2222

213.177.130.71:443

176.63.117.1:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Kfisajhbn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Biekdaacyteo = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
2600	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zvexkpwuxnidse\7e44c104 = 6ad8f9e9ad682f331aca11739de855f55ed6c40ebbb33cfa8a3ff6075389c17e8f3abd009cca6c5f0e4d342a9bff9432c56dd2ae7fbd3b4b3a7d3f4e590727f9e83725aa73ea66a225e14d59d50107afe4712049980bf6004bb75c65b64eed2beede771755b03e830c259ba40a5dd685a1e8db79b98021273a6496eae4904bcfcecf1a9f69e7589bd21871c35598e57fba7ff7dc9de99e9677588eade01e55f492daa2e5f53cae8e424264d586ac97011f6fd7fdfe3886f5a1ae	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zvexkpwuxnidse\10daef2 = 8eb0d05bae0e9c8ce60006e55480e243e5f6a66549b03624b0c099f4ac3cf7cc9bef94acf874831f96afd7e464c90563fedc0628e458e99ddb72775f2c73124a757f13	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zvexkpwuxnidse\34927ebc = 9077aa24958b8b024f9fd62dadf89b8f1f4cf5dacd4bf86efb082d5a97fb4c772b936e8aca0538f70475e6b0ee95546db0e2ff66f2794d892fc64c85cc7e1e3942ff67f10178808c965879e575928975b1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zvexkpwuxnidse\4bdb114a = 83a93ed9b0ec50605cc5fb01f1eedc32ccfabcbd98ff9f3a5cf88943fc1b6e2defda15ed2392baa5b4b06570e5c82dcf15e2d46d3fa4eaf002726ac8795df4ddf72eba195fae5f2ad10dcd2838485536e7e347d1c066a7ee6736c8bd1807	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zvexkpwuxnidse	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zvexkpwuxnidse\4bdb114a = 83a929d9b0ec652f34f1889a12a10231f08682758759eb2516838a3566295dd32150409c2ec7f97e96b99fbfdf8279ef38e615e67d04c37377c23bc56bb32956b9304d17d0232f7769	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zvexkpwuxnidse\7c05e178 = 31b08591139e9d97b1217a2d85a6336d8e81f96bd0232b3a8c660decf72c4e1aa88102f8e624464fa7f780296db8d06fd245c1723205cfe8473d07b93cfd2cb0e4ab616d99255cf83c2d8af500354ec82a3fb14a6a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zvexkpwuxnidse\c4b9861d = 85cc2f9c95441d6ffd167a266da9948fac08af5569651023bc36c84d40a15306b7bd93553f8b8fffa13256569ff93e9ea9c4acf5def8f0dfc6b9adb1f3c5a89c96557f87183a7797e2e807a2d5718d531d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zvexkpwuxnidse\b9b1c997 = dc743a3f6cd9e3ed041e6754b2cebbb497d01533280bca94660b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zvexkpwuxnidse\c6f8a661 = 362fe2f76b29f74c68bcefcb62c40d46a986cd2a059959d0dbbf91c19deb2a8239ebc5e1df6a79d2f41f7d4edac0e141d1268681dabf99ed088c80433950606264ae4ed7f8323c7e9bfe23def9329a6ecf8bae7b7988cd2a4787215236c652fa456bd193dea8440ae0	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2424	rundll32.exe
2600	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2424	rundll32.exe
2600	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2424	3012	rundll32.exe	29
PID 3012 wrote to memory of 2424	3012	rundll32.exe	29
PID 3012 wrote to memory of 2424	3012	rundll32.exe	29
PID 3012 wrote to memory of 2424	3012	rundll32.exe	29
PID 3012 wrote to memory of 2424	3012	rundll32.exe	29
PID 3012 wrote to memory of 2424	3012	rundll32.exe	29
PID 3012 wrote to memory of 2424	3012	rundll32.exe	29
PID 2424 wrote to memory of 2820	2424	rundll32.exe	30
PID 2424 wrote to memory of 2820	2424	rundll32.exe	30
PID 2424 wrote to memory of 2820	2424	rundll32.exe	30
PID 2424 wrote to memory of 2820	2424	rundll32.exe	30
PID 2424 wrote to memory of 2820	2424	rundll32.exe	30
PID 2424 wrote to memory of 2820	2424	rundll32.exe	30
PID 2820 wrote to memory of 2944	2820	explorer.exe	31
PID 2820 wrote to memory of 2944	2820	explorer.exe	31
PID 2820 wrote to memory of 2944	2820	explorer.exe	31
PID 2820 wrote to memory of 2944	2820	explorer.exe	31
PID 3060 wrote to memory of 2168	3060	taskeng.exe	34
PID 3060 wrote to memory of 2168	3060	taskeng.exe	34
PID 3060 wrote to memory of 2168	3060	taskeng.exe	34
PID 3060 wrote to memory of 2168	3060	taskeng.exe	34
PID 3060 wrote to memory of 2168	3060	taskeng.exe	34
PID 2168 wrote to memory of 2600	2168	regsvr32.exe	35
PID 2168 wrote to memory of 2600	2168	regsvr32.exe	35
PID 2168 wrote to memory of 2600	2168	regsvr32.exe	35
PID 2168 wrote to memory of 2600	2168	regsvr32.exe	35
PID 2168 wrote to memory of 2600	2168	regsvr32.exe	35
PID 2168 wrote to memory of 2600	2168	regsvr32.exe	35
PID 2168 wrote to memory of 2600	2168	regsvr32.exe	35
PID 2600 wrote to memory of 2816	2600	regsvr32.exe	36
PID 2600 wrote to memory of 2816	2600	regsvr32.exe	36
PID 2600 wrote to memory of 2816	2600	regsvr32.exe	36
PID 2600 wrote to memory of 2816	2600	regsvr32.exe	36
PID 2600 wrote to memory of 2816	2600	regsvr32.exe	36
PID 2600 wrote to memory of 2816	2600	regsvr32.exe	36
PID 2816 wrote to memory of 3044	2816	explorer.exe	37
PID 2816 wrote to memory of 3044	2816	explorer.exe	37
PID 2816 wrote to memory of 3044	2816	explorer.exe	37
PID 2816 wrote to memory of 3044	2816	explorer.exe	37
PID 2816 wrote to memory of 2400	2816	explorer.exe	39
PID 2816 wrote to memory of 2400	2816	explorer.exe	39
PID 2816 wrote to memory of 2400	2816	explorer.exe	39
PID 2816 wrote to memory of 2400	2816	explorer.exe	39

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76cf544349c4d0d62a70dadc232db5cc83b76b91ba2d83397397065d3493f421.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\76cf544349c4d0d62a70dadc232db5cc83b76b91ba2d83397397065d3493f421.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn noctgqn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\76cf544349c4d0d62a70dadc232db5cc83b76b91ba2d83397397065d3493f421.dll\"" /SC ONCE /Z /ST 07:56 /ET 08:08
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2944

C:\Windows\system32\taskeng.exe
taskeng.exe {D9C21B1B-5AFE-4F16-AA95-CF26A3AC0561} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\76cf544349c4d0d62a70dadc232db5cc83b76b91ba2d83397397065d3493f421.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\76cf544349c4d0d62a70dadc232db5cc83b76b91ba2d83397397065d3493f421.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2816
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Kfisajhbn" /d "0"
        5⤵
        Windows security bypass
        
        PID:3044
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Biekdaacyteo" /d "0"
        5⤵
        Windows security bypass
        
        PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\76cf544349c4d0d62a70dadc232db5cc83b76b91ba2d83397397065d3493f421.dll

Filesize
512KB

MD5
ac2cec3f240393f9015b7c6754bdef59

SHA1
36c5790aae838a0fc04f81da8c364bdb04208707

SHA256
76cf544349c4d0d62a70dadc232db5cc83b76b91ba2d83397397065d3493f421

SHA512
3447a336e0b2e8206e77d874abc9b0c2d01c5ea87172b25b707d90a9d1837b903a69deaf09879278156d03852b35a57613b248b84ff9700c9b53f49af091942a

Download Submit
memory/2424-4-0x0000000010000000-0x0000000010084000-memory.dmp

Filesize
528KB

Download
memory/2424-1-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/2424-0-0x00000000000F0000-0x0000000000123000-memory.dmp

Filesize
204KB

Download
memory/2424-6-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/2424-5-0x00000000000F0000-0x0000000000123000-memory.dmp

Filesize
204KB

Download
memory/2600-20-0x0000000010000000-0x0000000010084000-memory.dmp

Filesize
528KB

Download
memory/2816-22-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2816-23-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2816-24-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2820-9-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2820-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2820-10-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2820-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2820-2-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2820-3-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download