qakbot | 4bc6fbbd923c4bf3925f60d89d0bd25860152b9f19d2809f211b544fac9891e8

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bc6fbbd923c4bf3925f60d89d0bd25860152b9f19d2809f211b544fac9891e8.dll
Size

1.2MB
MD5

8b508dec08cf304b2978e7e90578a2e2
SHA1

259bf215667a337cca8619487d395cf0b8979bcd
SHA256

4bc6fbbd923c4bf3925f60d89d0bd25860152b9f19d2809f211b544fac9891e8
SHA512

247760ca95faf353dd4ae8bc239d5a063a09f3a80dc710c131e5af5268b2475dab88ac641cc337d79a4665adb51cc852ab3d520bef77ff0c886f22f0488a8824
SSDEEP

24576:m/o9iBRudBYZb/WqWletdadgndrqnq/wKkVWf:YRuEbeqWYMqnFY2IWf

Score

10^/10

qakbot tr 1634905513 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

Campaign

1634905513

27.5.5.31:2222

136.143.11.232:443

68.186.192.69:443

117.198.157.160:443

108.4.67.252:443

207.246.112.221:995

105.198.236.99:995

37.208.181.198:61200

115.99.227.13:995

140.82.49.12:443

188.50.34.167:995

216.201.162.158:443

103.142.10.177:443

197.89.21.241:443

73.25.109.183:2222

81.250.153.227:2222

2.222.167.138:443

78.191.24.189:995

87.242.20.233:2222

89.101.97.139:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Ihleaav = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Aynlwibjddht = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
2280	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Viwoqtqau\fcd300fd = 9ccfca65fa02c64b55d8369224f043f2a7009726090545fd39b4f6eabb1a53ad790b4ccfbc808677bb7d4b05e4b94aadb6a537abb20c7026a8e4391894f13969d58db3346bc04f8f075651	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Viwoqtqau\839a6f0b = d4415620f70b0a9839a22576bed6958bf37e82b802ffd571902cffd383b89fdb6e84005093fe1f12fa4a494df32707f68f576ae170966acf69e09de29b0f206486ade4c17e0d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Viwoqtqau\839a6f0b = d4414120f70b3f61a991d5b850c5f26772b861060905cd8f159151c0cbd161fc5bdb67ce11bc853d49004d9c634f918f80	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Viwoqtqau\b605bf45 = 5a62887c8450e79f30e4e3a118fa73093b586e5d4a4d5e2c202a67e4609865d0666d74e1bfa3484a6e25c704815a17f5976e754d96b0391a54f8b4fcfaa3c12a69b82078dd8b5cbabeba0e24495ea56f70ea3d0ed1b83d8fb10198fb39b26f5f010251834f638e422f93d3833c68f7013110fe7b811af12295e564a490e54150f503554d53d46bdfe6dea8441299e29d73ad957a75b75bed6fb2ba8cc8e708efd6806751549754ffdabc4f50a29154fb7c14e3d413c1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Viwoqtqau\b4449f39 = 3d4ee39882a7c433d73be2e32de0b9f6b87695de94f791a2a0d5799d43ca710d87e0e2b4fb8a2455df2fc9f6e243158934044caf3af305d698d9e91372ec5576a03217b6ea9281c143350b2e0b7d7a257cbf20ad98f77c70cfef3706e74607bc901bd499ded9cc57fc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Viwoqtqau\cf8f85c = ad6144053c416ea4f3c1cd7e7e859741e93b86c6ec0ded372335672fdd387a0d006912fb53f2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Viwoqtqau\eb9d820 = 474638f0cb0a15d386b7e351d0aa22042fb3f220b1e25f718d747d19fc61fa6ac9eb9707b7b78967a01330340cc96ef82f832c8d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Viwoqtqau	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Viwoqtqau\71f0b7d6 = 20ed910d36d42b4df3bb7d92ef020d35a64b932cabe265c4f0eb80019c6c30e32585a7ebb26c31d20e2f86a3ffd8b79658ed9ebf1fec170f319314067c99879ae241f291020139fa575e34bc4ed85cfd4d132b99f61827c25b3b336462cfc5e3d9b2bd9e8fc2bc38	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Viwoqtqau\c94cd0b3 = 916357978a66585072144d0cc6ab5eaeaeddaeb2f8f30b02b635c7baa3396e6705475bc0223eb11d558c74a8e315f7b5f9e402049b72fab4ac5ffff916a38b5cf979a36098b26c5b3aa5bc	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2780	rundll32.exe
2280	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2780	rundll32.exe
2280	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2780	2704	rundll32.exe	30
PID 2704 wrote to memory of 2780	2704	rundll32.exe	30
PID 2704 wrote to memory of 2780	2704	rundll32.exe	30
PID 2704 wrote to memory of 2780	2704	rundll32.exe	30
PID 2704 wrote to memory of 2780	2704	rundll32.exe	30
PID 2704 wrote to memory of 2780	2704	rundll32.exe	30
PID 2704 wrote to memory of 2780	2704	rundll32.exe	30
PID 2780 wrote to memory of 2836	2780	rundll32.exe	31
PID 2780 wrote to memory of 2836	2780	rundll32.exe	31
PID 2780 wrote to memory of 2836	2780	rundll32.exe	31
PID 2780 wrote to memory of 2836	2780	rundll32.exe	31
PID 2780 wrote to memory of 2836	2780	rundll32.exe	31
PID 2780 wrote to memory of 2836	2780	rundll32.exe	31
PID 2836 wrote to memory of 2608	2836	explorer.exe	32
PID 2836 wrote to memory of 2608	2836	explorer.exe	32
PID 2836 wrote to memory of 2608	2836	explorer.exe	32
PID 2836 wrote to memory of 2608	2836	explorer.exe	32
PID 1588 wrote to memory of 1636	1588	taskeng.exe	36
PID 1588 wrote to memory of 1636	1588	taskeng.exe	36
PID 1588 wrote to memory of 1636	1588	taskeng.exe	36
PID 1588 wrote to memory of 1636	1588	taskeng.exe	36
PID 1588 wrote to memory of 1636	1588	taskeng.exe	36
PID 1636 wrote to memory of 2280	1636	regsvr32.exe	37
PID 1636 wrote to memory of 2280	1636	regsvr32.exe	37
PID 1636 wrote to memory of 2280	1636	regsvr32.exe	37
PID 1636 wrote to memory of 2280	1636	regsvr32.exe	37
PID 1636 wrote to memory of 2280	1636	regsvr32.exe	37
PID 1636 wrote to memory of 2280	1636	regsvr32.exe	37
PID 1636 wrote to memory of 2280	1636	regsvr32.exe	37
PID 2280 wrote to memory of 484	2280	regsvr32.exe	38
PID 2280 wrote to memory of 484	2280	regsvr32.exe	38
PID 2280 wrote to memory of 484	2280	regsvr32.exe	38
PID 2280 wrote to memory of 484	2280	regsvr32.exe	38
PID 2280 wrote to memory of 484	2280	regsvr32.exe	38
PID 2280 wrote to memory of 484	2280	regsvr32.exe	38
PID 484 wrote to memory of 320	484	explorer.exe	39
PID 484 wrote to memory of 320	484	explorer.exe	39
PID 484 wrote to memory of 320	484	explorer.exe	39
PID 484 wrote to memory of 320	484	explorer.exe	39
PID 484 wrote to memory of 2192	484	explorer.exe	41
PID 484 wrote to memory of 2192	484	explorer.exe	41
PID 484 wrote to memory of 2192	484	explorer.exe	41
PID 484 wrote to memory of 2192	484	explorer.exe	41

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bc6fbbd923c4bf3925f60d89d0bd25860152b9f19d2809f211b544fac9891e8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bc6fbbd923c4bf3925f60d89d0bd25860152b9f19d2809f211b544fac9891e8.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hinmurcwas /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\4bc6fbbd923c4bf3925f60d89d0bd25860152b9f19d2809f211b544fac9891e8.dll\"" /SC ONCE /Z /ST 12:28 /ET 12:40
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2608

C:\Windows\system32\taskeng.exe
taskeng.exe {6E3D76BD-8BFC-46A5-9DF1-6033B8A99B94} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\4bc6fbbd923c4bf3925f60d89d0bd25860152b9f19d2809f211b544fac9891e8.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\4bc6fbbd923c4bf3925f60d89d0bd25860152b9f19d2809f211b544fac9891e8.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:484
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ihleaav" /d "0"
        5⤵
        Windows security bypass
        
        PID:320
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Aynlwibjddht" /d "0"
        5⤵
        Windows security bypass
        
        PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4bc6fbbd923c4bf3925f60d89d0bd25860152b9f19d2809f211b544fac9891e8.dll

Filesize
1.2MB

MD5
8b508dec08cf304b2978e7e90578a2e2

SHA1
259bf215667a337cca8619487d395cf0b8979bcd

SHA256
4bc6fbbd923c4bf3925f60d89d0bd25860152b9f19d2809f211b544fac9891e8

SHA512
247760ca95faf353dd4ae8bc239d5a063a09f3a80dc710c131e5af5268b2475dab88ac641cc337d79a4665adb51cc852ab3d520bef77ff0c886f22f0488a8824

Download Submit
memory/484-27-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/484-29-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/484-28-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2280-20-0x00000000739B0000-0x0000000073AE6000-memory.dmp

Filesize
1.2MB

Download
memory/2280-21-0x00000000739B0000-0x0000000073AE6000-memory.dmp

Filesize
1.2MB

Download
memory/2280-25-0x00000000739B0000-0x0000000073AE6000-memory.dmp

Filesize
1.2MB

Download
memory/2780-3-0x0000000074526000-0x000000007452C000-memory.dmp

Filesize
24KB

Download
memory/2780-8-0x0000000074400000-0x0000000074536000-memory.dmp

Filesize
1.2MB

Download
memory/2780-0-0x0000000074400000-0x0000000074536000-memory.dmp

Filesize
1.2MB

Download
memory/2780-4-0x0000000074400000-0x0000000074536000-memory.dmp

Filesize
1.2MB

Download
memory/2780-1-0x0000000074400000-0x0000000074536000-memory.dmp

Filesize
1.2MB

Download
memory/2836-7-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2836-15-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2836-12-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2836-13-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2836-14-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2836-11-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2836-5-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download