qakbot | 78bccdfce650d1b0c3023ed1cf7174625e88af831865a926c927a320c1177e10

General

Target

Original.dll
Size

1.2MB
MD5

b010fb1ea0c950e9b14a331b0da5aac8
SHA1

243989dc10c90b77ed107cbc066d8cc162fe7ab4
SHA256

641d48fdf79d0513748ed7044275f35ed5fa27177e5427a38d143d1c3272c40b
SHA512

6b8376162d9a7c88903280895e4efa133b3bb0a930021e52a591cab9e20c15097056a2b5a260ba9f678bf8409f1deabd687f85852dcf337e46606e4657ccf3f8
SSDEEP

24576:RzVwOlR/8qI8ixvTyj2AVpIP97+xgbZTekrX:RzVjR/zI8ixyjzS97+xgbZTfrX

Score

10^/10

qakbot biden53 1634717752 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden53

Campaign

1634717752

C2

103.142.10.177:443

24.152.219.253:995

181.118.183.94:443

129.208.147.188:995

24.119.214.7:443

38.70.253.226:2222

103.143.8.71:443

77.57.204.78:443

65.100.174.110:995

220.255.25.28:2222

91.178.126.51:995

37.210.155.239:995

81.241.252.59:2078

93.48.58.123:2222

65.100.174.110:443

76.25.142.196:443

24.231.209.2:2222

140.82.49.12:443

146.66.238.74:443

39.49.4.147:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Ovutezxr = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Useqirkn = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
1344	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vxkoaerk\4091c262 = bb9614c5df7450fe4c65f76265ebb386670a8d5168cef7764a0b6c2a6eee901c0782dd701234fde1c3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vxkoaerk\774f3250 = 60f132894f3d4df65b2a82847c629ed42109edf77a82dfeada213457573b61cf755dcf9c2bbc77a0bd11b3bddbe039b2d6a31b6a3150aa1bdf1e86b2381b156762a46f1fd5a08425d39d780a67c9fcd48d0f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vxkoaerk\b2fb1abf = 7d992654aa116900fb471bee3d06bdc35a09bb9061108eb95ff2800204aba1c0f3a2cd641cd81f0408e53beebc4e0a5ba5a16f0aacb2469bc408	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vxkoaerk\a477dda = 115c287456d264d48d46ff8543550d3d64a208499a65be8d3a35133ae598450c0ce0e76bf1f484f8340114efbdbc0a34c734ae4a6332366917860c114abcac007a21e427f479498a4778a8a21bb1d0474bea28a521dbd6cd1e591f00fd63d319459e0444144e1efff48e4ece39d0b784c4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vxkoaerk\cdb27549 = 7c2650882264241be30fce960451b19d2e20	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vxkoaerk	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vxkoaerk\750e122c = 5dc8d05dfb3dfcaa4f7ede56337780ab8a00be83f9ff91d25ae96d390882bd1f9a1423f765e4847c8058cea2d2bcd1abe40375bf12e5945752857b09cee9d169104e001c82f66fbd072c70e63eb8509d615e2c680e669b0cb593c8320983610654a431858c4d948a0e1e3c4cd6d39df5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vxkoaerk\cff35535 = d2c521dae6d13e957f3d9d1361c33417a177fb48774c42e3945975b5b6968a6437edcf1fc04362a7795c79a45eb027160fada318296aeb59498fd61b2af077476b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vxkoaerk\3fd8ad94 = 236dd493390dcc31e635de7c1ead6d9f382e6b24278a199df608aa2693f723075614ca5bb2baafa6002bfdb4213b11	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vxkoaerk\4091c262 = bb9603c5df7465a7853a1eefc4749a698711b36115d88ac2aef1e7694de65a7920338d4f2cfba5375e36315eeae833462b8437a5a50732f0a4be868384d0	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2364	rundll32.exe
2364	rundll32.exe
1344	regsvr32.exe
1344	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2364	rundll32.exe
1344	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 2364	5088	rundll32.exe	82
PID 5088 wrote to memory of 2364	5088	rundll32.exe	82
PID 5088 wrote to memory of 2364	5088	rundll32.exe	82
PID 2364 wrote to memory of 3580	2364	rundll32.exe	87
PID 2364 wrote to memory of 3580	2364	rundll32.exe	87
PID 2364 wrote to memory of 3580	2364	rundll32.exe	87
PID 2364 wrote to memory of 3580	2364	rundll32.exe	87
PID 2364 wrote to memory of 3580	2364	rundll32.exe	87
PID 3580 wrote to memory of 820	3580	explorer.exe	88
PID 3580 wrote to memory of 820	3580	explorer.exe	88
PID 3580 wrote to memory of 820	3580	explorer.exe	88
PID 1512 wrote to memory of 1344	1512	regsvr32.exe	96
PID 1512 wrote to memory of 1344	1512	regsvr32.exe	96
PID 1512 wrote to memory of 1344	1512	regsvr32.exe	96
PID 1344 wrote to memory of 3936	1344	regsvr32.exe	97
PID 1344 wrote to memory of 3936	1344	regsvr32.exe	97
PID 1344 wrote to memory of 3936	1344	regsvr32.exe	97
PID 1344 wrote to memory of 3936	1344	regsvr32.exe	97
PID 1344 wrote to memory of 3936	1344	regsvr32.exe	97
PID 3936 wrote to memory of 2528	3936	explorer.exe	98
PID 3936 wrote to memory of 2528	3936	explorer.exe	98
PID 3936 wrote to memory of 3624	3936	explorer.exe	100
PID 3936 wrote to memory of 3624	3936	explorer.exe	100

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Original.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Original.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xuzthqghq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\Original.dll\"" /SC ONCE /Z /ST 14:40 /ET 14:52
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:820

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\Original.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\Original.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Useqirkn" /d "0"
      4⤵
      Windows security bypass
      PID:2528
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ovutezxr" /d "0"
      4⤵
      Windows security bypass
      PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Original.dll

Filesize
1.2MB

MD5
b010fb1ea0c950e9b14a331b0da5aac8

SHA1
243989dc10c90b77ed107cbc066d8cc162fe7ab4

SHA256
641d48fdf79d0513748ed7044275f35ed5fa27177e5427a38d143d1c3272c40b

SHA512
6b8376162d9a7c88903280895e4efa133b3bb0a930021e52a591cab9e20c15097056a2b5a260ba9f678bf8409f1deabd687f85852dcf337e46606e4657ccf3f8

Download Submit
memory/1344-20-0x0000000073E90000-0x0000000073FCE000-memory.dmp

Filesize
1.2MB

Download
memory/1344-18-0x0000000073E90000-0x0000000073FCE000-memory.dmp

Filesize
1.2MB

Download
memory/1344-17-0x0000000073E90000-0x0000000073FCE000-memory.dmp

Filesize
1.2MB

Download
memory/2364-1-0x00000000756ED000-0x00000000756F3000-memory.dmp

Filesize
24KB

Download
memory/2364-2-0x00000000755C0000-0x00000000756FE000-memory.dmp

Filesize
1.2MB

Download
memory/2364-3-0x00000000755C0000-0x00000000756FE000-memory.dmp

Filesize
1.2MB

Download
memory/2364-0-0x00000000755C0000-0x00000000756FE000-memory.dmp

Filesize
1.2MB

Download
memory/2364-6-0x00000000755C0000-0x00000000756FE000-memory.dmp

Filesize
1.2MB

Download
memory/3580-5-0x0000000000900000-0x0000000000921000-memory.dmp

Filesize
132KB

Download
memory/3580-13-0x0000000000900000-0x0000000000921000-memory.dmp

Filesize
132KB

Download
memory/3580-10-0x0000000000900000-0x0000000000921000-memory.dmp

Filesize
132KB

Download
memory/3580-11-0x0000000000900000-0x0000000000921000-memory.dmp

Filesize
132KB

Download
memory/3580-9-0x0000000000900000-0x0000000000921000-memory.dmp

Filesize
132KB

Download
memory/3936-22-0x0000000000C30000-0x0000000000C51000-memory.dmp

Filesize
132KB

Download
memory/3936-24-0x0000000000C30000-0x0000000000C51000-memory.dmp

Filesize
132KB

Download
memory/3936-23-0x0000000000C30000-0x0000000000C51000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads