qakbot | 68806e100eb54e0f0a02fc1e97f205eb72b768f2b8b238433b169749c3dec688

General

Target

Xertis.dll
Size

539KB
MD5

a77ee18833f79b86262d4f4876a252a9
SHA1

efcb36e4b40493ccc361541495d3084b4275f30b
SHA256

68806e100eb54e0f0a02fc1e97f205eb72b768f2b8b238433b169749c3dec688
SHA512

89aca20e7cf76b2292e144b3c66a23c52d30701baa3a0e57f1b6338c9e0ef0376eac6902ed1f0c6b01c27afb60ce2ceabf8bbf4d855389c2626c50544b06a08f

Score

10^/10

qakbot obama102 1632302707 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.318

Botnet

obama102

Campaign

1632302707

C2

120.150.218.241:995

47.22.148.6:443

105.198.236.99:443

95.77.223.148:443

140.82.49.12:443

27.223.92.142:995

73.151.236.31:443

136.232.34.70:443

144.139.47.206:443

45.46.53.140:2222

76.25.142.196:443

173.21.10.71:2222

75.188.35.168:443

71.74.12.34:443

96.37.113.36:993

67.165.206.193:993

189.210.115.207:443

72.252.201.69:443

24.139.72.117:443

24.229.150.54:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4688 regsvr32.exe

pid	process
4688	regsvr32.exe

Drops file in System32 directory 4 IoCs

Processes:

OfficeC2RClient.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	OfficeC2RClient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db	OfficeC2RClient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-wal	OfficeC2RClient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-shm	OfficeC2RClient.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2520 4688 WerFault.exe regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4736 schtasks.exe

pid	pid_target	process	target process
2520	4688	WerFault.exe	regsvr32.exe

pid	process
4736	schtasks.exe

Modifies data under HKEY_USERS 23 IoCs

Processes:

OfficeC2RClient.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeC2RClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeC2RClient.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,17110988,7153487,39965824,17962391,17962392,3702920,3462423,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeC2RClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeC2RClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeC2RClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeC2RClient.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,941 10,1329 15,941 15,941 6,1329 100,1329 6"	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile	OfficeC2RClient.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
3252	rundll32.exe
3252	rundll32.exe
2520	WerFault.exe
2520	WerFault.exe
2520	WerFault.exe
2520	WerFault.exe
2520	WerFault.exe
2520	WerFault.exe
2520	WerFault.exe
2520	WerFault.exe
2520	WerFault.exe
2520	WerFault.exe
2520	WerFault.exe
2520	WerFault.exe
2520	WerFault.exe
2520	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

3252 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2520 WerFault.exe
Token: SeBackupPrivilege 2520 WerFault.exe
Token: SeDebugPrivilege 2520 WerFault.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OfficeC2RClient.exe

pid process

4472 OfficeC2RClient.exe

description	pid	process
Token: SeRestorePrivilege	2520	WerFault.exe
Token: SeBackupPrivilege	2520	WerFault.exe
Token: SeDebugPrivilege	2520	WerFault.exe

pid	process
4472	OfficeC2RClient.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 3176 wrote to memory of 3252	3176	rundll32.exe	rundll32.exe
PID 3176 wrote to memory of 3252	3176	rundll32.exe	rundll32.exe
PID 3176 wrote to memory of 3252	3176	rundll32.exe	rundll32.exe
PID 3252 wrote to memory of 4680	3252	rundll32.exe	explorer.exe
PID 3252 wrote to memory of 4680	3252	rundll32.exe	explorer.exe
PID 3252 wrote to memory of 4680	3252	rundll32.exe	explorer.exe
PID 3252 wrote to memory of 4680	3252	rundll32.exe	explorer.exe
PID 3252 wrote to memory of 4680	3252	rundll32.exe	explorer.exe
PID 4680 wrote to memory of 4736	4680	explorer.exe	schtasks.exe
PID 4680 wrote to memory of 4736	4680	explorer.exe	schtasks.exe
PID 4680 wrote to memory of 4736	4680	explorer.exe	schtasks.exe
PID 4824 wrote to memory of 4688	4824	regsvr32.exe	regsvr32.exe
PID 4824 wrote to memory of 4688	4824	regsvr32.exe	regsvr32.exe
PID 4824 wrote to memory of 4688	4824	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xertis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3176

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xertis.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3252

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4680

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mzjrwxq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\Xertis.dll\"" /SC ONCE /Z /ST 01:31 /ET 01:43
4⤵
- Creates scheduled task(s)
PID:4736

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4472

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\Xertis.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4824

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\Xertis.dll"
2⤵
- Loads dropped DLL
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 596
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Xertis.dll
MD5
330836bfebbda01fa2b803b36f64728f

SHA1
3339bab3a65d87bd87780a41d961b99ddb66109a

SHA256
57ce07547d79c7833e3e999e55859d2e5b4842715a3d113bfe7c93ab833ccd57

SHA512
f520447bf913f8665d4c9192434edfd2048fa71897b3417b9b461c28ec4ff8103d9c38eecea075035cb80e7cf09c0272295e2992f353925d97fd019ea312d649

Download Submit
\Users\Admin\AppData\Local\Temp\Xertis.dll
MD5
330836bfebbda01fa2b803b36f64728f

SHA1
3339bab3a65d87bd87780a41d961b99ddb66109a

SHA256
57ce07547d79c7833e3e999e55859d2e5b4842715a3d113bfe7c93ab833ccd57

SHA512
f520447bf913f8665d4c9192434edfd2048fa71897b3417b9b461c28ec4ff8103d9c38eecea075035cb80e7cf09c0272295e2992f353925d97fd019ea312d649

Download Submit
memory/3252-115-0x0000000000000000-mapping.dmp

Download
memory/3252-116-0x0000000073720000-0x0000000073741000-memory.dmp

Filesize
132KB

Download
memory/3252-117-0x0000000073720000-0x00000000737C1000-memory.dmp

Filesize
644KB

Download
memory/3252-118-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/4680-119-0x0000000000000000-mapping.dmp

Download
memory/4680-123-0x0000000003200000-0x0000000003221000-memory.dmp

Filesize
132KB

Download
memory/4688-125-0x0000000000000000-mapping.dmp

Download
memory/4736-120-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads