qakbot | 45e5bddd31db89802853edbb213d2b1bbd9837fc0a2c2fafc44293633726566b

General

Target
473f4322945d1142612e6059cf7f0cc5.dll
Size 484KB
Sample210925-qhtlwsdbaj
SHA256 45e5bddd31db89802853edbb213d2b1bbd9837fc0a2c2fafc44293633726566b
MD5 473f4322945d1142612e6059cf7f0cc5
SHA1 7266f1e9f82c5189a1963be5a4915f7da8b434f0
SHA512 264ac92e7cd0982d3dc67638a8077b906ccc05607929a5f8865dde88e4c746282b7b8c65e82d710e08d4c70f234f2d1dcafc832b80cbd4eeca8992fc730bcde8
MD5 SHA1 SHA512

Score

10^/10

qakbot obama103 1632477754 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

obama103

Campaign

1632477754

C2

136.232.34.70:443
216.201.162.158:443
92.59.35.196:2222
105.198.236.99:443
185.250.148.74:443
73.77.87.137:443
196.218.227.241:995
103.148.120.144:443
120.150.218.241:995
47.22.148.6:443
140.82.49.12:443
71.74.12.34:443
27.223.92.142:995
76.25.142.196:443
95.77.223.148:443
75.188.35.168:443
96.37.113.36:993
173.21.10.71:2222
45.46.53.140:2222
73.151.236.31:443
181.163.96.53:443
189.210.115.207:443
72.252.201.69:443
89.101.97.139:443
109.12.111.14:443
24.55.112.61:443
24.139.72.117:443
24.229.150.54:995
67.165.206.193:993
75.107.26.196:465
68.204.7.158:443
185.250.148.74:2222
68.186.192.69:443
24.152.219.253:995
50.29.166.232:995
75.67.192.125:443
24.95.61.62:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
908	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2584	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iuenkvf\b90473c7 = 56288c065222158294d2a6a823e0e2b479997837e6aec2f7957ee889e0e4f789552de64f5068ed4583f9d275600b09aae1bf82132b0cc049872c00e9c4dc4c64f7598d7b2379245ea6700381c0a7e7ea9267ede643b6bf42d11475b6e55121981f630bba7663aa468da10b84dd71b8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iuenkvf\3427c4ec = 590b6de601c2cd25b499bcc7f447723c13e59ea4d572a5d80ca8bd5068382d4dea5aa7e3494fe16b9adaf1a68662b4e04df90367d39cd4726e5622	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iuenkvf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iuenkvf\3427c4ec = 590b7ae601c2f83d02a25d4211a94c1e7a148fdd5d2ef5e2f24ea445156204b8ac4cf9cc70c7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iuenkvf\1b814a2 = c1ddb64084e926cf84c4f191d0ffbea2be95f6c6a8849fb30c44f94d39a270d7832e9ca036b298436bc8b8d788b3605ae973f848c05e04a111979344542a4d3acb5a66cf52ea62623da91deb93eb87cb6fe042ecc2b4c52006259f132d66172a6cd8f8e8770bcd5cdcbe119b8f21bf7f2391a4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iuenkvf\bb4553bb = 518aa5f951c8708f4705d9e950187e77eb7b6a18d578bd031b4c6c3128c5098905823f31cb7f9caacd2fc310df86f8384ad71476597e8b19075cb5ea9136d7e526819609fa4177d0ae263e3ed6167a54467ffaa65fd16b27baee1c69e02150bb97a04c520bec1a5c0a3f9bf4e07a973e2f1563	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iuenkvf\c64d1c31 = 82f79d962e7bf996e5d22c8b908c95e5257936f9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iuenkvf\7ef17b54 = 73f2ceb9718974d2249ef19fe14f058c341726ee75e04f08dcafabfb795c6bcb311143	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iuenkvf\3f934de = c81662ad3ff70b10c4471f32c9d8c512ff4f745f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iuenkvf\4b6eab1a = 59c1dbfeb4650ef449703280554379d2e1d980bdc8a0ca6847b362eb9ac5aec517043658e2e8	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2028	rundll32.exe
2028	rundll32.exe
908	regsvr32.exe
908	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2028	rundll32.exe
908	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2028	1952	rundll32.exe	69
PID 1952 wrote to memory of 2028	1952	rundll32.exe	69
PID 1952 wrote to memory of 2028	1952	rundll32.exe	69
PID 2028 wrote to memory of 2336	2028	rundll32.exe	70
PID 2028 wrote to memory of 2336	2028	rundll32.exe	70
PID 2028 wrote to memory of 2336	2028	rundll32.exe	70
PID 2028 wrote to memory of 2336	2028	rundll32.exe	70
PID 2028 wrote to memory of 2336	2028	rundll32.exe	70
PID 2336 wrote to memory of 2584	2336	explorer.exe	71
PID 2336 wrote to memory of 2584	2336	explorer.exe	71
PID 2336 wrote to memory of 2584	2336	explorer.exe	71
PID 4068 wrote to memory of 908	4068	regsvr32.exe	79
PID 4068 wrote to memory of 908	4068	regsvr32.exe	79
PID 4068 wrote to memory of 908	4068	regsvr32.exe	79
PID 908 wrote to memory of 1932	908	regsvr32.exe	80
PID 908 wrote to memory of 1932	908	regsvr32.exe	80
PID 908 wrote to memory of 1932	908	regsvr32.exe	80
PID 908 wrote to memory of 1932	908	regsvr32.exe	80
PID 908 wrote to memory of 1932	908	regsvr32.exe	80
PID 1932 wrote to memory of 3020	1932	explorer.exe	81
PID 1932 wrote to memory of 3020	1932	explorer.exe	81
PID 1932 wrote to memory of 528	1932	explorer.exe	83
PID 1932 wrote to memory of 528	1932	explorer.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\473f4322945d1142612e6059cf7f0cc5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\473f4322945d1142612e6059cf7f0cc5.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn janbfyb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\473f4322945d1142612e6059cf7f0cc5.dll\"" /SC ONCE /Z /ST 13:18 /ET 13:30
      4⤵
      Creates scheduled task(s)
      PID:2584

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\473f4322945d1142612e6059cf7f0cc5.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\473f4322945d1142612e6059cf7f0cc5.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Garkkyyuzet" /d "0"
      4⤵
      PID:3020
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Fgiqfzi" /d "0"
      4⤵
      PID:528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/908-129-0x00000000032E0000-0x00000000032E1000-memory.dmp

Download

memory/908-128-0x0000000010000000-0x0000000010119000-memory.dmp

Download

memory/1932-135-0x0000000000AD0000-0x0000000000AF1000-memory.dmp

Download

memory/2028-118-0x0000000000280000-0x0000000000281000-memory.dmp

Download

memory/2028-117-0x0000000010000000-0x0000000010119000-memory.dmp

Download

memory/2028-116-0x0000000010000000-0x0000000010021000-memory.dmp

Download

memory/2336-123-0x0000000000970000-0x0000000000991000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads