qakbot | 31a90ad6dbe61a0a90ee10802efa1a6ea8cc5edbeb3b74e79f7d07293cd56898

General

Target

Qakbot_2.red.dll
Size

378KB
MD5

7df93445d7752cd944b727d3824ebb55
SHA1

119352f971e74f397d5f78301b144c22be8f944f
SHA256

31a90ad6dbe61a0a90ee10802efa1a6ea8cc5edbeb3b74e79f7d07293cd56898
SHA512

daab59fbf601e2ca1bc75259adb0ea39cc32cc767479e09f33c0f37a1d46d6cc4049f5f2a13af0fe8eeb28c429fa4bffde215b6a07dbcec2d216593084353da8

Score

10^/10

qakbot obama104 1632729661 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

obama104

Campaign

1632729661

C2

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1680 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1824 schtasks.exe

pid	process
1680	regsvr32.exe

pid	process
1824	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gdenostoslv\e1b2825d = 825a59cc5156a173ca1fd99e33ab849ecae7392c61fc36b26a0c167e9eef4a9bcccb4286	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gdenostoslv\d66c726f = 35d6a640e330f8889d5ed9d5480a637d839699d242fb8bd2fa7d805a78141ed9873486ef9078def55c71	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gdenostoslv\e3f3a221 = 806e45b8fa5e66ce4895f3ab1802d3c3353fa1971b0acaf6826226452c1bef0e28dd668fe0fbeaccd61e430be7d0ec9564a1eda8429ae9a71374cfce6a16653a7dfba0264e1e1880c5d868465cfd6908ba8a009e3430a47beff25df6a221b3fcbe7cc850f0b112c54dc21304395761d11cde203f09000377adcdf31578a099724d2b4da4504227ead6750797e159d037e8952fb52ee85635088db8a5deabceab30f364ac2b5ae61ebd2046f19bf092725e422b29ccbea743e6fb2711	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gdenostoslv\590ee538 = 764821af93b81cd34c93831ff7b6f8d1b5d99121b15a257a6b766b6beaaf5541ac513a9a58f46ab27c96178d14f1ca75fbf571a1c7bd5ca998080cd0cc4ecb107d9a8aab9d188f3474901670cf0b0d920a0dccf83b5cff9c24725b53431cc6993c0beda0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gdenostoslv\2406aab2 = 1a1c884f260f010f0a811f81eb68d1940a660a1f7c744cc8096bfa0a7a38260719e3d820930ff35b6403e5cdd106	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gdenostoslv\9cbacdd7 = e3d9a616260082920062cce877974a8160189987bcd39e287fe18223e16c59d8a642f544b8bde827b6beb89efefb5f213cbf6b4f8aa2c05cbe27f42ef2baf47ccef5dbb494ea91403409f8cbad0a26725e635672e90635fadb6b8576b1ac96a2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gdenostoslv\5b4fc544 = 27c8e660e1c41b8e9f1a10a1b6b52ac5d18682af5a25bd05	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gdenostoslv\a9251d99 = ef29ed23342e999ddc9c12b6eedd1cdd23164f407338ff06f6db31eb9a97a51e502c22b87ad438cca7ddd78b6141b7d4893008a00ed8	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gdenostoslv	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gdenostoslv\d66c726f = 35d6b140e330cd03488213a5b651a8a04935ab3bfc	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1984 rundll32.exe
1680 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1984 rundll32.exe
1680 regsvr32.exe

pid	process
1984	rundll32.exe
1680	regsvr32.exe

pid	process
1984	rundll32.exe
1680	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 836 wrote to memory of 1984	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 1984	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 1984	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 1984	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 1984	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 1984	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 1984	836	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 1732	1984	rundll32.exe	explorer.exe
PID 1984 wrote to memory of 1732	1984	rundll32.exe	explorer.exe
PID 1984 wrote to memory of 1732	1984	rundll32.exe	explorer.exe
PID 1984 wrote to memory of 1732	1984	rundll32.exe	explorer.exe
PID 1984 wrote to memory of 1732	1984	rundll32.exe	explorer.exe
PID 1984 wrote to memory of 1732	1984	rundll32.exe	explorer.exe
PID 1732 wrote to memory of 1824	1732	explorer.exe	schtasks.exe
PID 1732 wrote to memory of 1824	1732	explorer.exe	schtasks.exe
PID 1732 wrote to memory of 1824	1732	explorer.exe	schtasks.exe
PID 1732 wrote to memory of 1824	1732	explorer.exe	schtasks.exe
PID 1320 wrote to memory of 1488	1320	taskeng.exe	regsvr32.exe
PID 1320 wrote to memory of 1488	1320	taskeng.exe	regsvr32.exe
PID 1320 wrote to memory of 1488	1320	taskeng.exe	regsvr32.exe
PID 1320 wrote to memory of 1488	1320	taskeng.exe	regsvr32.exe
PID 1320 wrote to memory of 1488	1320	taskeng.exe	regsvr32.exe
PID 1488 wrote to memory of 1680	1488	regsvr32.exe	regsvr32.exe
PID 1488 wrote to memory of 1680	1488	regsvr32.exe	regsvr32.exe
PID 1488 wrote to memory of 1680	1488	regsvr32.exe	regsvr32.exe
PID 1488 wrote to memory of 1680	1488	regsvr32.exe	regsvr32.exe
PID 1488 wrote to memory of 1680	1488	regsvr32.exe	regsvr32.exe
PID 1488 wrote to memory of 1680	1488	regsvr32.exe	regsvr32.exe
PID 1488 wrote to memory of 1680	1488	regsvr32.exe	regsvr32.exe
PID 1680 wrote to memory of 1640	1680	regsvr32.exe	explorer.exe
PID 1680 wrote to memory of 1640	1680	regsvr32.exe	explorer.exe
PID 1680 wrote to memory of 1640	1680	regsvr32.exe	explorer.exe
PID 1680 wrote to memory of 1640	1680	regsvr32.exe	explorer.exe
PID 1680 wrote to memory of 1640	1680	regsvr32.exe	explorer.exe
PID 1680 wrote to memory of 1640	1680	regsvr32.exe	explorer.exe
PID 1640 wrote to memory of 1828	1640	explorer.exe	reg.exe
PID 1640 wrote to memory of 1828	1640	explorer.exe	reg.exe
PID 1640 wrote to memory of 1828	1640	explorer.exe	reg.exe
PID 1640 wrote to memory of 1828	1640	explorer.exe	reg.exe
PID 1640 wrote to memory of 400	1640	explorer.exe	reg.exe
PID 1640 wrote to memory of 400	1640	explorer.exe	reg.exe
PID 1640 wrote to memory of 400	1640	explorer.exe	reg.exe
PID 1640 wrote to memory of 400	1640	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot_2.red.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot_2.red.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn uarggrzf /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\Qakbot_2.red.dll\"" /SC ONCE /Z /ST 21:23 /ET 21:35
4⤵
- Creates scheduled task(s)
PID:1824

C:\Windows\system32\taskeng.exe
taskeng.exe {305C8197-D286-4174-B407-52CC9A04C47B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1320

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\Qakbot_2.red.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\Qakbot_2.red.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Rnzimgteuz" /d "0"
5⤵
PID:1828

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Cfutcuyb" /d "0"
5⤵
PID:400

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Qakbot_2.red.dll
MD5
7df93445d7752cd944b727d3824ebb55

SHA1
119352f971e74f397d5f78301b144c22be8f944f

SHA256
31a90ad6dbe61a0a90ee10802efa1a6ea8cc5edbeb3b74e79f7d07293cd56898

SHA512
daab59fbf601e2ca1bc75259adb0ea39cc32cc767479e09f33c0f37a1d46d6cc4049f5f2a13af0fe8eeb28c429fa4bffde215b6a07dbcec2d216593084353da8

Download Submit
\Users\Admin\AppData\Local\Temp\Qakbot_2.red.dll
MD5
7df93445d7752cd944b727d3824ebb55

SHA1
119352f971e74f397d5f78301b144c22be8f944f

SHA256
31a90ad6dbe61a0a90ee10802efa1a6ea8cc5edbeb3b74e79f7d07293cd56898

SHA512
daab59fbf601e2ca1bc75259adb0ea39cc32cc767479e09f33c0f37a1d46d6cc4049f5f2a13af0fe8eeb28c429fa4bffde215b6a07dbcec2d216593084353da8

Download Submit
memory/400-81-0x0000000000000000-mapping.dmp

Download
memory/1488-69-0x0000000000000000-mapping.dmp

Download
memory/1488-70-0x000007FEFBC41000-0x000007FEFBC43000-memory.dmp

Filesize
8KB

Download
memory/1640-82-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1640-77-0x0000000000000000-mapping.dmp

Download
memory/1680-72-0x0000000000000000-mapping.dmp

Download
memory/1680-75-0x00000000001B0000-0x00000000001F2000-memory.dmp

Filesize
264KB

Download
memory/1680-76-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/1732-68-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1732-64-0x0000000000000000-mapping.dmp

Download
memory/1732-66-0x0000000074801000-0x0000000074803000-memory.dmp

Filesize
8KB

Download
memory/1824-67-0x0000000000000000-mapping.dmp

Download
memory/1828-80-0x0000000000000000-mapping.dmp

Download
memory/1984-63-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/1984-62-0x0000000000840000-0x0000000000882000-memory.dmp

Filesize
264KB

Download
memory/1984-60-0x0000000000000000-mapping.dmp

Download
memory/1984-61-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads