qakbot | b5bac95d38c0b9a246cf01fd76276870c42bdb38e2c5bab7d47ae04f1c52e969

General

Target

b9c2828409584dcb2d0a968f1968e00f.dll
Size

378KB
MD5

b9c2828409584dcb2d0a968f1968e00f
SHA1

28f7cdd53a24dd293f4d8233844fe4b609681a82
SHA256

b5bac95d38c0b9a246cf01fd76276870c42bdb38e2c5bab7d47ae04f1c52e969
SHA512

a7811c0a63822cbdc337d51c55db40ec8668640e21c1b91732fdacf4336d1903087a6e2a7477e676bf7c71b0ad1476dfc276b124ed1f38099e67755e082ff69c

Score

10^/10

qakbot obama104 1632729661 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

obama104

Campaign

1632729661

C2

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1304 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1512 schtasks.exe

pid	process
1304	regsvr32.exe

pid	process
1512	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pphxvqffthjsd\b5efae56 = a3b71ba28244e62293cc4aea8145134ac7155a864847c4db2f195307a8d914998996a1b0d96842ba30a094ab5c6a7a354b27368ff63253c5d077b954bce5ab4c8ccca923dba8de60beb79511d269ba9c3a5418b6aea71d3cfca9c20832e3bdbae1ad69b1160e0bf426c16c8f4518c82611990cdb8c06e0f1c16d43615d08cb7c1b48d6c434c36e50473654ed230d57601857f94c42f735b480924c55ed0d5a46df8eb5a591b82b0503c4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pphxvqffthjsd\721aa6c5 = 73f7754d65486923d150f23f14e687cd3a6b2f2b7f553eef8c346dc9d5f1e93fb122899a9624833fec98	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pphxvqffthjsd\caa6c1a0 = 39133d3df7a98b5eea786255063551925dc03c55fc2b9ed0d4991e8b6ec001a4ffb9aca30ab49560b12911a555b46095a9797831ed9f34ef0d572bb757bdf406a2c6d7ec3d65af65fec32cdc0ab7a9be0267fe62cc76dbe39c175bdcfe323dcb78d264317b2ef1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pphxvqffthjsd\d53c933 = d98556f35a28960b8d887affe17c587e7d1f007d9e89755a7ba9542dddc71046014da8c92a170914b8766c60e023ea46f053c6909f8bf53c342d75f92be8349c308d1edd35e64d000e48282fcf82b5c01bcf	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pphxvqffthjsd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pphxvqffthjsd\80707e18 = 5f14253edfffb9e41e13c2966f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pphxvqffthjsd\b7ae8e2a = edb80a0a5795988d45a2b1bb073e92be9e8003abfadcd9ed55148493aa390f4f0edc759b081e048c0d05f0c47faac25f31c5422a2f277df704d56fea	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pphxvqffthjsd\f12e94f = c3a012edf1bde39b2fa602bd39087ae3d590343a4a8252e2b1e15ea1f004e7e2c0147107642835afdfc49b916aadfe940c2998e74a7bbd7326e55153ceabf3751c86c52613b9115dc32a88331edd885e45bfd3f8ed9e9cf43eee6eed6f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pphxvqffthjsd\ff3911ee = 3acb50bc8e48e3883bc36f02434e46de39e11ca83a3281eb0397b4aee4799afd61410c8afeea589d96adaa248e8f0bcadf337dc94620bc3ebd21cadc7511224600ed	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pphxvqffthjsd\80707e18 = 5f14323edfff8c934c6e44841efad3bc11efcac089857f031f3c2eb6badc7e2fae23	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2044 rundll32.exe
1304 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2044 rundll32.exe
1304 regsvr32.exe

pid	process
2044	rundll32.exe
1304	regsvr32.exe

pid	process
2044	rundll32.exe
1304	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1044 wrote to memory of 2044	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2044	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2044	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2044	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2044	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2044	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2044	1044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1668	2044	rundll32.exe	explorer.exe
PID 2044 wrote to memory of 1668	2044	rundll32.exe	explorer.exe
PID 2044 wrote to memory of 1668	2044	rundll32.exe	explorer.exe
PID 2044 wrote to memory of 1668	2044	rundll32.exe	explorer.exe
PID 2044 wrote to memory of 1668	2044	rundll32.exe	explorer.exe
PID 2044 wrote to memory of 1668	2044	rundll32.exe	explorer.exe
PID 1668 wrote to memory of 1512	1668	explorer.exe	schtasks.exe
PID 1668 wrote to memory of 1512	1668	explorer.exe	schtasks.exe
PID 1668 wrote to memory of 1512	1668	explorer.exe	schtasks.exe
PID 1668 wrote to memory of 1512	1668	explorer.exe	schtasks.exe
PID 532 wrote to memory of 780	532	taskeng.exe	regsvr32.exe
PID 532 wrote to memory of 780	532	taskeng.exe	regsvr32.exe
PID 532 wrote to memory of 780	532	taskeng.exe	regsvr32.exe
PID 532 wrote to memory of 780	532	taskeng.exe	regsvr32.exe
PID 532 wrote to memory of 780	532	taskeng.exe	regsvr32.exe
PID 780 wrote to memory of 1304	780	regsvr32.exe	regsvr32.exe
PID 780 wrote to memory of 1304	780	regsvr32.exe	regsvr32.exe
PID 780 wrote to memory of 1304	780	regsvr32.exe	regsvr32.exe
PID 780 wrote to memory of 1304	780	regsvr32.exe	regsvr32.exe
PID 780 wrote to memory of 1304	780	regsvr32.exe	regsvr32.exe
PID 780 wrote to memory of 1304	780	regsvr32.exe	regsvr32.exe
PID 780 wrote to memory of 1304	780	regsvr32.exe	regsvr32.exe
PID 1304 wrote to memory of 1096	1304	regsvr32.exe	explorer.exe
PID 1304 wrote to memory of 1096	1304	regsvr32.exe	explorer.exe
PID 1304 wrote to memory of 1096	1304	regsvr32.exe	explorer.exe
PID 1304 wrote to memory of 1096	1304	regsvr32.exe	explorer.exe
PID 1304 wrote to memory of 1096	1304	regsvr32.exe	explorer.exe
PID 1304 wrote to memory of 1096	1304	regsvr32.exe	explorer.exe
PID 1096 wrote to memory of 1064	1096	explorer.exe	reg.exe
PID 1096 wrote to memory of 1064	1096	explorer.exe	reg.exe
PID 1096 wrote to memory of 1064	1096	explorer.exe	reg.exe
PID 1096 wrote to memory of 1064	1096	explorer.exe	reg.exe
PID 1096 wrote to memory of 1844	1096	explorer.exe	reg.exe
PID 1096 wrote to memory of 1844	1096	explorer.exe	reg.exe
PID 1096 wrote to memory of 1844	1096	explorer.exe	reg.exe
PID 1096 wrote to memory of 1844	1096	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9c2828409584dcb2d0a968f1968e00f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9c2828409584dcb2d0a968f1968e00f.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xjipdzcl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\b9c2828409584dcb2d0a968f1968e00f.dll\"" /SC ONCE /Z /ST 19:13 /ET 19:25
4⤵
- Creates scheduled task(s)
PID:1512

C:\Windows\system32\taskeng.exe
taskeng.exe {D31DD0AA-199D-4F08-A0F2-66CA51D0ED38} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:532

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\b9c2828409584dcb2d0a968f1968e00f.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:780

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\b9c2828409584dcb2d0a968f1968e00f.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Aaxrlwjpuyl" /d "0"
5⤵
PID:1064

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Cuicayyezlxw" /d "0"
5⤵
PID:1844

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b9c2828409584dcb2d0a968f1968e00f.dll
MD5
b9c2828409584dcb2d0a968f1968e00f

SHA1
28f7cdd53a24dd293f4d8233844fe4b609681a82

SHA256
b5bac95d38c0b9a246cf01fd76276870c42bdb38e2c5bab7d47ae04f1c52e969

SHA512
a7811c0a63822cbdc337d51c55db40ec8668640e21c1b91732fdacf4336d1903087a6e2a7477e676bf7c71b0ad1476dfc276b124ed1f38099e67755e082ff69c

Download Submit
\Users\Admin\AppData\Local\Temp\b9c2828409584dcb2d0a968f1968e00f.dll
MD5
b9c2828409584dcb2d0a968f1968e00f

SHA1
28f7cdd53a24dd293f4d8233844fe4b609681a82

SHA256
b5bac95d38c0b9a246cf01fd76276870c42bdb38e2c5bab7d47ae04f1c52e969

SHA512
a7811c0a63822cbdc337d51c55db40ec8668640e21c1b91732fdacf4336d1903087a6e2a7477e676bf7c71b0ad1476dfc276b124ed1f38099e67755e082ff69c

Download Submit
memory/780-63-0x0000000000000000-mapping.dmp

Download
memory/780-64-0x000007FEFB541000-0x000007FEFB543000-memory.dmp

Filesize
8KB

Download
memory/1064-74-0x0000000000000000-mapping.dmp

Download
memory/1096-76-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1096-71-0x0000000000000000-mapping.dmp

Download
memory/1304-66-0x0000000000000000-mapping.dmp

Download
memory/1304-70-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/1304-69-0x0000000000230000-0x0000000000272000-memory.dmp

Filesize
264KB

Download
memory/1512-61-0x0000000000000000-mapping.dmp

Download
memory/1668-62-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1668-60-0x0000000074011000-0x0000000074013000-memory.dmp

Filesize
8KB

Download
memory/1668-58-0x0000000000000000-mapping.dmp

Download
memory/1844-75-0x0000000000000000-mapping.dmp

Download
memory/2044-54-0x0000000000000000-mapping.dmp

Download
memory/2044-56-0x00000000001F0000-0x0000000000232000-memory.dmp

Filesize
264KB

Download
memory/2044-57-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/2044-55-0x0000000075871000-0x0000000075873000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads