qakbot | b5bac95d38c0b9a246cf01fd76276870c42bdb38e2c5bab7d47ae04f1c52e969

General

Target

b9c2828409584dcb2d0a968f1968e00f.dll
Size

378KB
MD5

b9c2828409584dcb2d0a968f1968e00f
SHA1

28f7cdd53a24dd293f4d8233844fe4b609681a82
SHA256

b5bac95d38c0b9a246cf01fd76276870c42bdb38e2c5bab7d47ae04f1c52e969
SHA512

a7811c0a63822cbdc337d51c55db40ec8668640e21c1b91732fdacf4336d1903087a6e2a7477e676bf7c71b0ad1476dfc276b124ed1f38099e67755e082ff69c

Score

10^/10

qakbot obama104 1632729661 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

obama104

Campaign

1632729661

C2

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4068 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2516 schtasks.exe

pid	process
4068	regsvr32.exe

pid	process
2516	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Epcuyigz	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Epcuyigz\b6cca1bf = 8ae2e8f4a3e95eab83d3ff10c15aada6a9fe1027b96a18fefc0f806ac0dc15521b96b71f2231ddfadb5467d06ca4adf71a74d91d7a6195a66fd1924e9f21086f3ff5695d7efbece48cb20e1e06502842cdf15c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Epcuyigz\c985ce49 = 7173746d1a27984d31b1ed9d0b050a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Epcuyigz\3bef1694 = d10cb1600430d0a2dc4bee659779b63efa2725ad0b62356f4549c39e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Epcuyigz\44a67962 = 8fb64d89ae23b8ad05183921f7669367072ac70d359246a90bdd11871ce4c6382701570d490defd5d48eb3aa74417a50ec1993721e7471c8c3ff3830c382561cff73845ebda744a10b226fe63f57af0cf549f4d6c0b5250f835b73381b375a7524e1442e19a077dbdcca6b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Epcuyigz\44a67962 = 8fb65a89ae238de83143b18f303288c200ff4e856c5795f25359cb28b312b79ccc3d54dbc52be8c944a696dd64cd56d4be7149e133af077dd2bb434958420b8070363568756abd6099ef09f083e965f8e1326aec55a6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Epcuyigz\7139a92c = c3405a737fbfde943f35c9de58d66c568c89f120fc0f8c3f5b1234002623abf4ee9930ebaa67eedf5b0afd58842ed24857a800d1bffbd1bfc868009960a59e7a70549728c740cd616fadbf90c0080cae8feacb5ece522e443cbcf4122265c039ec1c98aa269c9dffb2e3b5ddb9d926deb69cbaca4bdad64a7cd3126918268a2dc6800c9c958a90761b16a1e6726c7955fed01da05bd1911131b34c2cfb55d3e081082b819333f415d2901af29f1147ffab57b482bf9b4d52a4d1f7418e0289a709906b2f36d02a97a5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Epcuyigz\73788950 = 15c0fdaa0fcd7e1db3014ae8fe1360c86eb37dbf0be7d754a8e37bf2ab30efd113a4c9f9b5d7e07c9eeaa437	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Epcuyigz\cbc4ee35 = 500cab5299338f0855cc644848a6cbf939d8b5a7efae7b4a9a336c46a82bd73f1bbbd9e5cfffa483ec95bc1a2a8c310f60d5a8fb7f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Epcuyigz\e70c6da = c18ba300b4fbd2a8d5a723410fc9d74b3430acf229c172dbe92b7dbd7d2f8526906658c2d9	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2160 rundll32.exe
2160 rundll32.exe
4068 regsvr32.exe
4068 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2160 rundll32.exe
4068 regsvr32.exe

pid	process
2160	rundll32.exe
2160	rundll32.exe
4068	regsvr32.exe
4068	regsvr32.exe

pid	process
2160	rundll32.exe
4068	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2076 wrote to memory of 2160	2076	rundll32.exe	rundll32.exe
PID 2076 wrote to memory of 2160	2076	rundll32.exe	rundll32.exe
PID 2076 wrote to memory of 2160	2076	rundll32.exe	rundll32.exe
PID 2160 wrote to memory of 2436	2160	rundll32.exe	explorer.exe
PID 2160 wrote to memory of 2436	2160	rundll32.exe	explorer.exe
PID 2160 wrote to memory of 2436	2160	rundll32.exe	explorer.exe
PID 2160 wrote to memory of 2436	2160	rundll32.exe	explorer.exe
PID 2160 wrote to memory of 2436	2160	rundll32.exe	explorer.exe
PID 2436 wrote to memory of 2516	2436	explorer.exe	schtasks.exe
PID 2436 wrote to memory of 2516	2436	explorer.exe	schtasks.exe
PID 2436 wrote to memory of 2516	2436	explorer.exe	schtasks.exe
PID 996 wrote to memory of 4068	996	regsvr32.exe	regsvr32.exe
PID 996 wrote to memory of 4068	996	regsvr32.exe	regsvr32.exe
PID 996 wrote to memory of 4068	996	regsvr32.exe	regsvr32.exe
PID 4068 wrote to memory of 408	4068	regsvr32.exe	explorer.exe
PID 4068 wrote to memory of 408	4068	regsvr32.exe	explorer.exe
PID 4068 wrote to memory of 408	4068	regsvr32.exe	explorer.exe
PID 4068 wrote to memory of 408	4068	regsvr32.exe	explorer.exe
PID 4068 wrote to memory of 408	4068	regsvr32.exe	explorer.exe
PID 408 wrote to memory of 1056	408	explorer.exe	reg.exe
PID 408 wrote to memory of 1056	408	explorer.exe	reg.exe
PID 408 wrote to memory of 2196	408	explorer.exe	reg.exe
PID 408 wrote to memory of 2196	408	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9c2828409584dcb2d0a968f1968e00f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9c2828409584dcb2d0a968f1968e00f.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2436

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hgwplngq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\b9c2828409584dcb2d0a968f1968e00f.dll\"" /SC ONCE /Z /ST 19:13 /ET 19:25
4⤵
- Creates scheduled task(s)
PID:2516

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\b9c2828409584dcb2d0a968f1968e00f.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\b9c2828409584dcb2d0a968f1968e00f.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4068

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:408

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Nauxtomaaodx" /d "0"
4⤵
PID:1056

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Cjuxeyu" /d "0"
4⤵
PID:2196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b9c2828409584dcb2d0a968f1968e00f.dll
MD5
b9c2828409584dcb2d0a968f1968e00f

SHA1
28f7cdd53a24dd293f4d8233844fe4b609681a82

SHA256
b5bac95d38c0b9a246cf01fd76276870c42bdb38e2c5bab7d47ae04f1c52e969

SHA512
a7811c0a63822cbdc337d51c55db40ec8668640e21c1b91732fdacf4336d1903087a6e2a7477e676bf7c71b0ad1476dfc276b124ed1f38099e67755e082ff69c

Download Submit
\Users\Admin\AppData\Local\Temp\b9c2828409584dcb2d0a968f1968e00f.dll
MD5
b9c2828409584dcb2d0a968f1968e00f

SHA1
28f7cdd53a24dd293f4d8233844fe4b609681a82

SHA256
b5bac95d38c0b9a246cf01fd76276870c42bdb38e2c5bab7d47ae04f1c52e969

SHA512
a7811c0a63822cbdc337d51c55db40ec8668640e21c1b91732fdacf4336d1903087a6e2a7477e676bf7c71b0ad1476dfc276b124ed1f38099e67755e082ff69c

Download Submit
memory/408-132-0x00000000004C0000-0x00000000004E1000-memory.dmp

Filesize
132KB

Download
memory/408-127-0x0000000000000000-mapping.dmp

Download
memory/1056-128-0x0000000000000000-mapping.dmp

Download
memory/2160-116-0x0000000000B20000-0x0000000000BAE000-memory.dmp

Filesize
568KB

Download
memory/2160-117-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/2160-115-0x0000000000000000-mapping.dmp

Download
memory/2196-129-0x0000000000000000-mapping.dmp

Download
memory/2436-118-0x0000000000000000-mapping.dmp

Download
memory/2436-122-0x0000000003180000-0x00000000031A1000-memory.dmp

Filesize
132KB

Download
memory/2436-121-0x0000000003600000-0x0000000003601000-memory.dmp

Filesize
4KB

Download
memory/2516-119-0x0000000000000000-mapping.dmp

Download
memory/4068-126-0x0000000003960000-0x00000000039A2000-memory.dmp

Filesize
264KB

Download
memory/4068-124-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads