qakbot | 4b0c5b9e5bcc744b7af5b11f77219d6a28c75167f031e5773e2eff3c46cd4235

General

Target

Drezd.red.dll
Size

750KB
MD5

bf82897e4245cd0ad4582e46c9ff5674
SHA1

58f5a1ab77e88693f05946d4336c1a7ac338243f
SHA256

4b0c5b9e5bcc744b7af5b11f77219d6a28c75167f031e5773e2eff3c46cd4235
SHA512

9582b740795d06cf615df14d6920d3ef7880ee7ae2e209b3b975eea896e42861fb82ec8fcf95696f8b7425080f5b6964fd49fcb0af127f52774a0915f35fcba9

Score

10^/10

qakbot obama105 1632821932 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama105

Campaign

1632821932

C2

120.151.47.189:443

41.228.22.180:443

39.52.241.3:995

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

196.217.156.63:995

120.150.218.241:995

95.77.223.148:443

185.250.148.74:443

181.118.183.94:443

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3236 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

664 schtasks.exe

pid	process
3236	regsvr32.exe

pid	process
664	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zbyijqov\1b128f59 = 2ec3dc5137d43269dcedbd44b53df48b150d210fa0304ff1af02ad4ef1f4c6d6615cca8fa08fb74073ed862a8748e428879e3c3660b5a7ed27a7f14a50f2bf8d43ede2d58d03b1665f30d3549c2ed1eab36ff65665db5a6a80e61252ee8f0c1bfc1a1b161a7adf16040b17fb1be202	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zbyijqov\645be0af = 71899f2b537ff7bf969a867c999481145ed8ea991f7aaff2dc980e60950f9dc9fc6ab678cf20e0b2d8565f1acde281b4defe5a88fd5de461ecf8e5822dce9cde70b709b6ee62437fea71ea975ab368451b91cfc2f0f3ab79c9938a0924d95bbcb9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zbyijqov\a3aee83c = b72e81c895983d37353a11aac4e681d37615c4716cf0e7c703133a2bf0c699bfb53af27a49917860a5351dcdd301170f18dd7e57ddf8863aec27fc4bd410e7af415e56abcf60a1adb844111d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zbyijqov\51c430e1 = cd038f25e77d63aa1adb89a9329ffa91487d5f63576a1ab076	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zbyijqov\2e8d5f17 = b65507d4009c65adc99b523de775dfe2cec735cca5d160564295571d4fa148c7569c5d4a5ef025f7e32d4ecd84b3f1386959b8	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zbyijqov	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zbyijqov\2e8d5f17 = b65510d4009c506c275bc77ecc137307486cf7e37f89467569d291db88fb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zbyijqov\1953af25 = 0cdd75381ef389c457937653ea38bc6c5015292deb6f5b7c41273a46eb9c55dda7374c5a43	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zbyijqov\a1efc840 = 75b116758cd96de0af1b25e7f1660fcadbaa72d4f27d138eccf3b842e05601c1ef792f541d36de379608bc91629b6f39f6ea0ca8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zbyijqov\dce787ca = bc4543446ebdf6b67971ad1a44b8858165f7e79559d0e4ba4c403ff93a00c702ea719f7e6ec8805bd0b11d7d451661cc36be349fed0e39e6c3dde7d802d54882e4932301	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

628 rundll32.exe
628 rundll32.exe
3236 regsvr32.exe
3236 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

628 rundll32.exe
3236 regsvr32.exe

pid	process
628	rundll32.exe
628	rundll32.exe
3236	regsvr32.exe
3236	regsvr32.exe

pid	process
628	rundll32.exe
3236	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 564 wrote to memory of 628	564	rundll32.exe	rundll32.exe
PID 564 wrote to memory of 628	564	rundll32.exe	rundll32.exe
PID 564 wrote to memory of 628	564	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 2880	628	rundll32.exe	explorer.exe
PID 628 wrote to memory of 2880	628	rundll32.exe	explorer.exe
PID 628 wrote to memory of 2880	628	rundll32.exe	explorer.exe
PID 628 wrote to memory of 2880	628	rundll32.exe	explorer.exe
PID 628 wrote to memory of 2880	628	rundll32.exe	explorer.exe
PID 2880 wrote to memory of 664	2880	explorer.exe	schtasks.exe
PID 2880 wrote to memory of 664	2880	explorer.exe	schtasks.exe
PID 2880 wrote to memory of 664	2880	explorer.exe	schtasks.exe
PID 2960 wrote to memory of 3236	2960	regsvr32.exe	regsvr32.exe
PID 2960 wrote to memory of 3236	2960	regsvr32.exe	regsvr32.exe
PID 2960 wrote to memory of 3236	2960	regsvr32.exe	regsvr32.exe
PID 3236 wrote to memory of 4032	3236	regsvr32.exe	explorer.exe
PID 3236 wrote to memory of 4032	3236	regsvr32.exe	explorer.exe
PID 3236 wrote to memory of 4032	3236	regsvr32.exe	explorer.exe
PID 3236 wrote to memory of 4032	3236	regsvr32.exe	explorer.exe
PID 3236 wrote to memory of 4032	3236	regsvr32.exe	explorer.exe
PID 4032 wrote to memory of 3892	4032	explorer.exe	reg.exe
PID 4032 wrote to memory of 3892	4032	explorer.exe	reg.exe
PID 4032 wrote to memory of 2800	4032	explorer.exe	reg.exe
PID 4032 wrote to memory of 2800	4032	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Drezd.red.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:564

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Drezd.red.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:628

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cadvhidy /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\Drezd.red.dll\"" /SC ONCE /Z /ST 15:48 /ET 16:00
4⤵
- Creates scheduled task(s)
PID:664

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\Drezd.red.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\Drezd.red.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3236

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4032

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Eqbkrrkictv" /d "0"
4⤵
PID:3892

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Zyojbul" /d "0"
4⤵
PID:2800

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Drezd.red.dll
MD5
bf82897e4245cd0ad4582e46c9ff5674

SHA1
58f5a1ab77e88693f05946d4336c1a7ac338243f

SHA256
4b0c5b9e5bcc744b7af5b11f77219d6a28c75167f031e5773e2eff3c46cd4235

SHA512
9582b740795d06cf615df14d6920d3ef7880ee7ae2e209b3b975eea896e42861fb82ec8fcf95696f8b7425080f5b6964fd49fcb0af127f52774a0915f35fcba9

Download Submit
\Users\Admin\AppData\Local\Temp\Drezd.red.dll
MD5
bf82897e4245cd0ad4582e46c9ff5674

SHA1
58f5a1ab77e88693f05946d4336c1a7ac338243f

SHA256
4b0c5b9e5bcc744b7af5b11f77219d6a28c75167f031e5773e2eff3c46cd4235

SHA512
9582b740795d06cf615df14d6920d3ef7880ee7ae2e209b3b975eea896e42861fb82ec8fcf95696f8b7425080f5b6964fd49fcb0af127f52774a0915f35fcba9

Download Submit
memory/628-116-0x0000000074250000-0x0000000074322000-memory.dmp

Filesize
840KB

Download
memory/628-115-0x0000000074250000-0x0000000074271000-memory.dmp

Filesize
132KB

Download
memory/628-117-0x00000000029A0000-0x00000000029A1000-memory.dmp

Filesize
4KB

Download
memory/628-114-0x0000000000000000-mapping.dmp

Download
memory/664-119-0x0000000000000000-mapping.dmp

Download
memory/2800-131-0x0000000000000000-mapping.dmp

Download
memory/2880-118-0x0000000000000000-mapping.dmp

Download
memory/2880-122-0x0000000002F70000-0x0000000002F91000-memory.dmp

Filesize
132KB

Download
memory/3236-124-0x0000000000000000-mapping.dmp

Download
memory/3236-127-0x0000000072F60000-0x0000000073032000-memory.dmp

Filesize
840KB

Download
memory/3236-128-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/3236-126-0x0000000072F60000-0x0000000072F81000-memory.dmp

Filesize
132KB

Download
memory/3892-130-0x0000000000000000-mapping.dmp

Download
memory/4032-129-0x0000000000000000-mapping.dmp

Download
memory/4032-134-0x0000000000510000-0x0000000000531000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads