qakbot | f45a72880d244adbc4e7d41517e790b291ca235c7655f887d5eed31373516abb

Analysis

max time kernel
150s
max time network
26s
platform
windows7_x64
resource
win7-en-20210920
submitted
29/09/2021, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
44468.7122434028.dat.dll
Size 708KB
Sample210929-vcs6dsfch4
SHA256 f45a72880d244adbc4e7d41517e790b291ca235c7655f887d5eed31373516abb
MD5 5d525597ac63c8b29d42c879b8d34279
SHA1 9422595b557dcff273aa393752a48393d80c8bf7
SHA512 b7b269a08b5fcb6e595e5c82c7c63323dce03f06d364b42aef33f8e9f8ad38622af49e0181ecfbd2713d4d177cc7898352c596bad80d4a7c8c773d3dd8db9ea6
MD5 SHA1 SHA512

Score

10^/10

qakbot obama106 1632905607 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama106

Campaign

1632905607

37.210.152.224:995
120.151.47.189:443
105.198.236.99:443
122.11.220.212:2222
199.27.127.129:443
41.251.41.14:995
216.201.162.158:443
124.123.42.115:2078
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
217.17.56.163:443
182.181.78.18:995
140.82.49.12:443
105.159.144.186:995
89.101.97.139:443
217.17.56.163:0
27.223.92.142:995
95.77.223.148:443
109.190.253.11:2222
81.250.153.227:2222
190.198.206.189:2222
81.241.252.59:2078
136.232.34.70:443
47.22.148.6:443
93.8.66.216:443
124.123.42.115:2222
217.17.56.163:2222
217.17.56.163:2078
217.17.56.163:465
41.228.22.180:443
76.25.142.196:443
71.74.12.34:443
71.80.168.245:443
75.188.35.168:443
173.21.10.71:2222
73.151.236.31:443
45.46.53.140:2222
67.165.206.193:993
38.10.201.211:443
72.252.201.69:443
71.60.246.5:443
92.148.59.207:2222
92.157.171.41:2222
24.139.72.117:443
186.18.205.199:995
24.229.150.54:995
47.40.196.233:2222
24.55.112.61:443
177.130.82.197:2222
109.12.111.14:443
68.204.7.158:443
186.87.135.68:995
80.6.192.58:443
103.148.120.144:443
75.66.88.33:443
173.25.166.81:443
187.156.138.172:443
82.77.137.101:995
173.234.155.233:443
2.178.108.147:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
1372	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1752	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lfbahxasir\5463a96b = fd2d1926d606d80352a8f49b70b8e06f29b3e40a01fc07bb52fb27ffd106c058c4a2492f0c76b2a5bb50a9eb7d4826a57f59adbc3d664b1de656ee0b4c10b5d2886622b7af1d1f5aad977302c8b32034744e82a42e87d1fd3fdcf00099	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lfbahxasir\a60971b6 = 2c9c623acb3a5925d3807a0dcce005095fa10a298b94e22f4faca7f0f9a0faf85a9a805ea3cc4ab8bd4182bb34f864b1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lfbahxasir\ecdfce0e = 073021ea317d1d9773afeaa7ba3cc56803eecac48113e44205d8952d181e19dc4a91d850fefe6f8e607816baf6270f5c5422f8d75c2559c9821811f1979c6af1ab77c9bcdf9275e38609ca56a5cefed8cfb3952ebfc97b5ed231658a6387ad17a278e770fd708132d07b69c88bfa9c701b24e03cba4d9f109474c5f538a49717fc8f325ae8c51a94b00852621b54d245036e9331755434f8529dd4c8875af081204863ef06a617f76de5c1b45d7d5475393d19dc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lfbahxasir\ee9eee72 = 45edd3afda5f21620ab98af44c763cefcab3647345c4ca8d4365799fab1cef2e789d414481a36590695d9f88875b3805ee85fd5bb6baa49414bff8b7003830ef57e0dcc0230034	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lfbahxasir\56228917 = 676e8bb70c373255f875f79137bed2a76b7552bea849663c91162732ed222cf182274fe6681749a786faba79263907ba6064ef6c401a837565a7fd5c40370fad4ab7d9a251deb3e5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lfbahxasir\9396a1f8 = d22f70ea55b5275624b4c40ca41b681c8d5ce09fa4fc051a203d5b1816c93772a5f491de620d5c9166b4	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lfbahxasir	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lfbahxasir\d9401e40 = e35484667ac64500a73918	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lfbahxasir\2b2ac69d = 104cc3e8a9021509b9022bddffd5cfbd5685f313d05a69bdb2568fd2c7d82e170c089c6a6629582fddc96968ace6f84d69e5f9aef956c75a79c1741520d5a004af29b4f3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lfbahxasir\d9401e40 = e35493667ac670b6f026f489f0e3f4f44928f6149a5067eb315bd64cccccd137	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1456	rundll32.exe
1372	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1456	rundll32.exe
1372	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1456	1720	rundll32.exe	27
PID 1720 wrote to memory of 1456	1720	rundll32.exe	27
PID 1720 wrote to memory of 1456	1720	rundll32.exe	27
PID 1720 wrote to memory of 1456	1720	rundll32.exe	27
PID 1720 wrote to memory of 1456	1720	rundll32.exe	27
PID 1720 wrote to memory of 1456	1720	rundll32.exe	27
PID 1720 wrote to memory of 1456	1720	rundll32.exe	27
PID 1456 wrote to memory of 1236	1456	rundll32.exe	28
PID 1456 wrote to memory of 1236	1456	rundll32.exe	28
PID 1456 wrote to memory of 1236	1456	rundll32.exe	28
PID 1456 wrote to memory of 1236	1456	rundll32.exe	28
PID 1456 wrote to memory of 1236	1456	rundll32.exe	28
PID 1456 wrote to memory of 1236	1456	rundll32.exe	28
PID 1236 wrote to memory of 1752	1236	explorer.exe	29
PID 1236 wrote to memory of 1752	1236	explorer.exe	29
PID 1236 wrote to memory of 1752	1236	explorer.exe	29
PID 1236 wrote to memory of 1752	1236	explorer.exe	29
PID 572 wrote to memory of 680	572	taskeng.exe	34
PID 572 wrote to memory of 680	572	taskeng.exe	34
PID 572 wrote to memory of 680	572	taskeng.exe	34
PID 572 wrote to memory of 680	572	taskeng.exe	34
PID 572 wrote to memory of 680	572	taskeng.exe	34
PID 680 wrote to memory of 1372	680	regsvr32.exe	35
PID 680 wrote to memory of 1372	680	regsvr32.exe	35
PID 680 wrote to memory of 1372	680	regsvr32.exe	35
PID 680 wrote to memory of 1372	680	regsvr32.exe	35
PID 680 wrote to memory of 1372	680	regsvr32.exe	35
PID 680 wrote to memory of 1372	680	regsvr32.exe	35
PID 680 wrote to memory of 1372	680	regsvr32.exe	35
PID 1372 wrote to memory of 1792	1372	regsvr32.exe	36
PID 1372 wrote to memory of 1792	1372	regsvr32.exe	36
PID 1372 wrote to memory of 1792	1372	regsvr32.exe	36
PID 1372 wrote to memory of 1792	1372	regsvr32.exe	36
PID 1372 wrote to memory of 1792	1372	regsvr32.exe	36
PID 1372 wrote to memory of 1792	1372	regsvr32.exe	36
PID 1792 wrote to memory of 1328	1792	explorer.exe	37
PID 1792 wrote to memory of 1328	1792	explorer.exe	37
PID 1792 wrote to memory of 1328	1792	explorer.exe	37
PID 1792 wrote to memory of 1328	1792	explorer.exe	37
PID 1792 wrote to memory of 1976	1792	explorer.exe	39
PID 1792 wrote to memory of 1976	1792	explorer.exe	39
PID 1792 wrote to memory of 1976	1792	explorer.exe	39
PID 1792 wrote to memory of 1976	1792	explorer.exe	39

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44468.7122434028.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44468.7122434028.dat.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rkmcxna /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44468.7122434028.dat.dll\"" /SC ONCE /Z /ST 16:53 /ET 17:05
      4⤵
      Creates scheduled task(s)
      PID:1752

C:\Windows\system32\taskeng.exe
taskeng.exe {FE8EEC5D-3104-456A-9E04-4DF27D265AD7} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:572
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44468.7122434028.dat.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\44468.7122434028.dat.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1792
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Mipynv" /d "0"
        5⤵
        
        PID:1328
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Dzwjsvzv" /d "0"
        5⤵
        
        PID:1976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/680-64-0x000007FEFC271000-0x000007FEFC273000-memory.dmp

Download

memory/1236-62-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/1236-60-0x0000000074AF1000-0x0000000074AF3000-memory.dmp

Download

memory/1372-70-0x0000000074E30000-0x0000000074EFA000-memory.dmp

Download

memory/1372-71-0x00000000003A0000-0x00000000003A1000-memory.dmp

Download

memory/1372-69-0x0000000074E30000-0x0000000074E51000-memory.dmp

Download

memory/1456-57-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/1456-56-0x0000000074FD0000-0x000000007509A000-memory.dmp

Download

memory/1456-55-0x0000000074FD0000-0x0000000074FF1000-memory.dmp

Download

memory/1456-54-0x0000000075651000-0x0000000075653000-memory.dmp

Download

memory/1792-78-0x0000000000120000-0x0000000000141000-memory.dmp

Download