qakbot | f45a72880d244adbc4e7d41517e790b291ca235c7655f887d5eed31373516abb

General

Target
44468.7122434028.dat.dll
Size 708KB
Sample210929-vcs6dsfch4
SHA256 f45a72880d244adbc4e7d41517e790b291ca235c7655f887d5eed31373516abb
MD5 5d525597ac63c8b29d42c879b8d34279
SHA1 9422595b557dcff273aa393752a48393d80c8bf7
SHA512 b7b269a08b5fcb6e595e5c82c7c63323dce03f06d364b42aef33f8e9f8ad38622af49e0181ecfbd2713d4d177cc7898352c596bad80d4a7c8c773d3dd8db9ea6
MD5 SHA1 SHA512

Score

10^/10

qakbot obama106 1632905607 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama106

Campaign

1632905607

C2

37.210.152.224:995
120.151.47.189:443
105.198.236.99:443
122.11.220.212:2222
199.27.127.129:443
41.251.41.14:995
216.201.162.158:443
124.123.42.115:2078
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
217.17.56.163:443
182.181.78.18:995
140.82.49.12:443
105.159.144.186:995
89.101.97.139:443
217.17.56.163:0
27.223.92.142:995
95.77.223.148:443
109.190.253.11:2222
81.250.153.227:2222
190.198.206.189:2222
81.241.252.59:2078
136.232.34.70:443
47.22.148.6:443
93.8.66.216:443
124.123.42.115:2222
217.17.56.163:2222
217.17.56.163:2078
217.17.56.163:465
41.228.22.180:443
76.25.142.196:443
71.74.12.34:443
71.80.168.245:443
75.188.35.168:443
173.21.10.71:2222
73.151.236.31:443
45.46.53.140:2222
67.165.206.193:993
38.10.201.211:443
72.252.201.69:443
71.60.246.5:443
92.148.59.207:2222
92.157.171.41:2222
24.139.72.117:443
186.18.205.199:995
24.229.150.54:995
47.40.196.233:2222
24.55.112.61:443
177.130.82.197:2222
109.12.111.14:443
68.204.7.158:443
186.87.135.68:995
80.6.192.58:443
103.148.120.144:443
75.66.88.33:443
173.25.166.81:443
187.156.138.172:443
82.77.137.101:995
173.234.155.233:443
2.178.108.147:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
2088	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1108	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qecxkooqb\584badb1 = 338f89a7a5c6848604afbfa447b71e9468a1f572f8f5294862a041b5b40b710fd7d508aa1760788bfd7fb9d159e0decf0f51afcbf3dbf5986b0be4559f099b5d34b55d3bd2b0552ff56356bb7ae4dc380fb59236	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qecxkooqb\2702c247 = 006ba1f17817dd7a3fab4c30cde974dd017961f806734bb0064c8071039b62fabd1dba7c5f95937d38dde6c69164c434c1b7ad15	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qecxkooqb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qecxkooqb\2702c247 = 006bb6f17817e88fee7fd09645ff59f800c2a946b694dc283a32f123c0ecfe	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qecxkooqb\129d1209 = 0eb4d6ed468e6c4aef2592a88cf316b88ac8385bb965223ab4044b21ed5627a8c0ac00694e82da9522aa22e7ed1aa8b2a7ca3fd88a5fa843b6c677570cc41afa73a7fc7a419c56c096e39321e109d9a610f4f368c95565d9c743a175626201931a0c5aa8db675a21f1cc2001d26c251af7d9c4a0e84c20a9893eaa6e1d6f586e08ed6e34e24cd927b4e66b436c6a7b8876b7b601f13566fd1089c94d8aa47470efa0eb123cc09f743bb84703a55ae0fac60e609efb9fa7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qecxkooqb\d5681a9a = da56a3b7ed4db895a0492673f21403f44024ca4a4cef9b36f874824991b8737a6c1a80f0b3b02f3307144e384ff06f26	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qecxkooqb\6dd47dff = f5a828aa5610a15426fd94842e12d62d8c48f290680684d164f790113d72da5d93b7d9120ff1d53a6e147e5b3e529c35bb6b195df2b168f2ff268bf4c0a79cdc71d521e457	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qecxkooqb\10dc3275 = 35fa5a6df59fc6d5509dd6d5379c79a91a40671118067a99aa78765d760acc55a86b8e0a19cc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qecxkooqb\a8605510 = 70ca53fb35cf014a754a3505e03a492075a3f8ecd1cf54aaf160a8e3a71cf6f6518c6abb0efe2b265ec7b80a2d6ea95589c1baeab44994d73d6ceebf319672a756e17756b12568e221c4a4c5b98c190ddc99aaa30f624f2d1c8d68d3d18ecc93617639e40d2602703d9aba	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qecxkooqb\aa21756c = 937bcbb78775101a7ccdd87a76d237a6f8209ebe62c4ea11387f6564da965ccc40a5e07ddfd9ddecad696620d7fd095c6cdd8f57f586f5333b726b348413e473643257942a	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
836	rundll32.exe
836	rundll32.exe
2088	regsvr32.exe
2088	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
836	rundll32.exe
2088	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 836	664	rundll32.exe	68
PID 664 wrote to memory of 836	664	rundll32.exe	68
PID 664 wrote to memory of 836	664	rundll32.exe	68
PID 836 wrote to memory of 364	836	rundll32.exe	69
PID 836 wrote to memory of 364	836	rundll32.exe	69
PID 836 wrote to memory of 364	836	rundll32.exe	69
PID 836 wrote to memory of 364	836	rundll32.exe	69
PID 836 wrote to memory of 364	836	rundll32.exe	69
PID 364 wrote to memory of 1108	364	explorer.exe	70
PID 364 wrote to memory of 1108	364	explorer.exe	70
PID 364 wrote to memory of 1108	364	explorer.exe	70
PID 2628 wrote to memory of 2088	2628	regsvr32.exe	80
PID 2628 wrote to memory of 2088	2628	regsvr32.exe	80
PID 2628 wrote to memory of 2088	2628	regsvr32.exe	80
PID 2088 wrote to memory of 3940	2088	regsvr32.exe	81
PID 2088 wrote to memory of 3940	2088	regsvr32.exe	81
PID 2088 wrote to memory of 3940	2088	regsvr32.exe	81
PID 2088 wrote to memory of 3940	2088	regsvr32.exe	81
PID 2088 wrote to memory of 3940	2088	regsvr32.exe	81
PID 3940 wrote to memory of 2712	3940	explorer.exe	82
PID 3940 wrote to memory of 2712	3940	explorer.exe	82
PID 3940 wrote to memory of 740	3940	explorer.exe	84
PID 3940 wrote to memory of 740	3940	explorer.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44468.7122434028.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44468.7122434028.dat.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kkpwrsptfh /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44468.7122434028.dat.dll\"" /SC ONCE /Z /ST 18:53 /ET 19:05
      4⤵
      Creates scheduled task(s)
      PID:1108

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44468.7122434028.dat.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\44468.7122434028.dat.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Dolifozec" /d "0"
      4⤵
      PID:2712
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Oukdchpcb" /d "0"
      4⤵
      PID:740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-122-0x0000000002780000-0x00000000027A1000-memory.dmp

Download

memory/836-115-0x0000000073630000-0x0000000073651000-memory.dmp

Download

memory/836-116-0x0000000073630000-0x00000000736FA000-memory.dmp

Download

memory/836-117-0x0000000000D20000-0x0000000000D21000-memory.dmp

Download

memory/2088-127-0x0000000072EF0000-0x0000000072FBA000-memory.dmp

Download

memory/2088-128-0x0000000003480000-0x0000000003481000-memory.dmp

Download

memory/2088-126-0x0000000072EF0000-0x0000000072F11000-memory.dmp

Download

memory/3940-134-0x0000000003080000-0x00000000030A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads