qakbot | ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248

General

Target

Celod.wac1.dll
Size

572KB
MD5

82ec0e1df076c986704fe0f919d6a53f
SHA1

c0d6be6324a341c26cc36ccddf663e95104d05fc
SHA256

ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248
SHA512

b3b4790084110fb7146128b5763c79b890987154fcd50d3c52eb18ed9046c876692a44798fcae0b703d273d3f5f58c47b776e2f486c91e41e49e5cd1c016d039

Score

10^/10

qakbot obama114 1634112211 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

C2

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1636 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1352 schtasks.exe

pid	process
1636	regsvr32.exe

pid	process
1352	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\46cccac8 = 60c89df6d371a450c77c493d1d8023ecd333a6cff8090e7bc67486030d68c903e41a395d47	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\8378e227 = 15f603b66fac8b1b704c16d42f565db1a116ecd5b42f78d38aeb6508e7f4ea354d8bf98aeea236da4a4f6ae24bfbe20d1c235d5e0863c3378e48f31ee2c4e1c20a7385e34c8294c33301	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\3bc48542 = ebc7bea1c59f5a679f3f44a9e977106396238795bfdf281593018958d512f5eddd015abe9fdf2b61d83bc2a022b398846c8e18cefdef0c1e8f2a95eb7eeefc2ba33a9d1e3d2cc60fefe9a531b4d68b09341bd4a317840624ed	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\71123afa = 353112294c06f5297bcb40895b90df0f9fef5f4c4a2d166a7caf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\448deab4 = 1f81aa9a99c1eec849148c0a544de70f9f3d215cb7001468cdfb49429d6cc22b0b1ae133ea39b944cd5eb0c1955756db7ac8e70ad9541b36fee62df0807718ddeef6687fd48d1de31771181266337bc08d1f4c2600d1e705215717da3602d681c5120f7af233caa2efc4fec9ac8aa84f001f5c6a6d0b13d0083270ea4d95988e0886b221cf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\fe70adad = 3e18585dda4f66bee3b8da5b2f579745a2bf1a93422bea78becffc5dab7de3f17bf92c1bf63173c39a9ac3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\fc318dd1 = 31c78a22c3e2f58613d3b909d0ab56b0cfbc2ab52e70369727648a8e1ff0a26d445cc679eff7245daec4f2392f6848a46b9755de100064c5fbf7ffb94b4aada3f567ddc3a7a64b04eef945a7012a21918b0ca6b5eaf56dd0b5f721	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\e5b550c = 7a7e2d60053c6e075841412bc1b67697ff1dc0feb31e34de8328	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Riahfyzeu\71123afa = 353105294c06c07b81e4a85034bc612e0e12e62d362079ef19c3a112e1591df21c8af032481a069a3c30d185915f63	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1032 rundll32.exe
1636 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1032 rundll32.exe
1636 regsvr32.exe

pid	process
1032	rundll32.exe
1636	regsvr32.exe

pid	process
1032	rundll32.exe
1636	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1756 wrote to memory of 1032	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1032	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1032	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1032	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1032	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1032	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1032	1756	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 1776	1032	rundll32.exe	explorer.exe
PID 1032 wrote to memory of 1776	1032	rundll32.exe	explorer.exe
PID 1032 wrote to memory of 1776	1032	rundll32.exe	explorer.exe
PID 1032 wrote to memory of 1776	1032	rundll32.exe	explorer.exe
PID 1032 wrote to memory of 1776	1032	rundll32.exe	explorer.exe
PID 1032 wrote to memory of 1776	1032	rundll32.exe	explorer.exe
PID 1776 wrote to memory of 1352	1776	explorer.exe	schtasks.exe
PID 1776 wrote to memory of 1352	1776	explorer.exe	schtasks.exe
PID 1776 wrote to memory of 1352	1776	explorer.exe	schtasks.exe
PID 1776 wrote to memory of 1352	1776	explorer.exe	schtasks.exe
PID 1304 wrote to memory of 1956	1304	taskeng.exe	regsvr32.exe
PID 1304 wrote to memory of 1956	1304	taskeng.exe	regsvr32.exe
PID 1304 wrote to memory of 1956	1304	taskeng.exe	regsvr32.exe
PID 1304 wrote to memory of 1956	1304	taskeng.exe	regsvr32.exe
PID 1304 wrote to memory of 1956	1304	taskeng.exe	regsvr32.exe
PID 1956 wrote to memory of 1636	1956	regsvr32.exe	regsvr32.exe
PID 1956 wrote to memory of 1636	1956	regsvr32.exe	regsvr32.exe
PID 1956 wrote to memory of 1636	1956	regsvr32.exe	regsvr32.exe
PID 1956 wrote to memory of 1636	1956	regsvr32.exe	regsvr32.exe
PID 1956 wrote to memory of 1636	1956	regsvr32.exe	regsvr32.exe
PID 1956 wrote to memory of 1636	1956	regsvr32.exe	regsvr32.exe
PID 1956 wrote to memory of 1636	1956	regsvr32.exe	regsvr32.exe
PID 1636 wrote to memory of 984	1636	regsvr32.exe	explorer.exe
PID 1636 wrote to memory of 984	1636	regsvr32.exe	explorer.exe
PID 1636 wrote to memory of 984	1636	regsvr32.exe	explorer.exe
PID 1636 wrote to memory of 984	1636	regsvr32.exe	explorer.exe
PID 1636 wrote to memory of 984	1636	regsvr32.exe	explorer.exe
PID 1636 wrote to memory of 984	1636	regsvr32.exe	explorer.exe
PID 984 wrote to memory of 1732	984	explorer.exe	reg.exe
PID 984 wrote to memory of 1732	984	explorer.exe	reg.exe
PID 984 wrote to memory of 1732	984	explorer.exe	reg.exe
PID 984 wrote to memory of 1732	984	explorer.exe	reg.exe
PID 984 wrote to memory of 1260	984	explorer.exe	reg.exe
PID 984 wrote to memory of 1260	984	explorer.exe	reg.exe
PID 984 wrote to memory of 1260	984	explorer.exe	reg.exe
PID 984 wrote to memory of 1260	984	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Celod.wac1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Celod.wac1.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn evmymllbxh /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\Celod.wac1.dll\"" /SC ONCE /Z /ST 15:38 /ET 15:50
4⤵
- Creates scheduled task(s)
PID:1352

C:\Windows\system32\taskeng.exe
taskeng.exe {86FCE9DA-91F5-46C3-AEC5-3B4C935A3EA6} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\Celod.wac1.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\Celod.wac1.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Wcxjsuyjtqp" /d "0"
5⤵
PID:1732

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Lmyynyohkgae" /d "0"
5⤵
PID:1260

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Celod.wac1.dll
MD5
82ec0e1df076c986704fe0f919d6a53f

SHA1
c0d6be6324a341c26cc36ccddf663e95104d05fc

SHA256
ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248

SHA512
b3b4790084110fb7146128b5763c79b890987154fcd50d3c52eb18ed9046c876692a44798fcae0b703d273d3f5f58c47b776e2f486c91e41e49e5cd1c016d039

Download Submit
\Users\Admin\AppData\Local\Temp\Celod.wac1.dll
MD5
82ec0e1df076c986704fe0f919d6a53f

SHA1
c0d6be6324a341c26cc36ccddf663e95104d05fc

SHA256
ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248

SHA512
b3b4790084110fb7146128b5763c79b890987154fcd50d3c52eb18ed9046c876692a44798fcae0b703d273d3f5f58c47b776e2f486c91e41e49e5cd1c016d039

Download Submit
memory/984-78-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/984-73-0x0000000000000000-mapping.dmp

Download
memory/1032-56-0x00000000001D0000-0x0000000000205000-memory.dmp

Filesize
212KB

Download
memory/1032-54-0x0000000000000000-mapping.dmp

Download
memory/1032-57-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1032-55-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1260-77-0x0000000000000000-mapping.dmp

Download
memory/1352-63-0x0000000000000000-mapping.dmp

Download
memory/1636-71-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1636-70-0x00000000001F0000-0x0000000000225000-memory.dmp

Filesize
212KB

Download
memory/1636-67-0x0000000000000000-mapping.dmp

Download
memory/1732-76-0x0000000000000000-mapping.dmp

Download
memory/1776-59-0x0000000000000000-mapping.dmp

Download
memory/1776-62-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1776-61-0x0000000074D01000-0x0000000074D03000-memory.dmp

Filesize
8KB

Download
memory/1776-58-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/1956-65-0x000007FEFC271000-0x000007FEFC273000-memory.dmp

Filesize
8KB

Download
memory/1956-64-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads