qakbot | 60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2

General

Target

9be188ae25897326093bac560a28547f.dll
Size

572KB
MD5

9be188ae25897326093bac560a28547f
SHA1

f8c004df37c37864e7f48d7c44a651d96ce19a5a
SHA256

60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2
SHA512

70134745bcbbc7f183a603d6d6f30499cf828d44560fb7b97eee693d9e998ea62d10ab5968fb3b9c76592616f4a913d0074b3cb5b93772b9e094a23ff40bfe9e

Score

10^/10

qakbot obama114 1634112211 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

C2

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2144 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4004 schtasks.exe

pid	process
2144	regsvr32.exe

pid	process
4004	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkaeolacrz\da820679 = 236bb45e75c7a6d527abcf50587bb4c5ef9e0fc359d28cca707a7b14bdb6731e50ab4ea3455dbec675542984c4f87aea4c331bb85dac3de760c66f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkaeolacrz\623e611c = ba9639e90b328b8e29d65ffeeabd7f0f4d51bdb8dbfed0ca7f7d0f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkaeolacrz\a5cb698f = d7cdfe788666c3b200ae2d2103af33c8b5719fec4ececed69e8377e4391687c6d770f2fd7aba0ba9aa4cfc92c9b852e2675bd38893bfdf22e44e9c9c5dc94f278fdbcd5bed20f361881c0bff7f569c5aa460db493dc9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkaeolacrz\28e8dea4 = b48afbaec49bff2a019375b553cc82e9a051f67ff49a2164174509fda2f73916feb740bf614f1320781029620f083d371f4cfb2beb5840468b8f954bbe038bb8038763692973c762dde18c6d495b1cff417c4a3bd37e1a5d208a93f04af9	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkaeolacrz	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkaeolacrz\1d770eea = 59c36a4cba901f482f6f5f3de92e8f38d352910e2bf4dca5a5131bf9eeffdf4d313b713dd8665a1754c4a058804c3d9dd44efff27a07ee957bf6c334ec908ec05dae899fcebde55db015b4d37f1e25f3752804017f072fe526dd22bac7a9523c78ec9bb874e6e9f8d73ed4c377a3189536d28ee4c238	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkaeolacrz\a78a49f3 = 71170ce7299c1ceb2bf585d64a475640321917b7fd50ff333b7e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkaeolacrz\57a1b152 = f50f0c70a4ded00fb09cd5dc6bd59d1e054d62	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkaeolacrz\28e8dea4 = b48aecaec49bca6e047c16881bee55b7db0a7dbcd64bbb5900e900928f1609d1350f701e4511195eb5ee8931428be18bf6318351c32074a8115a0978d3773c3d9a0f131f47beee5367	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xkaeolacrz\1f362e96 = 5d2f010a20ddeaabe244235623ab7c0687b383cd8eeac727cf29ce72fdca535e3ddf1ab4a58bc5b03ac717d37824bf3712a717b25d38f8ba1a71f3cccf0b105e6a15bb36c109bd22941c7a27fd84024985b35ce1fa63830da8c1bc951ecf3bba2de89fa4c221bf6036ed55bc4f0d13443872	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1020 rundll32.exe
1020 rundll32.exe
2144 regsvr32.exe
2144 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1020 rundll32.exe
2144 regsvr32.exe

pid	process
1020	rundll32.exe
1020	rundll32.exe
2144	regsvr32.exe
2144	regsvr32.exe

pid	process
1020	rundll32.exe
2144	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1832 wrote to memory of 1020	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1020	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1020	1832	rundll32.exe	rundll32.exe
PID 1020 wrote to memory of 896	1020	rundll32.exe	explorer.exe
PID 1020 wrote to memory of 896	1020	rundll32.exe	explorer.exe
PID 1020 wrote to memory of 896	1020	rundll32.exe	explorer.exe
PID 1020 wrote to memory of 896	1020	rundll32.exe	explorer.exe
PID 1020 wrote to memory of 896	1020	rundll32.exe	explorer.exe
PID 896 wrote to memory of 4004	896	explorer.exe	schtasks.exe
PID 896 wrote to memory of 4004	896	explorer.exe	schtasks.exe
PID 896 wrote to memory of 4004	896	explorer.exe	schtasks.exe
PID 908 wrote to memory of 2144	908	regsvr32.exe	regsvr32.exe
PID 908 wrote to memory of 2144	908	regsvr32.exe	regsvr32.exe
PID 908 wrote to memory of 2144	908	regsvr32.exe	regsvr32.exe
PID 2144 wrote to memory of 1060	2144	regsvr32.exe	explorer.exe
PID 2144 wrote to memory of 1060	2144	regsvr32.exe	explorer.exe
PID 2144 wrote to memory of 1060	2144	regsvr32.exe	explorer.exe
PID 2144 wrote to memory of 1060	2144	regsvr32.exe	explorer.exe
PID 2144 wrote to memory of 1060	2144	regsvr32.exe	explorer.exe
PID 1060 wrote to memory of 2984	1060	explorer.exe	reg.exe
PID 1060 wrote to memory of 2984	1060	explorer.exe	reg.exe
PID 1060 wrote to memory of 4068	1060	explorer.exe	reg.exe
PID 1060 wrote to memory of 4068	1060	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1020

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ftykhurwzo /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll\"" /SC ONCE /Z /ST 16:26 /ET 16:38
4⤵
- Creates scheduled task(s)
PID:4004

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2144

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Soyabdeyh" /d "0"
4⤵
PID:2984

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Jvnmz" /d "0"
4⤵
PID:4068

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll
MD5
9be188ae25897326093bac560a28547f

SHA1
f8c004df37c37864e7f48d7c44a651d96ce19a5a

SHA256
60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2

SHA512
70134745bcbbc7f183a603d6d6f30499cf828d44560fb7b97eee693d9e998ea62d10ab5968fb3b9c76592616f4a913d0074b3cb5b93772b9e094a23ff40bfe9e

Download Submit
\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll
MD5
9be188ae25897326093bac560a28547f

SHA1
f8c004df37c37864e7f48d7c44a651d96ce19a5a

SHA256
60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2

SHA512
70134745bcbbc7f183a603d6d6f30499cf828d44560fb7b97eee693d9e998ea62d10ab5968fb3b9c76592616f4a913d0074b3cb5b93772b9e094a23ff40bfe9e

Download Submit
memory/896-118-0x0000000002590000-0x00000000025B1000-memory.dmp

Filesize
132KB

Download
memory/896-117-0x0000000000000000-mapping.dmp

Download
memory/896-120-0x0000000002A80000-0x0000000002A81000-memory.dmp

Filesize
4KB

Download
memory/896-121-0x0000000002A80000-0x0000000002A81000-memory.dmp

Filesize
4KB

Download
memory/1020-116-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1020-114-0x0000000000000000-mapping.dmp

Download
memory/1020-115-0x0000000000B00000-0x0000000000B8E000-memory.dmp

Filesize
568KB

Download
memory/1060-126-0x0000000000000000-mapping.dmp

Download
memory/1060-129-0x00000000025A0000-0x00000000025C1000-memory.dmp

Filesize
132KB

Download
memory/1060-130-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/1060-131-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/2144-123-0x0000000000000000-mapping.dmp

Download
memory/2144-125-0x0000000000F90000-0x0000000000FC5000-memory.dmp

Filesize
212KB

Download
memory/2984-127-0x0000000000000000-mapping.dmp

Download
memory/4004-119-0x0000000000000000-mapping.dmp

Download
memory/4068-128-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads