qakbot | 60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2

General

Target

9be188ae25897326093bac560a28547f.dll
Size

572KB
MD5

9be188ae25897326093bac560a28547f
SHA1

f8c004df37c37864e7f48d7c44a651d96ce19a5a
SHA256

60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2
SHA512

70134745bcbbc7f183a603d6d6f30499cf828d44560fb7b97eee693d9e998ea62d10ab5968fb3b9c76592616f4a913d0074b3cb5b93772b9e094a23ff40bfe9e

Score

10^/10

qakbot obama114 1634112211 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

C2

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3864 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1340 schtasks.exe

pid	process
3864	regsvr32.exe

pid	process
1340	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otoifaugfyachf\4223707d = 8bbbeabed710e25e656dfc23bd3b394c789c9f008c5919c8cff0d57b056afe1cdf3b64df93803d5dfaca4bd2114349b2f1cc4a08d40e0f874c5483ea71159f5d36821400f5da8ea5c4502eb5cf584f34df8e49a446d28dbbeab1df6abf0ad06390ed696a7ec20f5d9fe71a7449262c06603484154c11d06260d6d0d8676dbcc52e8a1216206fe812b578bb53c4ed3526	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otoifaugfyachf\3d6a1f8b = 27f544b4f0f64a71f8da07536d3dd2c54fa43a65a9bbdddd982c6021d68dcf22c8c1d70c1b37ab6391a1033a60d2605314f35a9f32ac28722fbcbd8a8a6c6410	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otoifaugfyachf\fa9f1718 = 493bcf991b7cc27c5da2a192aebe9a01b6b324fbb1a4bab606ee1b79d7ae408cb470c4cfde9b5fb0cbb44a6177	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otoifaugfyachf\85d678ee = 22b706ed9df0f22f9d825ae4a916df1f96e27c5db72664ccee32649b5852882e701abbc5107795e4989913e6d4fecd448705719b8b2e77bc5216597f094bc44a174618004c7f7bbc26c5654ff7919beecf380b3b8aa1a9aff3e44e8557b475834b066160000078a9f74428c1f12e24fcff22	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otoifaugfyachf\8f5cfc5 = 9edc867f9de1bf16ce9aee12115cc5bd19c32102a21cfe54c5611cca2b410f64922b117b2ee6c995aa4cd8930a123e2b1cdecf99eb4bd8bb7be64097	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otoifaugfyachf\77bca033 = 910c0207768b38945214820ce09fc460332bd89ffc2c7fa43214680cf2adc91a41859379e88e3cf6151879ab1ff4530bb1b6873fcad646bf1bf81ac86c26ef45d777428e316d3e666a9227c4eaba2ab35d29c142df4033a5215c96760e29ccf89a416cd9e76d86dbb5893c4089ee6f756272dd	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otoifaugfyachf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otoifaugfyachf\77bca033 = 910c1507768b0d4d44711c9ab245d4791971da71dd5e33b323e484088a79a51271e52a7a68346f5a1d4eb9f3bd512a9bf68c5bf693ac22aadf0ce1c5d9978d74adfb6d17091f19172f619168432086726543752d2091d41e1783b7801051	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otoifaugfyachf\40625001 = a3525129cf2391defc86251bbb72747bd6abb64391b777a1006f286c2af3ffb9a38c841f1255964b118aac6f3eab4879aafe6b605e3b0488ea46aa0591d3a0d3a486a4af19d013a5608b4139ef47d049054ad844ed8f621d06cd2aeb5adfa93ec99119bf0d02bb4dcbb78b24f902a0f3b01f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otoifaugfyachf\f8de3764 = ad28bfe3b62758a60a33211932562978aee1dd2617f91dc6fe960dc62e00c3d72e8a7b5b9b69e46b7750affb1fa3b959c27165cf12ee3192d3b48031df23b13d911e95eb9e307c751184926b12fa1173b0237fc6d8d9895acc	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2712 rundll32.exe
2712 rundll32.exe
3864 regsvr32.exe
3864 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2712 rundll32.exe
3864 regsvr32.exe

pid	process
2712	rundll32.exe
2712	rundll32.exe
3864	regsvr32.exe
3864	regsvr32.exe

pid	process
2712	rundll32.exe
3864	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1688 wrote to memory of 2712	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 2712	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 2712	1688	rundll32.exe	rundll32.exe
PID 2712 wrote to memory of 3244	2712	rundll32.exe	explorer.exe
PID 2712 wrote to memory of 3244	2712	rundll32.exe	explorer.exe
PID 2712 wrote to memory of 3244	2712	rundll32.exe	explorer.exe
PID 2712 wrote to memory of 3244	2712	rundll32.exe	explorer.exe
PID 2712 wrote to memory of 3244	2712	rundll32.exe	explorer.exe
PID 3244 wrote to memory of 1340	3244	explorer.exe	schtasks.exe
PID 3244 wrote to memory of 1340	3244	explorer.exe	schtasks.exe
PID 3244 wrote to memory of 1340	3244	explorer.exe	schtasks.exe
PID 3980 wrote to memory of 3864	3980	regsvr32.exe	regsvr32.exe
PID 3980 wrote to memory of 3864	3980	regsvr32.exe	regsvr32.exe
PID 3980 wrote to memory of 3864	3980	regsvr32.exe	regsvr32.exe
PID 3864 wrote to memory of 976	3864	regsvr32.exe	explorer.exe
PID 3864 wrote to memory of 976	3864	regsvr32.exe	explorer.exe
PID 3864 wrote to memory of 976	3864	regsvr32.exe	explorer.exe
PID 3864 wrote to memory of 976	3864	regsvr32.exe	explorer.exe
PID 3864 wrote to memory of 976	3864	regsvr32.exe	explorer.exe
PID 976 wrote to memory of 1300	976	explorer.exe	reg.exe
PID 976 wrote to memory of 1300	976	explorer.exe	reg.exe
PID 976 wrote to memory of 1424	976	explorer.exe	reg.exe
PID 976 wrote to memory of 1424	976	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2712

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3244

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ztuzajnihl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll\"" /SC ONCE /Z /ST 15:00 /ET 15:12
4⤵
- Creates scheduled task(s)
PID:1340

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3980

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3864

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:976

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Lexrib" /d "0"
4⤵
PID:1300

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Wbflfrb" /d "0"
4⤵
PID:1424

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll
MD5
9be188ae25897326093bac560a28547f

SHA1
f8c004df37c37864e7f48d7c44a651d96ce19a5a

SHA256
60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2

SHA512
70134745bcbbc7f183a603d6d6f30499cf828d44560fb7b97eee693d9e998ea62d10ab5968fb3b9c76592616f4a913d0074b3cb5b93772b9e094a23ff40bfe9e

Download Submit
\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll
MD5
9be188ae25897326093bac560a28547f

SHA1
f8c004df37c37864e7f48d7c44a651d96ce19a5a

SHA256
60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2

SHA512
70134745bcbbc7f183a603d6d6f30499cf828d44560fb7b97eee693d9e998ea62d10ab5968fb3b9c76592616f4a913d0074b3cb5b93772b9e094a23ff40bfe9e

Download Submit
memory/976-127-0x0000000000000000-mapping.dmp

Download
memory/976-132-0x00000000032A0000-0x00000000032C1000-memory.dmp

Filesize
132KB

Download
memory/976-130-0x00000000036D0000-0x00000000036D1000-memory.dmp

Filesize
4KB

Download
memory/976-131-0x00000000036D0000-0x00000000036D1000-memory.dmp

Filesize
4KB

Download
memory/1300-128-0x0000000000000000-mapping.dmp

Download
memory/1340-119-0x0000000000000000-mapping.dmp

Download
memory/1424-129-0x0000000000000000-mapping.dmp

Download
memory/2712-115-0x0000000000000000-mapping.dmp

Download
memory/2712-116-0x0000000004360000-0x00000000043EE000-memory.dmp

Filesize
568KB

Download
memory/2712-117-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/3244-121-0x0000000000A40000-0x0000000000A41000-memory.dmp

Filesize
4KB

Download
memory/3244-122-0x00000000005D0000-0x00000000005F1000-memory.dmp

Filesize
132KB

Download
memory/3244-118-0x0000000000000000-mapping.dmp

Download
memory/3244-120-0x0000000000A40000-0x0000000000A41000-memory.dmp

Filesize
4KB

Download
memory/3864-126-0x0000000003320000-0x0000000003355000-memory.dmp

Filesize
212KB

Download
memory/3864-124-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads