qakbot | ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248

General

Target

44482.6403608796.dat.dll
Size

572KB
MD5

82ec0e1df076c986704fe0f919d6a53f
SHA1

c0d6be6324a341c26cc36ccddf663e95104d05fc
SHA256

ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248
SHA512

b3b4790084110fb7146128b5763c79b890987154fcd50d3c52eb18ed9046c876692a44798fcae0b703d273d3f5f58c47b776e2f486c91e41e49e5cd1c016d039

Score

10^/10

qakbot obama114 1634112211 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

C2

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1540 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

524 schtasks.exe

pid	process
1540	regsvr32.exe

pid	process
524	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xfytkaikxmlyz\9c2c4cd9 = b0c9949d5c101b024c4b0861537abbe3814e7e17c1e323ca3ba9c7eae6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xfytkaikxmlyz\e365232f = e0cc5368fa914bb86ef2edf44858468ed11a570ce49f66594b8876e041fa99c3ee94613b947fb55c882b944cd7ad875d9562dd48085bf9a4c4b4b8a7903ceb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xfytkaikxmlyz\e365232f = e0cc4468fa917ee3949d50d08cb238c1603004da91c7eac52ccb07a906eff71708f2a609d250756528bd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xfytkaikxmlyz\d6faf361 = d70a6aae03d880efbc102ffc798a4219843ad1d858b7e5d866ea7d9a8d71a2a3cd05c75483d6405ee81f6d1fc230d570bfbf289232ed174189bbe8aa1544a5b200427d6039d507cdaba394233a8865988ff38bf2cfee5993bdbffa9aef3bab07bb8026b82c5e4369fc3947499f15fc45fbb4793f059de2f3342c827281461dc7c32d5cd0db78407146d7582ab5c91a765ffaf8a701f9344e248776b335430b3a446a278a1dab566de0a18d93e5c9a121bd7ef94ecf75aba50f8a0bc44c9f3ef452ce	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xfytkaikxmlyz\a9b39c97 = 5a6209b25e99b5d87f8e00fa32fd4a7b1d78a7bac29aa60311118c3da0eb2975c4d3bd9cca8674320dfa1f81be2ae517d68df03745feba9a86030574c262b81e325decd6bbdd377e3a44229e7c546a8730fd87611975682daef1ea	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xfytkaikxmlyz\110ffbf2 = 1f5f85cb28efed1f5f8e62562c888f389f23ee2e386a9d1f32c28e2af01254fe8b22a7d62d45eda65389f1042a77e21db99a93428b97d75a2ebce0ff2924f4675e6e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xfytkaikxmlyz\6e469404 = 0cf6abee6a1cae5b97654858b20bd4402b381f7ddf127333988851ed4f08b64182ff0dff55d6d4fd074848b4963892b8cdbc	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xfytkaikxmlyz	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xfytkaikxmlyz\d4bbd31d = 9251cd0a62eefecc0c302a8b19f431f54cc60c0729b67d8913378038e59da6c2a97c7a73ce3a14decfb70ccfa24e4ee3665ec6ad64d3532f05be76cb5dfbd2060569f0e145372136a2c7aa2aad	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xfytkaikxmlyz\6c07b478 = 34388853161336449f823178d2a597c84e556f5725e72ee0c4bb29bd8ce82fec431d21fbbf940d1c8b710252f98141d0c86bb277d6cbc8c157165b	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1064 rundll32.exe
1540 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1064 rundll32.exe
1540 regsvr32.exe

pid	process
1064	rundll32.exe
1540	regsvr32.exe

pid	process
1064	rundll32.exe
1540	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1832 wrote to memory of 1064	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1064	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1064	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1064	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1064	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1064	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1064	1832	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1996	1064	rundll32.exe	explorer.exe
PID 1064 wrote to memory of 1996	1064	rundll32.exe	explorer.exe
PID 1064 wrote to memory of 1996	1064	rundll32.exe	explorer.exe
PID 1064 wrote to memory of 1996	1064	rundll32.exe	explorer.exe
PID 1064 wrote to memory of 1996	1064	rundll32.exe	explorer.exe
PID 1064 wrote to memory of 1996	1064	rundll32.exe	explorer.exe
PID 1996 wrote to memory of 524	1996	explorer.exe	schtasks.exe
PID 1996 wrote to memory of 524	1996	explorer.exe	schtasks.exe
PID 1996 wrote to memory of 524	1996	explorer.exe	schtasks.exe
PID 1996 wrote to memory of 524	1996	explorer.exe	schtasks.exe
PID 1616 wrote to memory of 784	1616	taskeng.exe	regsvr32.exe
PID 1616 wrote to memory of 784	1616	taskeng.exe	regsvr32.exe
PID 1616 wrote to memory of 784	1616	taskeng.exe	regsvr32.exe
PID 1616 wrote to memory of 784	1616	taskeng.exe	regsvr32.exe
PID 1616 wrote to memory of 784	1616	taskeng.exe	regsvr32.exe
PID 784 wrote to memory of 1540	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1540	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1540	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1540	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1540	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1540	784	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1540	784	regsvr32.exe	regsvr32.exe
PID 1540 wrote to memory of 1660	1540	regsvr32.exe	explorer.exe
PID 1540 wrote to memory of 1660	1540	regsvr32.exe	explorer.exe
PID 1540 wrote to memory of 1660	1540	regsvr32.exe	explorer.exe
PID 1540 wrote to memory of 1660	1540	regsvr32.exe	explorer.exe
PID 1540 wrote to memory of 1660	1540	regsvr32.exe	explorer.exe
PID 1540 wrote to memory of 1660	1540	regsvr32.exe	explorer.exe
PID 1660 wrote to memory of 864	1660	explorer.exe	reg.exe
PID 1660 wrote to memory of 864	1660	explorer.exe	reg.exe
PID 1660 wrote to memory of 864	1660	explorer.exe	reg.exe
PID 1660 wrote to memory of 864	1660	explorer.exe	reg.exe
PID 1660 wrote to memory of 1104	1660	explorer.exe	reg.exe
PID 1660 wrote to memory of 1104	1660	explorer.exe	reg.exe
PID 1660 wrote to memory of 1104	1660	explorer.exe	reg.exe
PID 1660 wrote to memory of 1104	1660	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44482.6403608796.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44482.6403608796.dat.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pxspiwpr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44482.6403608796.dat.dll\"" /SC ONCE /Z /ST 17:33 /ET 17:45
4⤵
- Creates scheduled task(s)
PID:524

C:\Windows\system32\taskeng.exe
taskeng.exe {E9A03039-7540-482F-97AD-5DA872440163} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44482.6403608796.dat.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\44482.6403608796.dat.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Eivofqefyprp" /d "0"
5⤵
PID:864

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Eoeunny" /d "0"
5⤵
PID:1104

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44482.6403608796.dat.dll
MD5
82ec0e1df076c986704fe0f919d6a53f

SHA1
c0d6be6324a341c26cc36ccddf663e95104d05fc

SHA256
ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248

SHA512
b3b4790084110fb7146128b5763c79b890987154fcd50d3c52eb18ed9046c876692a44798fcae0b703d273d3f5f58c47b776e2f486c91e41e49e5cd1c016d039

Download Submit
\Users\Admin\AppData\Local\Temp\44482.6403608796.dat.dll
MD5
82ec0e1df076c986704fe0f919d6a53f

SHA1
c0d6be6324a341c26cc36ccddf663e95104d05fc

SHA256
ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248

SHA512
b3b4790084110fb7146128b5763c79b890987154fcd50d3c52eb18ed9046c876692a44798fcae0b703d273d3f5f58c47b776e2f486c91e41e49e5cd1c016d039

Download Submit
memory/524-68-0x0000000000000000-mapping.dmp

Download
memory/784-71-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Filesize
8KB

Download
memory/784-70-0x0000000000000000-mapping.dmp

Download
memory/864-80-0x0000000000000000-mapping.dmp

Download
memory/1064-62-0x00000000006D0000-0x0000000000705000-memory.dmp

Filesize
212KB

Download
memory/1064-0-0x0000000000000000-mapping.dmp

Download
memory/1064-1-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1064-63-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1104-81-0x0000000000000000-mapping.dmp

Download
memory/1540-73-0x0000000000000000-mapping.dmp

Download
memory/1540-83-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1540-82-0x0000000000600000-0x0000000000635000-memory.dmp

Filesize
212KB

Download
memory/1660-77-0x0000000000000000-mapping.dmp

Download
memory/1660-84-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1996-67-0x00000000740C1000-0x00000000740C3000-memory.dmp

Filesize
8KB

Download
memory/1996-64-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/1996-69-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1996-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads