qakbot | 60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2

General

Target

9be188ae25897326093bac560a28547f.dll
Size

572KB
MD5

9be188ae25897326093bac560a28547f
SHA1

f8c004df37c37864e7f48d7c44a651d96ce19a5a
SHA256

60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2
SHA512

70134745bcbbc7f183a603d6d6f30499cf828d44560fb7b97eee693d9e998ea62d10ab5968fb3b9c76592616f4a913d0074b3cb5b93772b9e094a23ff40bfe9e

Score

10^/10

qakbot obama114 1634112211 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

C2

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1520 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1312 schtasks.exe

pid	process
1520	regsvr32.exe

pid	process
1312	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zolryofsdes\4413a5c4 = 876d46be805655a00fd60e55710481bedcbff904f2da9916d753cdb267867ccb4c426129a9868e1e5f960a37e5964467d68a628dec4f47b9cf3fabe5eaab4f4a6ba0af10192ea2041e81276297f957038fee	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zolryofsdes\81a78d2b = 1ce63def9e3f61968dde54bc903bb29747ee8249d3534d153a42b4beed7886eebc895563	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zolryofsdes\c843a00 = fabfe6e9612787383f0e36898c723afa71252883387568e825328731a217a0b265fe4ddef1b2f5eebf3bb139914fcead536506fbacfcd3a455ede3a24c387dbca00d144e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zolryofsdes\fcafc2a1 = b58181dd3fe56ac2aadd112ecfbb9751197e23db977c919b6c4fc69024be873ad82f896500cb2f62a93c31776c386d78737830ce7990c3c1bdd6cca5601a811192a822c1a81d3e9918674879caf051a7e9de3a8179a4b910	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zolryofsdes\391bea4e = ffec81f4bfd522650157f459ebc3aaea547f5597e6a5a6f5f6e679ba4d755e6286	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zolryofsdes\feeee2dd = c0a20e1e84e4dbcaac7bc88b689574c4f9c853c09138aedc0c70be000f95190681323430492e9bc6f395a56d9c2f9eb3459633c538891509b3d39a6462fba2c195576c6410b77ca26b1b3049	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zolryofsdes\73cd55f6 = 319150fe09adfb1aae8663ac0613e38dbf90644482e22909ebdd2854e813a3ebb9aafa5e0914ed903c41e6bfd9f00b2ef501c9893f67296867a37e675caf7b86	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zolryofsdes	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zolryofsdes\73cd55f6 = 319147fe09adce11d4057ad318a70c8ccb03b6f97a43f76dafa71eb7d92edfca46bb2f0bd447cc21a09231	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zolryofsdes\465285b8 = 696741ea149f7981f70f95def06d9ba31ca2b9d19698398771e9c50d5680b4a9bdc81ebedf0382e32655edcf78c606f4184e47894285e40effa7c3fafc5d7de6f23a20bc454f75590e69b253ff6059e59e52aafe006b49cb5327dae85ccf681b59c79b8df8cd15a3a0c1eec36f6b5bc0878ada2b68b9c0bcd8c17974aab2f7cb8bcbae1edddf9e2e40de190c073fa4b6a78c54f7d2c1	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

764 rundll32.exe
1520 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

764 rundll32.exe
1520 regsvr32.exe

pid	process
764	rundll32.exe
1520	regsvr32.exe

pid	process
764	rundll32.exe
1520	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1212 wrote to memory of 764	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 764	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 764	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 764	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 764	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 764	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 764	1212	rundll32.exe	rundll32.exe
PID 764 wrote to memory of 852	764	rundll32.exe	explorer.exe
PID 764 wrote to memory of 852	764	rundll32.exe	explorer.exe
PID 764 wrote to memory of 852	764	rundll32.exe	explorer.exe
PID 764 wrote to memory of 852	764	rundll32.exe	explorer.exe
PID 764 wrote to memory of 852	764	rundll32.exe	explorer.exe
PID 764 wrote to memory of 852	764	rundll32.exe	explorer.exe
PID 852 wrote to memory of 1312	852	explorer.exe	schtasks.exe
PID 852 wrote to memory of 1312	852	explorer.exe	schtasks.exe
PID 852 wrote to memory of 1312	852	explorer.exe	schtasks.exe
PID 852 wrote to memory of 1312	852	explorer.exe	schtasks.exe
PID 1300 wrote to memory of 1796	1300	taskeng.exe	regsvr32.exe
PID 1300 wrote to memory of 1796	1300	taskeng.exe	regsvr32.exe
PID 1300 wrote to memory of 1796	1300	taskeng.exe	regsvr32.exe
PID 1300 wrote to memory of 1796	1300	taskeng.exe	regsvr32.exe
PID 1300 wrote to memory of 1796	1300	taskeng.exe	regsvr32.exe
PID 1796 wrote to memory of 1520	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1520	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1520	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1520	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1520	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1520	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1520	1796	regsvr32.exe	regsvr32.exe
PID 1520 wrote to memory of 1352	1520	regsvr32.exe	explorer.exe
PID 1520 wrote to memory of 1352	1520	regsvr32.exe	explorer.exe
PID 1520 wrote to memory of 1352	1520	regsvr32.exe	explorer.exe
PID 1520 wrote to memory of 1352	1520	regsvr32.exe	explorer.exe
PID 1520 wrote to memory of 1352	1520	regsvr32.exe	explorer.exe
PID 1520 wrote to memory of 1352	1520	regsvr32.exe	explorer.exe
PID 1352 wrote to memory of 1732	1352	explorer.exe	reg.exe
PID 1352 wrote to memory of 1732	1352	explorer.exe	reg.exe
PID 1352 wrote to memory of 1732	1352	explorer.exe	reg.exe
PID 1352 wrote to memory of 1732	1352	explorer.exe	reg.exe
PID 1352 wrote to memory of 1996	1352	explorer.exe	reg.exe
PID 1352 wrote to memory of 1996	1352	explorer.exe	reg.exe
PID 1352 wrote to memory of 1996	1352	explorer.exe	reg.exe
PID 1352 wrote to memory of 1996	1352	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:852

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn aarxpimsxw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll\"" /SC ONCE /Z /ST 14:12 /ET 14:24
4⤵
- Creates scheduled task(s)
PID:1312

C:\Windows\system32\taskeng.exe
taskeng.exe {45F85AA9-A49A-42AE-934D-ECA030E03C7D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Qfolubbhoaqy" /d "0"
5⤵
PID:1732

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Trbznb" /d "0"
5⤵
PID:1996

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll
MD5
9be188ae25897326093bac560a28547f

SHA1
f8c004df37c37864e7f48d7c44a651d96ce19a5a

SHA256
60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2

SHA512
70134745bcbbc7f183a603d6d6f30499cf828d44560fb7b97eee693d9e998ea62d10ab5968fb3b9c76592616f4a913d0074b3cb5b93772b9e094a23ff40bfe9e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll
MD5
9be188ae25897326093bac560a28547f

SHA1
f8c004df37c37864e7f48d7c44a651d96ce19a5a

SHA256
60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2

SHA512
70134745bcbbc7f183a603d6d6f30499cf828d44560fb7b97eee693d9e998ea62d10ab5968fb3b9c76592616f4a913d0074b3cb5b93772b9e094a23ff40bfe9e

Download Submit
memory/764-55-0x0000000075331000-0x0000000075333000-memory.dmp

Filesize
8KB

Download
memory/764-56-0x0000000000170000-0x00000000001A5000-memory.dmp

Filesize
212KB

Download
memory/764-57-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/764-54-0x0000000000000000-mapping.dmp

Download
memory/852-59-0x0000000000000000-mapping.dmp

Download
memory/852-61-0x00000000743B1000-0x00000000743B3000-memory.dmp

Filesize
8KB

Download
memory/852-58-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/852-63-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1312-62-0x0000000000000000-mapping.dmp

Download
memory/1352-71-0x0000000000000000-mapping.dmp

Download
memory/1352-78-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1520-67-0x0000000000000000-mapping.dmp

Download
memory/1520-76-0x00000000001A0000-0x00000000001D5000-memory.dmp

Filesize
212KB

Download
memory/1520-77-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1732-75-0x0000000000000000-mapping.dmp

Download
memory/1796-65-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/1796-64-0x0000000000000000-mapping.dmp

Download
memory/1996-79-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads