qakbot | ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248

General

Target

Celod.wac1.dll
Size

572KB
MD5

82ec0e1df076c986704fe0f919d6a53f
SHA1

c0d6be6324a341c26cc36ccddf663e95104d05fc
SHA256

ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248
SHA512

b3b4790084110fb7146128b5763c79b890987154fcd50d3c52eb18ed9046c876692a44798fcae0b703d273d3f5f58c47b776e2f486c91e41e49e5cd1c016d039

Score

10^/10

qakbot obama114 1634112211 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

C2

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2000 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

744 schtasks.exe

pid	process
2000	regsvr32.exe

pid	process
744	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iiuiliqhufqdxa\7994141a = 927b8c4de3bfa059b92fbf5651d52eeefa6208530c72e44e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iiuiliqhufqdxa\be611c89 = e59837cf8de26ed4e51c7de8bed0d9b074c70fdeee9ab6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iiuiliqhufqdxa\4c0bc454 = be36550be2455a9a4afb6762354a1a65d8f18de7a2a940c528	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iiuiliqhufqdxa\6dd7bec = 97c899751659f78e4a9c78a3e171e72e392c3397ecb7faf6af9e86ca92f7ea6ddab49ed80ea73ff7480532046cdb0c546fbc4149f1a479326287d2375d7fb5aba7f644b82445074c031a6618a2485565a7a424f9f6c4c8407d8da5883ce6540c3de1acfa55e7f8ea4b57e1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iiuiliqhufqdxa\49c5b90 = f6336781eceefdccad28657c6f0fe70c05283fbb9a90246536cecdb5545e9fa575facb6cddf709cdee96b3b19e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iiuiliqhufqdxa\c128737f = ebdd1752041ed64919a51a6b345911866b01429f74096ec107bc4d97fb4da386022703380fc9dbe2c88161dccabbd4f8174307ccfd8073	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iiuiliqhufqdxa\3342aba2 = dce41e1e13a7612f71a84ea952f094abdc3f2cfcbce2e8d5ea77351ced	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iiuiliqhufqdxa	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iiuiliqhufqdxa\3342aba2 = dce4091e13a7549b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iiuiliqhufqdxa\bc203cf5 = 98962869eeeec22f14b548f089540e6f098e78ed3bd3976aff745c8a33447036b614fc20608db7027850a9a381f11967b4c6551d6e4bb501	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1032 rundll32.exe
2000 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1032 rundll32.exe
2000 regsvr32.exe

pid	process
1032	rundll32.exe
2000	regsvr32.exe

pid	process
1032	rundll32.exe
2000	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 948 wrote to memory of 1032	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 1032	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 1032	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 1032	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 1032	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 1032	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 1032	948	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 952	1032	rundll32.exe	explorer.exe
PID 1032 wrote to memory of 952	1032	rundll32.exe	explorer.exe
PID 1032 wrote to memory of 952	1032	rundll32.exe	explorer.exe
PID 1032 wrote to memory of 952	1032	rundll32.exe	explorer.exe
PID 1032 wrote to memory of 952	1032	rundll32.exe	explorer.exe
PID 1032 wrote to memory of 952	1032	rundll32.exe	explorer.exe
PID 952 wrote to memory of 744	952	explorer.exe	schtasks.exe
PID 952 wrote to memory of 744	952	explorer.exe	schtasks.exe
PID 952 wrote to memory of 744	952	explorer.exe	schtasks.exe
PID 952 wrote to memory of 744	952	explorer.exe	schtasks.exe
PID 1820 wrote to memory of 1356	1820	taskeng.exe	regsvr32.exe
PID 1820 wrote to memory of 1356	1820	taskeng.exe	regsvr32.exe
PID 1820 wrote to memory of 1356	1820	taskeng.exe	regsvr32.exe
PID 1820 wrote to memory of 1356	1820	taskeng.exe	regsvr32.exe
PID 1820 wrote to memory of 1356	1820	taskeng.exe	regsvr32.exe
PID 1356 wrote to memory of 2000	1356	regsvr32.exe	regsvr32.exe
PID 1356 wrote to memory of 2000	1356	regsvr32.exe	regsvr32.exe
PID 1356 wrote to memory of 2000	1356	regsvr32.exe	regsvr32.exe
PID 1356 wrote to memory of 2000	1356	regsvr32.exe	regsvr32.exe
PID 1356 wrote to memory of 2000	1356	regsvr32.exe	regsvr32.exe
PID 1356 wrote to memory of 2000	1356	regsvr32.exe	regsvr32.exe
PID 1356 wrote to memory of 2000	1356	regsvr32.exe	regsvr32.exe
PID 2000 wrote to memory of 1340	2000	regsvr32.exe	explorer.exe
PID 2000 wrote to memory of 1340	2000	regsvr32.exe	explorer.exe
PID 2000 wrote to memory of 1340	2000	regsvr32.exe	explorer.exe
PID 2000 wrote to memory of 1340	2000	regsvr32.exe	explorer.exe
PID 2000 wrote to memory of 1340	2000	regsvr32.exe	explorer.exe
PID 2000 wrote to memory of 1340	2000	regsvr32.exe	explorer.exe
PID 1340 wrote to memory of 1324	1340	explorer.exe	reg.exe
PID 1340 wrote to memory of 1324	1340	explorer.exe	reg.exe
PID 1340 wrote to memory of 1324	1340	explorer.exe	reg.exe
PID 1340 wrote to memory of 1324	1340	explorer.exe	reg.exe
PID 1340 wrote to memory of 1760	1340	explorer.exe	reg.exe
PID 1340 wrote to memory of 1760	1340	explorer.exe	reg.exe
PID 1340 wrote to memory of 1760	1340	explorer.exe	reg.exe
PID 1340 wrote to memory of 1760	1340	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Celod.wac1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Celod.wac1.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pxvhmtthy /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\Celod.wac1.dll\"" /SC ONCE /Z /ST 14:15 /ET 14:27
4⤵
- Creates scheduled task(s)
PID:744

C:\Windows\system32\taskeng.exe
taskeng.exe {554F0D20-6929-49F1-83C8-82296585F2E0} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\Celod.wac1.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\Celod.wac1.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Vxmbsk" /d "0"
5⤵
PID:1324

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Zhpdcoud" /d "0"
5⤵
PID:1760

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Celod.wac1.dll
MD5
82ec0e1df076c986704fe0f919d6a53f

SHA1
c0d6be6324a341c26cc36ccddf663e95104d05fc

SHA256
ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248

SHA512
b3b4790084110fb7146128b5763c79b890987154fcd50d3c52eb18ed9046c876692a44798fcae0b703d273d3f5f58c47b776e2f486c91e41e49e5cd1c016d039

Download Submit
\Users\Admin\AppData\Local\Temp\Celod.wac1.dll
MD5
82ec0e1df076c986704fe0f919d6a53f

SHA1
c0d6be6324a341c26cc36ccddf663e95104d05fc

SHA256
ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248

SHA512
b3b4790084110fb7146128b5763c79b890987154fcd50d3c52eb18ed9046c876692a44798fcae0b703d273d3f5f58c47b776e2f486c91e41e49e5cd1c016d039

Download Submit
memory/744-59-0x0000000000000000-mapping.dmp

Download
memory/952-55-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/952-56-0x0000000000000000-mapping.dmp

Download
memory/952-58-0x0000000074D01000-0x0000000074D03000-memory.dmp

Filesize
8KB

Download
memory/952-62-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1032-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1032-61-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1032-60-0x00000000002B0000-0x00000000002E5000-memory.dmp

Filesize
212KB

Download
memory/1032-53-0x0000000000000000-mapping.dmp

Download
memory/1324-73-0x0000000000000000-mapping.dmp

Download
memory/1340-70-0x0000000000000000-mapping.dmp

Download
memory/1340-76-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1356-64-0x000007FEFC271000-0x000007FEFC273000-memory.dmp

Filesize
8KB

Download
memory/1356-63-0x0000000000000000-mapping.dmp

Download
memory/1760-77-0x0000000000000000-mapping.dmp

Download
memory/2000-66-0x0000000000000000-mapping.dmp

Download
memory/2000-75-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2000-74-0x0000000000200000-0x0000000000235000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads