qakbot | 533a1afbe6fde892155eaa61a6bd0f612779290701cc6c391c4063ec6187c75d

General

Target

44483.6988947917.dat.dll
Size

500KB
MD5

9a5ce3ea1339e255ce078346d6dd0ef3
SHA1

24f55a887f02f1018a94212192f3ed9a71813c0d
SHA256

533a1afbe6fde892155eaa61a6bd0f612779290701cc6c391c4063ec6187c75d
SHA512

0c665ccd925711934841d77574850e9402bec35b6ff340bd671d48fa962d4efdbd125c96fa4c29d1251516523f77ad3bfd81d72a8b1b32f16ce03f68aac2caa6

Score

10^/10

qakbot obama115 1634197867 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama115

Campaign

1634197867

C2

91.178.126.51:995

220.255.25.28:2222

208.78.220.143:443

77.31.162.93:443

73.230.205.91:443

216.201.162.158:443

94.200.181.154:443

24.231.209.2:2222

89.137.52.44:443

140.82.49.12:443

65.100.174.110:32103

41.86.42.158:995

27.223.92.142:995

200.232.214.222:995

81.250.153.227:2222

217.17.56.163:465

122.60.71.201:995

120.150.218.241:995

41.228.22.180:443

69.30.186.190:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1800 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1412 schtasks.exe

pid	process
1800	regsvr32.exe

pid	process
1412	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoahulin\6311fe6f = 4bf4f5dbf624a8cb4425bd0d5a543797c37a7bf15d4f0607adabfa1874a08205594ac3a01b11ba9dbd9e0da1e25a717f9f6d428a50e5733e6e140d47b2c1968c77821533237f1dfd1bb772cedd0bad8f4b1c4c9e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoahulin\dbad990a = 074f94c7842bb485d1796840654a65f45b4f9d20bcefb563d1c5658c1f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoahulin\a6a5d680 = 00b7d1667f2e0874dabbcafd2ee2e0e09e7b22dafd048c47d96613dd5e9e7d02f85677	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoahulin\d9ecb976 = e5cb4ad34475c822856f44f24cd3a58a806ae26033d510ae332026b5c81c0a2ba1265ea7bdaa10b8a4c6765a4195cfc5225a7fd570c8cfe5e1b5736448ab5dbc709408c0a587c61736bff349e2ea	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoahulin\2b8661ab = de6b9b579d4d3ec3334a841d832f23d370d0a527d92b8d6f77e1f0f2e90ea6bd4ae7a75de8976450dcc11caf95f128	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uoahulin	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoahulin\54cf0e5d = e785a0201b72db98f27335f68060bf46f613265c803602fb2db47bad4e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoahulin\6150de13 = 0576d798b49a7f28021f996221fd986541215c2a22a3434831abac72b04709b57f351e41acf5f4613060a4f47632d0e3c2d71af9512dd9a5005e21913f3b65a46b52e61315112e89af9b76de63ae9ce9cb3d77e2b26db3955b8e0cd211d25d59072cb65354a861262fcc958a2947cdc8f8cedd12616e83b6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoahulin\1e19b1e5 = 087aa3bf89772081e700fbebf70335f4982ea33a2752124eaeb9536da9ca6b203d90f4ee5f6b8669c57bdc3af19f680534b9c7f87ca7cb2a7633	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoahulin\54cf0e5d = e785b7201b72eee58190b54bcfbb19e577285daa35b5ef27e03d60730dd8cb94ed1f8bc1f06213c8f0118f243ebca5b7330b	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1600 rundll32.exe
1800 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1600 rundll32.exe
1800 regsvr32.exe

pid	process
1600	rundll32.exe
1800	regsvr32.exe

pid	process
1600	rundll32.exe
1800	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1112 wrote to memory of 1600	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1600	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1600	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1600	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1600	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1600	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1600	1112	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 588	1600	rundll32.exe	explorer.exe
PID 1600 wrote to memory of 588	1600	rundll32.exe	explorer.exe
PID 1600 wrote to memory of 588	1600	rundll32.exe	explorer.exe
PID 1600 wrote to memory of 588	1600	rundll32.exe	explorer.exe
PID 1600 wrote to memory of 588	1600	rundll32.exe	explorer.exe
PID 1600 wrote to memory of 588	1600	rundll32.exe	explorer.exe
PID 588 wrote to memory of 1412	588	explorer.exe	schtasks.exe
PID 588 wrote to memory of 1412	588	explorer.exe	schtasks.exe
PID 588 wrote to memory of 1412	588	explorer.exe	schtasks.exe
PID 588 wrote to memory of 1412	588	explorer.exe	schtasks.exe
PID 1944 wrote to memory of 1464	1944	taskeng.exe	regsvr32.exe
PID 1944 wrote to memory of 1464	1944	taskeng.exe	regsvr32.exe
PID 1944 wrote to memory of 1464	1944	taskeng.exe	regsvr32.exe
PID 1944 wrote to memory of 1464	1944	taskeng.exe	regsvr32.exe
PID 1944 wrote to memory of 1464	1944	taskeng.exe	regsvr32.exe
PID 1464 wrote to memory of 1800	1464	regsvr32.exe	regsvr32.exe
PID 1464 wrote to memory of 1800	1464	regsvr32.exe	regsvr32.exe
PID 1464 wrote to memory of 1800	1464	regsvr32.exe	regsvr32.exe
PID 1464 wrote to memory of 1800	1464	regsvr32.exe	regsvr32.exe
PID 1464 wrote to memory of 1800	1464	regsvr32.exe	regsvr32.exe
PID 1464 wrote to memory of 1800	1464	regsvr32.exe	regsvr32.exe
PID 1464 wrote to memory of 1800	1464	regsvr32.exe	regsvr32.exe
PID 1800 wrote to memory of 1000	1800	regsvr32.exe	explorer.exe
PID 1800 wrote to memory of 1000	1800	regsvr32.exe	explorer.exe
PID 1800 wrote to memory of 1000	1800	regsvr32.exe	explorer.exe
PID 1800 wrote to memory of 1000	1800	regsvr32.exe	explorer.exe
PID 1800 wrote to memory of 1000	1800	regsvr32.exe	explorer.exe
PID 1800 wrote to memory of 1000	1800	regsvr32.exe	explorer.exe
PID 1000 wrote to memory of 2036	1000	explorer.exe	reg.exe
PID 1000 wrote to memory of 2036	1000	explorer.exe	reg.exe
PID 1000 wrote to memory of 2036	1000	explorer.exe	reg.exe
PID 1000 wrote to memory of 2036	1000	explorer.exe	reg.exe
PID 1000 wrote to memory of 1920	1000	explorer.exe	reg.exe
PID 1000 wrote to memory of 1920	1000	explorer.exe	reg.exe
PID 1000 wrote to memory of 1920	1000	explorer.exe	reg.exe
PID 1000 wrote to memory of 1920	1000	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44483.6988947917.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44483.6988947917.dat.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:588

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rokksdsibw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44483.6988947917.dat.dll\"" /SC ONCE /Z /ST 14:40 /ET 14:52
4⤵
- Creates scheduled task(s)
PID:1412

C:\Windows\system32\taskeng.exe
taskeng.exe {2EA76543-D542-42A0-A993-B26BC77428E3} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44483.6988947917.dat.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\44483.6988947917.dat.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Lpveomsx" /d "0"
5⤵
PID:2036

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Yaxudxhd" /d "0"
5⤵
PID:1920

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44483.6988947917.dat.dll
MD5
9a5ce3ea1339e255ce078346d6dd0ef3

SHA1
24f55a887f02f1018a94212192f3ed9a71813c0d

SHA256
533a1afbe6fde892155eaa61a6bd0f612779290701cc6c391c4063ec6187c75d

SHA512
0c665ccd925711934841d77574850e9402bec35b6ff340bd671d48fa962d4efdbd125c96fa4c29d1251516523f77ad3bfd81d72a8b1b32f16ce03f68aac2caa6

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\44483.6988947917.dat.dll
MD5
9a5ce3ea1339e255ce078346d6dd0ef3

SHA1
24f55a887f02f1018a94212192f3ed9a71813c0d

SHA256
533a1afbe6fde892155eaa61a6bd0f612779290701cc6c391c4063ec6187c75d

SHA512
0c665ccd925711934841d77574850e9402bec35b6ff340bd671d48fa962d4efdbd125c96fa4c29d1251516523f77ad3bfd81d72a8b1b32f16ce03f68aac2caa6

Download Submit
memory/588-55-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/588-56-0x0000000000000000-mapping.dmp

Download
memory/588-60-0x0000000074201000-0x0000000074203000-memory.dmp

Filesize
8KB

Download
memory/588-62-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1000-75-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1000-70-0x0000000000000000-mapping.dmp

Download
memory/1412-61-0x0000000000000000-mapping.dmp

Download
memory/1464-63-0x0000000000000000-mapping.dmp

Download
memory/1464-64-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Filesize
8KB

Download
memory/1600-59-0x0000000010000000-0x000000001007F000-memory.dmp

Filesize
508KB

Download
memory/1600-53-0x0000000000000000-mapping.dmp

Download
memory/1600-58-0x0000000000150000-0x0000000000183000-memory.dmp

Filesize
204KB

Download
memory/1600-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1800-66-0x0000000000000000-mapping.dmp

Download
memory/1800-74-0x0000000010000000-0x000000001007F000-memory.dmp

Filesize
508KB

Download
memory/1800-73-0x00000000001C0000-0x00000000001F3000-memory.dmp

Filesize
204KB

Download
memory/1920-78-0x0000000000000000-mapping.dmp

Download
memory/2036-77-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads