qakbot | 41af67ae35a6f1aa2361e3e35ed02c78f6995067359a94c417488304f2744a63

General

Target

Celod.wac.dll
Size

825KB
MD5

7b1fcee11e42920b6922baaf43e48585
SHA1

b2c3040aeff1b37771b6bf8633a42fb14af8a4fe
SHA256

41af67ae35a6f1aa2361e3e35ed02c78f6995067359a94c417488304f2744a63
SHA512

46fa6b323bf3a5a99680facbe4d93cd78e51aeb902559d1f624ee8d30daea247d78c885d702b1e654c039e8eb96d4d42c68cc5ffdd7a586c7a51168f878c3829

Score

10^/10

qakbot obama111 1633590450 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama111

Campaign

1633590450

C2

37.210.152.224:995

201.93.111.2:995

202.134.178.157:443

89.101.97.139:443

73.52.50.32:443

188.55.235.110:995

27.223.92.142:995

181.118.183.94:443

136.232.34.70:443

186.32.163.199:443

72.173.78.211:443

76.25.142.196:443

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

188.50.169.158:443

174.54.193.186:443

103.148.120.144:443

140.82.49.12:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3892 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2708 schtasks.exe

pid	process
3892	regsvr32.exe

pid	process
2708	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xciigipat\e5e90e40 = 059e876caa732566e7100a03852b00415902a9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xciigipat\9aa061b6 = 70bd86983feaacda9bb79690cf108bee9d07da3e0d282de2e4c7b08aad09c90ed26d7b3154c0ed63457d6b24c33a	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xciigipat	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xciigipat\9aa061b6 = 70bd91983fea993334225add3bddf0709c5c68555b2f4e756b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xciigipat\af3fb1f8 = 65385a8427f5792ea78d624f3a7f046e1f6a878ad800d93b0c84e2a885693d9b95d9fb2e7a0a7161f4d2fed91e9b656652facdb04fa25841f1d72a6ece9429f656fe84a45618d5edc1f907c487af31013fddc5ee849215b81251727be95a9610ce54b766dbbfb7f202c5eada28c7f960f870a2813c4b24a4a7e97fbd862cf8e058e26d66d11704684ca1e0b30f21a93e52ad1011e5daaa0a221b72eb23da2a8b73fecac4e7810f5d7999603743d198	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xciigipat\ad7e9184 = 237736e7c66f1aac753765b821642b45cf49db32e11cc5d6fc00024b14c39e418341c571e2ab439a577618cf829e5b2508433b084265d450ee4741d35c0df411a5daf0ff1fce83c735f014ddcd6dc66c795394e00d921c43d2cf25c28ca89f324a5c92	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xciigipat\15c2f6e1 = 1e0c61347fbfc7a76b4c73a0e5fd29db03fd3b1528470c95dfc3abd3a0c3279583918a64a400bf887d9bed635fa300b136a2e01738a07e8c05543e20af9bcf330f9dec8695c6f31f71fa420570ffd45849a53cac2d753280352a24c03ba399beacd54b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xciigipat\68cab96b = 5d663e6d31a8749dbd5ef6f87aacb9cb2c793158a6facb15074245be504106280f557539b97a082a474e1ce60ebd8559716d84ff5939cfe4c22fe416ff78765a463fec560e29d0484a4b74b99e45c67df8f574b67e913d3af1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xciigipat\d076de0e = 03a122bac4ea438d6e02f916ef6480f346247933b7c5dfd0dbe391b9c92afba1b7b4e639cd7761efd50c89c18b4b09e836b2c00a1d82f6c642	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xciigipat\1783d69d = 144ec45fcabfaf2ee29614de2cb43f06baf1ef8589258d358bb3576c778ddb06fa83943a592660960b1ce91253975c6713e683ddd0b2f1a5beabc26e5e1c8f913bb202c4f1d3	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1120 rundll32.exe
1120 rundll32.exe
3892 regsvr32.exe
3892 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1120 rundll32.exe
3892 regsvr32.exe

pid	process
1120	rundll32.exe
1120	rundll32.exe
3892	regsvr32.exe
3892	regsvr32.exe

pid	process
1120	rundll32.exe
3892	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2960 wrote to memory of 1120	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 1120	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 1120	2960	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 3536	1120	rundll32.exe	explorer.exe
PID 1120 wrote to memory of 3536	1120	rundll32.exe	explorer.exe
PID 1120 wrote to memory of 3536	1120	rundll32.exe	explorer.exe
PID 1120 wrote to memory of 3536	1120	rundll32.exe	explorer.exe
PID 1120 wrote to memory of 3536	1120	rundll32.exe	explorer.exe
PID 3536 wrote to memory of 2708	3536	explorer.exe	schtasks.exe
PID 3536 wrote to memory of 2708	3536	explorer.exe	schtasks.exe
PID 3536 wrote to memory of 2708	3536	explorer.exe	schtasks.exe
PID 1728 wrote to memory of 3892	1728	regsvr32.exe	regsvr32.exe
PID 1728 wrote to memory of 3892	1728	regsvr32.exe	regsvr32.exe
PID 1728 wrote to memory of 3892	1728	regsvr32.exe	regsvr32.exe
PID 3892 wrote to memory of 3632	3892	regsvr32.exe	explorer.exe
PID 3892 wrote to memory of 3632	3892	regsvr32.exe	explorer.exe
PID 3892 wrote to memory of 3632	3892	regsvr32.exe	explorer.exe
PID 3892 wrote to memory of 3632	3892	regsvr32.exe	explorer.exe
PID 3892 wrote to memory of 3632	3892	regsvr32.exe	explorer.exe
PID 3632 wrote to memory of 3808	3632	explorer.exe	reg.exe
PID 3632 wrote to memory of 3808	3632	explorer.exe	reg.exe
PID 3632 wrote to memory of 3056	3632	explorer.exe	reg.exe
PID 3632 wrote to memory of 3056	3632	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Celod.wac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Celod.wac.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3536

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn tksftpsqjc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\Celod.wac.dll\"" /SC ONCE /Z /ST 00:03 /ET 00:15
4⤵
- Creates scheduled task(s)
PID:2708

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\Celod.wac.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\Celod.wac.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3892

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3632

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Jakjkuyfxf" /d "0"
4⤵
PID:3808

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Kxehhq" /d "0"
4⤵
PID:3056

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Celod.wac.dll
MD5
7b1fcee11e42920b6922baaf43e48585

SHA1
b2c3040aeff1b37771b6bf8633a42fb14af8a4fe

SHA256
41af67ae35a6f1aa2361e3e35ed02c78f6995067359a94c417488304f2744a63

SHA512
46fa6b323bf3a5a99680facbe4d93cd78e51aeb902559d1f624ee8d30daea247d78c885d702b1e654c039e8eb96d4d42c68cc5ffdd7a586c7a51168f878c3829

Download Submit
\Users\Admin\AppData\Local\Temp\Celod.wac.dll
MD5
7b1fcee11e42920b6922baaf43e48585

SHA1
b2c3040aeff1b37771b6bf8633a42fb14af8a4fe

SHA256
41af67ae35a6f1aa2361e3e35ed02c78f6995067359a94c417488304f2744a63

SHA512
46fa6b323bf3a5a99680facbe4d93cd78e51aeb902559d1f624ee8d30daea247d78c885d702b1e654c039e8eb96d4d42c68cc5ffdd7a586c7a51168f878c3829

Download Submit
memory/1120-116-0x0000000073BB0000-0x0000000073D20000-memory.dmp

Filesize
1.4MB

Download
memory/1120-118-0x0000000073BB0000-0x0000000073D20000-memory.dmp

Filesize
1.4MB

Download
memory/1120-117-0x0000000073BB0000-0x0000000073BD1000-memory.dmp

Filesize
132KB

Download
memory/1120-119-0x0000000002710000-0x000000000285A000-memory.dmp

Filesize
1.3MB

Download
memory/1120-115-0x0000000000000000-mapping.dmp

Download
memory/2708-121-0x0000000000000000-mapping.dmp

Download
memory/3056-134-0x0000000000000000-mapping.dmp

Download
memory/3536-120-0x0000000000000000-mapping.dmp

Download
memory/3536-123-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/3536-124-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Filesize
132KB

Download
memory/3536-122-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/3632-137-0x00000000003D0000-0x00000000003F1000-memory.dmp

Filesize
132KB

Download
memory/3632-136-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/3632-135-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/3632-132-0x0000000000000000-mapping.dmp

Download
memory/3808-133-0x0000000000000000-mapping.dmp

Download
memory/3892-128-0x0000000072890000-0x0000000072A00000-memory.dmp

Filesize
1.4MB

Download
memory/3892-131-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/3892-130-0x0000000072890000-0x0000000072A00000-memory.dmp

Filesize
1.4MB

Download
memory/3892-129-0x0000000072890000-0x00000000728B1000-memory.dmp

Filesize
132KB

Download
memory/3892-126-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads