qakbot | 42737acf7fb7d153217e694c2a1f7bb9c189c30ed96f0f0d465655cea46cde89

General

Target

44483.540521412.dat.dll
Size

500KB
MD5

d1265a257b2f72efaf9d62c0045c9b6e
SHA1

1d02ba044e633e673f08fbf400ad506c3031cff2
SHA256

42737acf7fb7d153217e694c2a1f7bb9c189c30ed96f0f0d465655cea46cde89
SHA512

8f47f8e288b21a05d0edb066036ed4df53940bd5993f3338c4559942a6257b0460848255b72cd0ee9fc0818af484311104431b52978afc2b4be4eaaae98af9a1

Score

10^/10

qakbot obama115 1634197867 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama115

Campaign

1634197867

C2

91.178.126.51:995

220.255.25.28:2222

208.78.220.143:443

77.31.162.93:443

73.230.205.91:443

216.201.162.158:443

94.200.181.154:443

24.231.209.2:2222

89.137.52.44:443

140.82.49.12:443

65.100.174.110:32103

41.86.42.158:995

27.223.92.142:995

200.232.214.222:995

81.250.153.227:2222

217.17.56.163:465

122.60.71.201:995

120.150.218.241:995

41.228.22.180:443

69.30.186.190:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1472 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

968 schtasks.exe

pid	process
1472	regsvr32.exe

pid	process
968	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pfvujvujaemy\41e40cb2 = 0afb825c32fd9e563e8c316bec2a06d8a733d770a024c1dc0124e758f8bbf4df5fec9aa09bbe7f6439094b224df8a9149735250bb9518b7c805d6baf4c8be62bcb5d0c8632b329cf73049ce7ca2042356a43d1f70c42aaee3859d4b904a53a265c337f6d63c3abe1b18d4be1cbce2519dce09b687e20ce7f5ff5080d33c752e55281	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pfvujvujaemy\b32b30a = e601325e282b5748da40e0174d9fa74783f29210512e5c8aa60c2a5c4fb82b6882ba6f4ee6fc91e0ce44c71d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pfvujvujaemy	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pfvujvujaemy\747bdcfc = 0cfbbea649b46685e9cd74e75b5941c9d674533603cd5d95311532214607075ce7f889c3d0d5d59ce797abf1c7440641aff919983e3d360d180ace3ced797ba307640de270064216b80ebaf42ea61b3beeb8c7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pfvujvujaemy\43a52cce = be29423a3c80398a537223c149fc86b57d74e44fb6db75f424d33bd801b05cbcc5bee575535dd9edef61a1ad3283caa987b5c71e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pfvujvujaemy\fb194bab = fcd4bf552ffded423606b6671e13632ecfe0b6647433a56da9cfba126d2d1820ae3acdb41262f772544ed82b64e5c7df82d471862250b4135d5cea1fb3988b4b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pfvujvujaemy\86110421 = 587cb84e94fb2eb46cdb08ae37bd9694cecc821df675093c32fe09c4051162dcf0d82e3c89ad10f401677fd350412b156b698f6f345ec5372291d35c3a98258cffafaeb51f9851cf824e31a7e4aa0c17e54687cf94cb7f1f664e32428fa4c60e2ec732	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pfvujvujaemy\3ead6344 = f8512706c1f3aedacc147946570db68abf2333de664d8dd8426d5fa037bac20ab17a067fe7ac168debf9b03681cb13ea0cda9be7cad879eacba51f17372abd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pfvujvujaemy\f9586bd7 = ce83a3709093df7bb6470f473587ac07a89ffa0ae976ef617f829f6f2375ad4d605842f2f3370e28c502c2b368c576851c4a8596e38f6f28eef8174b1712b66d0fbeee4a2325ef7ed548b3f8d240b71b99da7480c7ffc87c25ba4aa41af09b70b693fcb13c1e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pfvujvujaemy\747bdcfc = 0cfba9a649b453468686d25c5699199b770b56c90d2110503a26974f5fb56a2dd2cc5d28d061bef7205d6f90ac84674d7721815ac1f5c2df5289d169795a82a663bae59f2a067799cd4163e9864dc255fbf08a606e8eb69ed488f6f08287b59aa7e077445cf54e77	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2704 rundll32.exe
2704 rundll32.exe
1472 regsvr32.exe
1472 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2704 rundll32.exe
1472 regsvr32.exe

pid	process
2704	rundll32.exe
2704	rundll32.exe
1472	regsvr32.exe
1472	regsvr32.exe

pid	process
2704	rundll32.exe
1472	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1688 wrote to memory of 2704	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 2704	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 2704	1688	rundll32.exe	rundll32.exe
PID 2704 wrote to memory of 1332	2704	rundll32.exe	explorer.exe
PID 2704 wrote to memory of 1332	2704	rundll32.exe	explorer.exe
PID 2704 wrote to memory of 1332	2704	rundll32.exe	explorer.exe
PID 2704 wrote to memory of 1332	2704	rundll32.exe	explorer.exe
PID 2704 wrote to memory of 1332	2704	rundll32.exe	explorer.exe
PID 1332 wrote to memory of 968	1332	explorer.exe	schtasks.exe
PID 1332 wrote to memory of 968	1332	explorer.exe	schtasks.exe
PID 1332 wrote to memory of 968	1332	explorer.exe	schtasks.exe
PID 1748 wrote to memory of 1472	1748	regsvr32.exe	regsvr32.exe
PID 1748 wrote to memory of 1472	1748	regsvr32.exe	regsvr32.exe
PID 1748 wrote to memory of 1472	1748	regsvr32.exe	regsvr32.exe
PID 1472 wrote to memory of 936	1472	regsvr32.exe	explorer.exe
PID 1472 wrote to memory of 936	1472	regsvr32.exe	explorer.exe
PID 1472 wrote to memory of 936	1472	regsvr32.exe	explorer.exe
PID 1472 wrote to memory of 936	1472	regsvr32.exe	explorer.exe
PID 1472 wrote to memory of 936	1472	regsvr32.exe	explorer.exe
PID 936 wrote to memory of 976	936	explorer.exe	reg.exe
PID 936 wrote to memory of 976	936	explorer.exe	reg.exe
PID 936 wrote to memory of 1300	936	explorer.exe	reg.exe
PID 936 wrote to memory of 1300	936	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44483.540521412.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44483.540521412.dat.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2704

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yhrpbrclkt /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44483.540521412.dat.dll\"" /SC ONCE /Z /ST 06:40 /ET 06:52
4⤵
- Creates scheduled task(s)
PID:968

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44483.540521412.dat.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\44483.540521412.dat.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:936

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Vpailkt" /d "0"
4⤵
PID:976

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ytxwosqqy" /d "0"
4⤵
PID:1300

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44483.540521412.dat.dll
MD5
d1265a257b2f72efaf9d62c0045c9b6e

SHA1
1d02ba044e633e673f08fbf400ad506c3031cff2

SHA256
42737acf7fb7d153217e694c2a1f7bb9c189c30ed96f0f0d465655cea46cde89

SHA512
8f47f8e288b21a05d0edb066036ed4df53940bd5993f3338c4559942a6257b0460848255b72cd0ee9fc0818af484311104431b52978afc2b4be4eaaae98af9a1

Download Submit
\Users\Admin\AppData\Local\Temp\44483.540521412.dat.dll
MD5
d1265a257b2f72efaf9d62c0045c9b6e

SHA1
1d02ba044e633e673f08fbf400ad506c3031cff2

SHA256
42737acf7fb7d153217e694c2a1f7bb9c189c30ed96f0f0d465655cea46cde89

SHA512
8f47f8e288b21a05d0edb066036ed4df53940bd5993f3338c4559942a6257b0460848255b72cd0ee9fc0818af484311104431b52978afc2b4be4eaaae98af9a1

Download Submit
memory/936-127-0x0000000000000000-mapping.dmp

Download
memory/936-132-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Filesize
132KB

Download
memory/936-130-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/936-131-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/968-120-0x0000000000000000-mapping.dmp

Download
memory/976-128-0x0000000000000000-mapping.dmp

Download
memory/1300-129-0x0000000000000000-mapping.dmp

Download
memory/1332-119-0x00000000007B0000-0x00000000007D1000-memory.dmp

Filesize
132KB

Download
memory/1332-122-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1332-121-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1332-118-0x0000000000000000-mapping.dmp

Download
memory/1472-124-0x0000000000000000-mapping.dmp

Download
memory/1472-126-0x0000000003120000-0x000000000332E000-memory.dmp

Filesize
2.1MB

Download
memory/2704-115-0x0000000000000000-mapping.dmp

Download
memory/2704-116-0x0000000001020000-0x0000000001043000-memory.dmp

Filesize
140KB

Download
memory/2704-117-0x0000000010000000-0x000000001007F000-memory.dmp

Filesize
508KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads