qakbot | 99c7d40784fe46cc9acd304219a554ce378b7832a602866e352d9562f191d703

General

Target

44484.6871458333.dat.dll
Size

905KB
MD5

028851f519f904c1f367dcc2f17612b4
SHA1

3b5f3470e00b8064d233a2e2fb8011d3474e7cd9
SHA256

99c7d40784fe46cc9acd304219a554ce378b7832a602866e352d9562f191d703
SHA512

6cb05daf1f132bec4c924104b66578033f4450d5af0e28b049c8f0c3476b5b65548e728d7a3bcb4e780a4c121e48329fefc1f07c5e1bb72218d64e60046e3d49

Score

10^/10

qakbot obama116 1634289383 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama116

Campaign

1634289383

C2

41.228.22.180:443

188.55.249.239:995

120.150.218.241:995

37.117.191.19:2222

68.204.7.158:443

81.241.252.59:2078

196.207.140.40:995

174.54.193.186:443

63.143.92.99:995

197.89.144.200:443

86.220.112.26:2222

73.52.50.32:443

103.82.211.39:465

146.66.238.74:443

167.248.117.81:443

2.222.167.138:443

181.118.183.94:443

103.82.211.39:995

78.179.137.102:995

89.137.52.44:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1916 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3988 schtasks.exe

pid	process
1916	regsvr32.exe

pid	process
3988	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aosgygimixe\33c0e185 = 43bb947d7ab8789cb95917527a87340fa3469579ff9a687a793d601673d500c3aaca0da136598f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aosgygimixe\33c0e185 = 43bb837d7ab84d332db18945dcc326177745	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aosgygimixe\65f31cb = 73b6a788a40a996fcf4df10eee8942a3ce33f318c4168cb2484e51320543d6560d036b3ee2af3c0e5705f18596188647652a3a7587a24b079a75f2bc39033e6d7dfc6fbebc5a95588930ead9ce2edb9be5ad13f9d59300a073be48d48ec7d140ac768526c9051b74c4b23f931db0c75ae3515f01a72cfa7b95dc703a5bb4907d91bc7c6b01807e82ac97eb26d5c4f53c5416dfe7cdb855	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aosgygimixe\41e11b7 = 8a8dfedca7d837cb7314f098a68818950cc900b702338b1b0e060b797e6be420cfad1257db50cc2f62d8fc98	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aosgygimixe\bca276d2 = 04786b5622424b1263bc9d2e4056ec54970b7cfb5b49b190dbc62815651ca01c35	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aosgygimixe\4c898e73 = 32fa5d00a337d2b12bbaea00518489bf8877301a119dfd8b3f8d67408c803d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aosgygimixe	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aosgygimixe\c1aa3958 = f42b051b778ebc533fc024812224639f8a6d5445aa3bf0ea4076e1df51abe881d07d311e40751ba79b8ab115b589f22e0db7759dcc058f7484737251fbe8203d3be6ca80c35358c4dbeef4752416eb7f34fda9d3fbc30030d9ade6a12982c41e5a8e9b11	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aosgygimixe\79165e3d = 3cb792159a25ecc81be7ed7ec15b20c57100b2d38b972ead1685a31325c9757f9341ab52cbcfba39dcc7ae	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aosgygimixe\bee356ae = a6866ff6a4740fdeaacb4d264f2a2e84e7c7aa94891b0b8ed4105897cea55576c9968c	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

752 rundll32.exe
752 rundll32.exe
1916 regsvr32.exe
1916 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

752 rundll32.exe
1916 regsvr32.exe

pid	process
752	rundll32.exe
752	rundll32.exe
1916	regsvr32.exe
1916	regsvr32.exe

pid	process
752	rundll32.exe
1916	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2632 wrote to memory of 752	2632	rundll32.exe	rundll32.exe
PID 2632 wrote to memory of 752	2632	rundll32.exe	rundll32.exe
PID 2632 wrote to memory of 752	2632	rundll32.exe	rundll32.exe
PID 752 wrote to memory of 1664	752	rundll32.exe	explorer.exe
PID 752 wrote to memory of 1664	752	rundll32.exe	explorer.exe
PID 752 wrote to memory of 1664	752	rundll32.exe	explorer.exe
PID 752 wrote to memory of 1664	752	rundll32.exe	explorer.exe
PID 752 wrote to memory of 1664	752	rundll32.exe	explorer.exe
PID 1664 wrote to memory of 3988	1664	explorer.exe	schtasks.exe
PID 1664 wrote to memory of 3988	1664	explorer.exe	schtasks.exe
PID 1664 wrote to memory of 3988	1664	explorer.exe	schtasks.exe
PID 644 wrote to memory of 1916	644	regsvr32.exe	regsvr32.exe
PID 644 wrote to memory of 1916	644	regsvr32.exe	regsvr32.exe
PID 644 wrote to memory of 1916	644	regsvr32.exe	regsvr32.exe
PID 1916 wrote to memory of 1344	1916	regsvr32.exe	explorer.exe
PID 1916 wrote to memory of 1344	1916	regsvr32.exe	explorer.exe
PID 1916 wrote to memory of 1344	1916	regsvr32.exe	explorer.exe
PID 1916 wrote to memory of 1344	1916	regsvr32.exe	explorer.exe
PID 1916 wrote to memory of 1344	1916	regsvr32.exe	explorer.exe
PID 1344 wrote to memory of 1420	1344	explorer.exe	reg.exe
PID 1344 wrote to memory of 1420	1344	explorer.exe	reg.exe
PID 1344 wrote to memory of 1700	1344	explorer.exe	reg.exe
PID 1344 wrote to memory of 1700	1344	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44484.6871458333.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44484.6871458333.dat.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn glbzqsqs /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44484.6871458333.dat.dll\"" /SC ONCE /Z /ST 15:46 /ET 15:58
4⤵
- Creates scheduled task(s)
PID:3988

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44484.6871458333.dat.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:644

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\44484.6871458333.dat.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Lofcnnao" /d "0"
4⤵
PID:1420

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Qmcyqjmyepa" /d "0"
4⤵
PID:1700

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44484.6871458333.dat.dll
MD5
028851f519f904c1f367dcc2f17612b4

SHA1
3b5f3470e00b8064d233a2e2fb8011d3474e7cd9

SHA256
99c7d40784fe46cc9acd304219a554ce378b7832a602866e352d9562f191d703

SHA512
6cb05daf1f132bec4c924104b66578033f4450d5af0e28b049c8f0c3476b5b65548e728d7a3bcb4e780a4c121e48329fefc1f07c5e1bb72218d64e60046e3d49

Download Submit
\Users\Admin\AppData\Local\Temp\44484.6871458333.dat.dll
MD5
028851f519f904c1f367dcc2f17612b4

SHA1
3b5f3470e00b8064d233a2e2fb8011d3474e7cd9

SHA256
99c7d40784fe46cc9acd304219a554ce378b7832a602866e352d9562f191d703

SHA512
6cb05daf1f132bec4c924104b66578033f4450d5af0e28b049c8f0c3476b5b65548e728d7a3bcb4e780a4c121e48329fefc1f07c5e1bb72218d64e60046e3d49

Download Submit
memory/752-116-0x0000000074320000-0x00000000744A5000-memory.dmp

Filesize
1.5MB

Download
memory/752-118-0x0000000074320000-0x00000000744A5000-memory.dmp

Filesize
1.5MB

Download
memory/752-117-0x0000000074320000-0x0000000074341000-memory.dmp

Filesize
132KB

Download
memory/752-119-0x0000000003290000-0x00000000033DA000-memory.dmp

Filesize
1.3MB

Download
memory/752-115-0x0000000000000000-mapping.dmp

Download
memory/1344-137-0x0000000002D30000-0x0000000002D51000-memory.dmp

Filesize
132KB

Download
memory/1344-136-0x0000000003690000-0x0000000003691000-memory.dmp

Filesize
4KB

Download
memory/1344-135-0x0000000003690000-0x0000000003691000-memory.dmp

Filesize
4KB

Download
memory/1344-132-0x0000000000000000-mapping.dmp

Download
memory/1420-133-0x0000000000000000-mapping.dmp

Download
memory/1664-120-0x0000000000000000-mapping.dmp

Download
memory/1664-124-0x0000000002F00000-0x0000000002F01000-memory.dmp

Filesize
4KB

Download
memory/1664-123-0x0000000002F00000-0x0000000002F01000-memory.dmp

Filesize
4KB

Download
memory/1664-121-0x00000000005D0000-0x00000000005F1000-memory.dmp

Filesize
132KB

Download
memory/1700-134-0x0000000000000000-mapping.dmp

Download
memory/1916-128-0x0000000073080000-0x0000000073205000-memory.dmp

Filesize
1.5MB

Download
memory/1916-129-0x0000000073080000-0x00000000730A1000-memory.dmp

Filesize
132KB

Download
memory/1916-130-0x0000000073080000-0x0000000073205000-memory.dmp

Filesize
1.5MB

Download
memory/1916-131-0x0000000002C40000-0x0000000002C41000-memory.dmp

Filesize
4KB

Download
memory/1916-126-0x0000000000000000-mapping.dmp

Download
memory/3988-122-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads