qakbot | 5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88

General

Target

44487.6724652778.dat.dll
Size

689KB
MD5

932cf14b4f91d84439db9c977beee326
SHA1

e9eb1f908042d89d754e843b24b3f7b423fbff37
SHA256

5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88
SHA512

dc6428aa9f16f16d9880d75036a848331522bad5d91b5166ee4157240a05503ad515b4b303956ee80e6335b97c06a72d123b1777b4d5fc366a2ff1963aa97f95

Score

10^/10

qakbot obama117 1634545803 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama117

Campaign

1634545803

C2

176.45.53.222:443

220.255.25.28:2222

91.178.126.51:995

2.222.167.138:443

65.100.174.110:995

105.198.236.99:995

115.96.64.9:995

196.207.140.40:995

24.231.209.2:2222

146.66.238.74:443

103.82.211.39:995

65.100.174.110:443

103.142.10.177:443

140.82.49.12:443

78.105.213.151:995

41.86.42.158:995

89.101.97.139:443

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1556 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

896 schtasks.exe

pid	process
1556	regsvr32.exe

pid	process
896	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eunnfwwzhk\b1b30acc = 104bf311f6e65f5bb007d38ca2434c9214061c44fc9721e83dc0494f680ddd63058411d349a255874318f9845ec470099ef1622baef57a807befe25541c71b74fe894fb31f418a796891972358f8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eunnfwwzhk\90f6da9 = 363849d0b47a948bd4f5f2e1bcfecdd26518318ff95f669ebbed7f575c838728a5f3b8877007f54a6c8d032ce7661f82ef8e7c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eunnfwwzhk\74072223 = f517afd593861cdaf2d54f74feeb03c9fab8acdcca8abf8fe3f0165f74c5f485a020e9ee6792d6358272da768deb61460715	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eunnfwwzhk\b4e4dd5 = ce3eb225284fac5c862b0db1eea2794dd3463dc29c5867339550b770ba28d6bb787c8d0f761d03aa4008650e755e7794aba3c403ee4c4c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eunnfwwzhk\f9249508 = 61bd77053db6c188e20ad5d431657680e6df0e3dfec4e4baa790f54beceb431860a1de49c37c6d297d77a2e220423292294256d2c6a98e688a5d0f06988fa9a07b845c6e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eunnfwwzhk\866dfafe = c1e17e10c392ef9c70fcd632c495672029a2265c688bca4f86699f6bf96e53527f99bc3dafb527a91b238e70d5fc880e5c7afff016abb190897fbbcbde8f6d19eb15b5c5ee251f3e1d8578c1d5e4deab358adca5ad5133cb27a5ce0005f3	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eunnfwwzhk	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eunnfwwzhk\866dfafe = c1e16910c392da7596ac031eabad5d7355c135fdd328ce2fe15dce9ac7975b35dcf296f1611df6b21536f01e12a4f2836a789d43a735dabbb7f003661bc28ca880a1232617b2411b45	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eunnfwwzhk\b3f22ab0 = 5573732b5dd195a20e29de45086a179dbec0a87107b14bce5dd55c6e237f120044c4ad400439ec35308d4a625f0c37378f7661a600ee7966b8969329fd6cd33607731d6ae873f35e966facc853859dc6b6cd0edfc412b4db014ecb9cc0f637d64e894a2164d36185cb83f5339651dc13fc170d97e49025379c1880310722b492193206fc8e4cbe9e489f8f9f9cd2b6cd472e4333a649d898d9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eunnfwwzhk\ccbb4546 = fbbd03e20e3a678b03969679f54c49bd8061d97b8612bc123e7642dfc3ad10d2793d11069a6a9f96d91fb66ef9e422342bd42d8b6bec0edcb00c09ed441e612feefe3fcbad	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1816 rundll32.exe
1556 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1816 rundll32.exe
1556 regsvr32.exe

pid	process
1816	rundll32.exe
1556	regsvr32.exe

pid	process
1816	rundll32.exe
1556	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1728 wrote to memory of 1816	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1816	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1816	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1816	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1816	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1816	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1816	1728	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 576	1816	rundll32.exe	explorer.exe
PID 1816 wrote to memory of 576	1816	rundll32.exe	explorer.exe
PID 1816 wrote to memory of 576	1816	rundll32.exe	explorer.exe
PID 1816 wrote to memory of 576	1816	rundll32.exe	explorer.exe
PID 1816 wrote to memory of 576	1816	rundll32.exe	explorer.exe
PID 1816 wrote to memory of 576	1816	rundll32.exe	explorer.exe
PID 576 wrote to memory of 896	576	explorer.exe	schtasks.exe
PID 576 wrote to memory of 896	576	explorer.exe	schtasks.exe
PID 576 wrote to memory of 896	576	explorer.exe	schtasks.exe
PID 576 wrote to memory of 896	576	explorer.exe	schtasks.exe
PID 1768 wrote to memory of 1732	1768	taskeng.exe	regsvr32.exe
PID 1768 wrote to memory of 1732	1768	taskeng.exe	regsvr32.exe
PID 1768 wrote to memory of 1732	1768	taskeng.exe	regsvr32.exe
PID 1768 wrote to memory of 1732	1768	taskeng.exe	regsvr32.exe
PID 1768 wrote to memory of 1732	1768	taskeng.exe	regsvr32.exe
PID 1732 wrote to memory of 1556	1732	regsvr32.exe	regsvr32.exe
PID 1732 wrote to memory of 1556	1732	regsvr32.exe	regsvr32.exe
PID 1732 wrote to memory of 1556	1732	regsvr32.exe	regsvr32.exe
PID 1732 wrote to memory of 1556	1732	regsvr32.exe	regsvr32.exe
PID 1732 wrote to memory of 1556	1732	regsvr32.exe	regsvr32.exe
PID 1732 wrote to memory of 1556	1732	regsvr32.exe	regsvr32.exe
PID 1732 wrote to memory of 1556	1732	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 1896	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 1896	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 1896	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 1896	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 1896	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 1896	1556	regsvr32.exe	explorer.exe
PID 1896 wrote to memory of 1716	1896	explorer.exe	reg.exe
PID 1896 wrote to memory of 1716	1896	explorer.exe	reg.exe
PID 1896 wrote to memory of 1716	1896	explorer.exe	reg.exe
PID 1896 wrote to memory of 1716	1896	explorer.exe	reg.exe
PID 1896 wrote to memory of 1920	1896	explorer.exe	reg.exe
PID 1896 wrote to memory of 1920	1896	explorer.exe	reg.exe
PID 1896 wrote to memory of 1920	1896	explorer.exe	reg.exe
PID 1896 wrote to memory of 1920	1896	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lnxnzyo /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll\"" /SC ONCE /Z /ST 16:54 /ET 17:06
4⤵
- Creates scheduled task(s)
PID:896

C:\Windows\system32\taskeng.exe
taskeng.exe {5434FD8D-6E7E-43ED-B603-8B1C8AA0A61B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Cujafutpz" /d "0"
5⤵
PID:1716

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Buweqyqwbvn" /d "0"
5⤵
PID:1920

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll
MD5
932cf14b4f91d84439db9c977beee326

SHA1
e9eb1f908042d89d754e843b24b3f7b423fbff37

SHA256
5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88

SHA512
dc6428aa9f16f16d9880d75036a848331522bad5d91b5166ee4157240a05503ad515b4b303956ee80e6335b97c06a72d123b1777b4d5fc366a2ff1963aa97f95

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll
MD5
932cf14b4f91d84439db9c977beee326

SHA1
e9eb1f908042d89d754e843b24b3f7b423fbff37

SHA256
5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88

SHA512
dc6428aa9f16f16d9880d75036a848331522bad5d91b5166ee4157240a05503ad515b4b303956ee80e6335b97c06a72d123b1777b4d5fc366a2ff1963aa97f95

Download Submit
memory/576-63-0x0000000074541000-0x0000000074543000-memory.dmp

Filesize
8KB

Download
memory/576-65-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/576-59-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/576-60-0x0000000000000000-mapping.dmp

Download
memory/896-64-0x0000000000000000-mapping.dmp

Download
memory/1556-74-0x0000000073CF0000-0x0000000073DAD000-memory.dmp

Filesize
756KB

Download
memory/1556-72-0x0000000073CF0000-0x0000000073DAD000-memory.dmp

Filesize
756KB

Download
memory/1556-75-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1556-69-0x0000000000000000-mapping.dmp

Download
memory/1556-73-0x0000000073CF0000-0x0000000073D11000-memory.dmp

Filesize
132KB

Download
memory/1716-81-0x0000000000000000-mapping.dmp

Download
memory/1732-66-0x0000000000000000-mapping.dmp

Download
memory/1732-67-0x000007FEFB8C1000-0x000007FEFB8C3000-memory.dmp

Filesize
8KB

Download
memory/1816-57-0x0000000074740000-0x0000000074761000-memory.dmp

Filesize
132KB

Download
memory/1816-56-0x0000000074740000-0x00000000747FD000-memory.dmp

Filesize
756KB

Download
memory/1816-54-0x0000000000000000-mapping.dmp

Download
memory/1816-62-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1816-55-0x0000000075901000-0x0000000075903000-memory.dmp

Filesize
8KB

Download
memory/1816-58-0x0000000074740000-0x00000000747FD000-memory.dmp

Filesize
756KB

Download
memory/1896-77-0x0000000000000000-mapping.dmp

Download
memory/1896-83-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1920-82-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads