qakbot | 5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88

General

Target

44487.6724652778.dat.dll
Size

689KB
MD5

932cf14b4f91d84439db9c977beee326
SHA1

e9eb1f908042d89d754e843b24b3f7b423fbff37
SHA256

5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88
SHA512

dc6428aa9f16f16d9880d75036a848331522bad5d91b5166ee4157240a05503ad515b4b303956ee80e6335b97c06a72d123b1777b4d5fc366a2ff1963aa97f95

Score

10^/10

qakbot obama117 1634545803 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama117

Campaign

1634545803

C2

176.45.53.222:443

220.255.25.28:2222

91.178.126.51:995

2.222.167.138:443

65.100.174.110:995

105.198.236.99:995

115.96.64.9:995

196.207.140.40:995

24.231.209.2:2222

146.66.238.74:443

103.82.211.39:995

65.100.174.110:443

103.142.10.177:443

140.82.49.12:443

78.105.213.151:995

41.86.42.158:995

89.101.97.139:443

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2544 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3600 schtasks.exe

pid	process
2544	regsvr32.exe

pid	process
3600	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Weyrzmbo\5f0c9314 = 11ddd431577369f52cd48e7c5c37e8e5765c0416803c89ec354bde2d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Weyrzmbo\e7b0f471 = 25f3586a07d115b1d8d8cea44ff8e3c065b054f9475a166e4559c7b4026103ffa1dbe7e07176f61476717e89878010651d5534841574	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Weyrzmbo\2045fce2 = 77f4f36a141324a78ecf0d600923f9b9157cc61450673abbc25cb25bd95220d529	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Weyrzmbo\ad664bc9 = 7a97ce8b6e7ff29e0fdebbc211d2fe7b06c7186e32916eff5d5dbf1aeea4485a011e020064f8cdbeb27667b50cc978	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Weyrzmbo\98f99b87 = de8d0bef57f5c5e998fd64096a5c1342a29d285ff50baead84c179c489b3c315ea1a3a101f372eb8159fb6f05cdcfddd25b3ed2d67a70e67339fc5019d690fe68f116b7bb01832ba27245c20f85e89ac6675e602377b5e5af5b981349e04efd9a6bb833968f20e7e9a386fcf47cef7aae583	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Weyrzmbo\9ab8bbfb = 6f97ba1ed00e61489959e931c8b97e648bb5618300f98cbc1a95b6206671eab6b44c02331ca71765b911b973c8fc5ae8102817cb09ba5a39f3fe3a1b59235a71	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Weyrzmbo\ad664bc9 = 7a97d98b6e7fc7b8a19c672fece05710db5f98325de891fabaf3cf894a08dc1182592d4cb9a4b3ad763e9d8fb0f0ad4259be36e2494db75c217f1f6bfc10c51a71e13e7b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Weyrzmbo	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Weyrzmbo\2204dc9e = 6cb50f8afee64cd31ad0e5b3ac893fcb4e706c471805307497fdd0ff52750b46bbd60dc22a0cbb776f9a7f705285a7d1e1a0216bc996e557ac028eb0bcf0d14af8da8fe1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Weyrzmbo\d22f243f = a50209c227305cba3ba6613eb343e6ceeab606c948a5fdc3bd7a7d2cd2a0053beeb97789e136be3d90b9ec9e622c874f5b2cfadd972b073b58364b7f7121c3b6ce3085728bd7703c15df2fcc547d0b9d8beef2b17bf8d4632556bdaab5e5a825	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3348 rundll32.exe
3348 rundll32.exe
2544 regsvr32.exe
2544 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3348 rundll32.exe
2544 regsvr32.exe

pid	process
3348	rundll32.exe
3348	rundll32.exe
2544	regsvr32.exe
2544	regsvr32.exe

pid	process
3348	rundll32.exe
2544	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2168 wrote to memory of 3348	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 3348	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 3348	2168	rundll32.exe	rundll32.exe
PID 3348 wrote to memory of 2124	3348	rundll32.exe	explorer.exe
PID 3348 wrote to memory of 2124	3348	rundll32.exe	explorer.exe
PID 3348 wrote to memory of 2124	3348	rundll32.exe	explorer.exe
PID 3348 wrote to memory of 2124	3348	rundll32.exe	explorer.exe
PID 3348 wrote to memory of 2124	3348	rundll32.exe	explorer.exe
PID 2124 wrote to memory of 3600	2124	explorer.exe	schtasks.exe
PID 2124 wrote to memory of 3600	2124	explorer.exe	schtasks.exe
PID 2124 wrote to memory of 3600	2124	explorer.exe	schtasks.exe
PID 2632 wrote to memory of 2544	2632	regsvr32.exe	regsvr32.exe
PID 2632 wrote to memory of 2544	2632	regsvr32.exe	regsvr32.exe
PID 2632 wrote to memory of 2544	2632	regsvr32.exe	regsvr32.exe
PID 2544 wrote to memory of 2624	2544	regsvr32.exe	explorer.exe
PID 2544 wrote to memory of 2624	2544	regsvr32.exe	explorer.exe
PID 2544 wrote to memory of 2624	2544	regsvr32.exe	explorer.exe
PID 2544 wrote to memory of 2624	2544	regsvr32.exe	explorer.exe
PID 2544 wrote to memory of 2624	2544	regsvr32.exe	explorer.exe
PID 2624 wrote to memory of 3916	2624	explorer.exe	reg.exe
PID 2624 wrote to memory of 3916	2624	explorer.exe	reg.exe
PID 2624 wrote to memory of 952	2624	explorer.exe	reg.exe
PID 2624 wrote to memory of 952	2624	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3348

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yrlvdtmbwu /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll\"" /SC ONCE /Z /ST 02:53 /ET 03:05
4⤵
- Creates scheduled task(s)
PID:3600

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2632

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2544

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2624

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Nuhnu" /d "0"
4⤵
PID:3916

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ydyghsnbucy" /d "0"
4⤵
PID:952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll
MD5
932cf14b4f91d84439db9c977beee326

SHA1
e9eb1f908042d89d754e843b24b3f7b423fbff37

SHA256
5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88

SHA512
dc6428aa9f16f16d9880d75036a848331522bad5d91b5166ee4157240a05503ad515b4b303956ee80e6335b97c06a72d123b1777b4d5fc366a2ff1963aa97f95

Download Submit
\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll
MD5
932cf14b4f91d84439db9c977beee326

SHA1
e9eb1f908042d89d754e843b24b3f7b423fbff37

SHA256
5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88

SHA512
dc6428aa9f16f16d9880d75036a848331522bad5d91b5166ee4157240a05503ad515b4b303956ee80e6335b97c06a72d123b1777b4d5fc366a2ff1963aa97f95

Download Submit
memory/952-134-0x0000000000000000-mapping.dmp

Download
memory/2124-120-0x0000000000000000-mapping.dmp

Download
memory/2124-123-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/2124-124-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/2124-121-0x0000000000370000-0x0000000000391000-memory.dmp

Filesize
132KB

Download
memory/2544-131-0x00000000004A0000-0x000000000054E000-memory.dmp

Filesize
696KB

Download
memory/2544-129-0x0000000072800000-0x0000000072821000-memory.dmp

Filesize
132KB

Download
memory/2544-130-0x0000000072800000-0x00000000728BD000-memory.dmp

Filesize
756KB

Download
memory/2544-128-0x0000000072800000-0x00000000728BD000-memory.dmp

Filesize
756KB

Download
memory/2544-126-0x0000000000000000-mapping.dmp

Download
memory/2624-132-0x0000000000000000-mapping.dmp

Download
memory/2624-135-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2624-136-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2624-137-0x0000000000870000-0x0000000000891000-memory.dmp

Filesize
132KB

Download
memory/3348-117-0x0000000073AE0000-0x0000000073B01000-memory.dmp

Filesize
132KB

Download
memory/3348-118-0x0000000073AE0000-0x0000000073B9D000-memory.dmp

Filesize
756KB

Download
memory/3348-115-0x0000000000000000-mapping.dmp

Download
memory/3348-119-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/3348-116-0x0000000073AE0000-0x0000000073B9D000-memory.dmp

Filesize
756KB

Download
memory/3600-122-0x0000000000000000-mapping.dmp

Download
memory/3916-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads