qakbot | 488aff5976e8fee5f941b9ad61214565723c5f7b324b5d26a978abd336d321da

General

Target

44487.5969353009.dat.dll
Size

689KB
MD5

89141c9ffcbb60880e8187aef83c935d
SHA1

d8f5e0e230889afdce67de83caf12122187887f2
SHA256

488aff5976e8fee5f941b9ad61214565723c5f7b324b5d26a978abd336d321da
SHA512

74f06f57bb72cb342ee6c8539bc3bf64e705f1157f6c7267925faec92db730ebbfc96abe4c9d5a0c9589c3a4d1761eaca049c36a9e2d003efee39f45f3b569ab

Score

10^/10

qakbot obama117 1634545803 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama117

Campaign

1634545803

C2

176.45.53.222:443

220.255.25.28:2222

91.178.126.51:995

2.222.167.138:443

65.100.174.110:995

105.198.236.99:995

115.96.64.9:995

196.207.140.40:995

24.231.209.2:2222

146.66.238.74:443

103.82.211.39:995

65.100.174.110:443

103.142.10.177:443

140.82.49.12:443

78.105.213.151:995

41.86.42.158:995

89.101.97.139:443

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

420 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4636 schtasks.exe

pid	process
420	regsvr32.exe

pid	process
4636	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouytvvk	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouytvvk\f9633e46 = f6d9e4eef0a315c30790105390c1737fea28b3f72825b32b167148d81f20546353720b098bfa811d13e544ada663ace7dc9d5914509971e7a0f5522613b90e2e4988f871d15bc7f7b65b0ea3b2420ffd479c505ae4ad53ed22fb09611035b587c863a55551c1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouytvvk\ccfcee08 = ade49b9faf09ef7b85be7a0c5a1f44c699be272c6ec013b7a74f32bea18e76b7946b18c2714f6b6042818a50031202345297743a1290e12a4190439d5431a9266f98b056673a43559f13fc765dbaae73dfcea771f64f6f65994959bfa49e9b1078c000176bd0ff9f9fcad0290617e45ec0dc5225501393582d980795c0655c63f16553b6cc2e0b8f0027e53b979713db0afcd3d6a70de423a79d604669d1f7d86e1fe037	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouytvvk\b09e69b = bc44f850c38f5e477d5bb4f6ea843f9ca8e8504f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouytvvk\862a51b0 = bbd09607df6c1b018158b4444ba9ac584b9774a56605becda4f78972a4bcc1be728ec201e2778459d08e883b43f73aa3cd977a4a461e5bb0069c5e3a871cfa3b09187bff6b988221	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouytvvk\f9633e46 = f6d9f3eef0a3200e90aa5ab114f2357aaed31cb4496874dbc3682fd0b46c8726390a8c2076c2af2a08b731e8d3d5ce32e3a44d18b6a51ca33c02c54e05a2c7bf086529e38eb436d288682bd903162a80b66aabe878921747bce8983e67cb32d3ecafff1c1ae24be508a7d97703801e00c92989d42a50c351d5c70c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouytvvk\cebdce74 = 712c3142379f7ee0bec1226e4d5369daf59b74e3dc4f6c6d86303d9a14	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouytvvk\7601a911 = be4c2094f22dc1e1033149b8782fc28bc25f13cb462cd8df63648f8a059f2e4029a907e803ec241d0f5710d919d5b4f54ea4a000072e166cf3343a3bc3546b08a5c5ce3c306e0017be32	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouytvvk\b3b581fe = 634a0bbb9b46bd6a7afb64ccf95051799b8b27fb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouytvvk\7440896d = cebbd34948742daf3e322cad0f963092c1567f36e8fc3aeed254740254e6c9ae4d57b498f90493eab5b07895066b17305f072d643be3c44132b5d090d040b25793b648980880ec94e80911acbdf511b4961cc43f9d9c45d2cd7348e1a7de3ba11906496e07eff50df4b0e015	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2012 rundll32.exe
2012 rundll32.exe
420 regsvr32.exe
420 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2012 rundll32.exe
420 regsvr32.exe

pid	process
2012	rundll32.exe
2012	rundll32.exe
420	regsvr32.exe
420	regsvr32.exe

pid	process
2012	rundll32.exe
420	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2324 wrote to memory of 2012	2324	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 2012	2324	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 2012	2324	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 4564	2012	rundll32.exe	explorer.exe
PID 2012 wrote to memory of 4564	2012	rundll32.exe	explorer.exe
PID 2012 wrote to memory of 4564	2012	rundll32.exe	explorer.exe
PID 2012 wrote to memory of 4564	2012	rundll32.exe	explorer.exe
PID 2012 wrote to memory of 4564	2012	rundll32.exe	explorer.exe
PID 4564 wrote to memory of 4636	4564	explorer.exe	schtasks.exe
PID 4564 wrote to memory of 4636	4564	explorer.exe	schtasks.exe
PID 4564 wrote to memory of 4636	4564	explorer.exe	schtasks.exe
PID 320 wrote to memory of 420	320	regsvr32.exe	regsvr32.exe
PID 320 wrote to memory of 420	320	regsvr32.exe	regsvr32.exe
PID 320 wrote to memory of 420	320	regsvr32.exe	regsvr32.exe
PID 420 wrote to memory of 1184	420	regsvr32.exe	explorer.exe
PID 420 wrote to memory of 1184	420	regsvr32.exe	explorer.exe
PID 420 wrote to memory of 1184	420	regsvr32.exe	explorer.exe
PID 420 wrote to memory of 1184	420	regsvr32.exe	explorer.exe
PID 420 wrote to memory of 1184	420	regsvr32.exe	explorer.exe
PID 1184 wrote to memory of 1372	1184	explorer.exe	reg.exe
PID 1184 wrote to memory of 1372	1184	explorer.exe	reg.exe
PID 1184 wrote to memory of 1600	1184	explorer.exe	reg.exe
PID 1184 wrote to memory of 1600	1184	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44487.5969353009.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44487.5969353009.dat.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4564

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ymksfbq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44487.5969353009.dat.dll\"" /SC ONCE /Z /ST 23:33 /ET 23:45
4⤵
- Creates scheduled task(s)
PID:4636

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44487.5969353009.dat.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\44487.5969353009.dat.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:420

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Iiqnvpt" /d "0"
4⤵
PID:1372

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Eopcjmwbf" /d "0"
4⤵
PID:1600

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44487.5969353009.dat.dll
MD5
89141c9ffcbb60880e8187aef83c935d

SHA1
d8f5e0e230889afdce67de83caf12122187887f2

SHA256
488aff5976e8fee5f941b9ad61214565723c5f7b324b5d26a978abd336d321da

SHA512
74f06f57bb72cb342ee6c8539bc3bf64e705f1157f6c7267925faec92db730ebbfc96abe4c9d5a0c9589c3a4d1761eaca049c36a9e2d003efee39f45f3b569ab

Download Submit
\Users\Admin\AppData\Local\Temp\44487.5969353009.dat.dll
MD5
89141c9ffcbb60880e8187aef83c935d

SHA1
d8f5e0e230889afdce67de83caf12122187887f2

SHA256
488aff5976e8fee5f941b9ad61214565723c5f7b324b5d26a978abd336d321da

SHA512
74f06f57bb72cb342ee6c8539bc3bf64e705f1157f6c7267925faec92db730ebbfc96abe4c9d5a0c9589c3a4d1761eaca049c36a9e2d003efee39f45f3b569ab

Download Submit
memory/420-130-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/420-128-0x0000000072580000-0x00000000725A1000-memory.dmp

Filesize
132KB

Download
memory/420-125-0x0000000000000000-mapping.dmp

Download
memory/420-129-0x0000000072580000-0x000000007263D000-memory.dmp

Filesize
756KB

Download
memory/420-127-0x0000000072580000-0x000000007263D000-memory.dmp

Filesize
756KB

Download
memory/1184-136-0x0000000000A10000-0x0000000000A31000-memory.dmp

Filesize
132KB

Download
memory/1184-134-0x00000000034A0000-0x00000000034A1000-memory.dmp

Filesize
4KB

Download
memory/1184-135-0x00000000034A0000-0x00000000034A1000-memory.dmp

Filesize
4KB

Download
memory/1184-131-0x0000000000000000-mapping.dmp

Download
memory/1372-132-0x0000000000000000-mapping.dmp

Download
memory/1600-133-0x0000000000000000-mapping.dmp

Download
memory/2012-115-0x0000000000000000-mapping.dmp

Download
memory/2012-116-0x0000000073860000-0x000000007391D000-memory.dmp

Filesize
756KB

Download
memory/2012-118-0x0000000073860000-0x000000007391D000-memory.dmp

Filesize
756KB

Download
memory/2012-117-0x0000000073860000-0x0000000073881000-memory.dmp

Filesize
132KB

Download
memory/2012-119-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/4564-123-0x0000000003450000-0x0000000003451000-memory.dmp

Filesize
4KB

Download
memory/4564-121-0x0000000000B20000-0x0000000000B41000-memory.dmp

Filesize
132KB

Download
memory/4564-120-0x0000000000000000-mapping.dmp

Download
memory/4636-122-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads