qakbot | 5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88

General

Target

44487.6724652778.dat.dll
Size

689KB
MD5

932cf14b4f91d84439db9c977beee326
SHA1

e9eb1f908042d89d754e843b24b3f7b423fbff37
SHA256

5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88
SHA512

dc6428aa9f16f16d9880d75036a848331522bad5d91b5166ee4157240a05503ad515b4b303956ee80e6335b97c06a72d123b1777b4d5fc366a2ff1963aa97f95

Score

10^/10

qakbot obama117 1634545803 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama117

Campaign

1634545803

C2

176.45.53.222:443

220.255.25.28:2222

91.178.126.51:995

2.222.167.138:443

65.100.174.110:995

105.198.236.99:995

115.96.64.9:995

196.207.140.40:995

24.231.209.2:2222

146.66.238.74:443

103.82.211.39:995

65.100.174.110:443

103.142.10.177:443

140.82.49.12:443

78.105.213.151:995

41.86.42.158:995

89.101.97.139:443

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

984 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1620 schtasks.exe

pid	process
984	regsvr32.exe

pid	process
1620	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uradcgzdlz\c2866974 = add5e3f712331ba178cf8e8744acd9b0c013a66c0c3c215869f0978fda3fd19a5415e13426251f6a995e60867cb38af2d41a3f7601373986b8544dc5719ea9a20a37285719a9ee952e2d36d657b72874c2bc0ed6d611d041c609e7c2bb0bf756	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uradcgzdlz\30ecb1a9 = a3602519411fd255fa91a47c26182f57be4bca08	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uradcgzdlz\4fa5de5f = b108becbe96cc05a043733c97208895180c43cdf2cad9c075c2e09c4a01598f5f99355505c41f5ad3597619c6341	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uradcgzdlz\7a3a0e11 = e0163d257a2c7c4d051afb98086e9e9bbe123603b86d0cd7bb1c5d2afe9759620bf376b2fd751abe257f5c18720e96bec848d9beb3a108ae16ba89ea67a4e18fdf33430602e31979bd9f8aed11151a90205d09e5582535fbaaabfbfc7ded1690420e42445db15efd348bd1245058ae988d3b91c9dfa0ac6d82b3abecac637e9d2447a402376b1f9aeeb8d65640e42950e510811e8a3bf59cfd48a5b53407fd40b002bd50fb4626e3af6f289c96	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uradcgzdlz\787b2e6d = e1f781baf204beab9630cc8465f1bfb9c1717cb2549316b6f12c856351a93b5e48ee28354033f1a2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uradcgzdlz\c0c74908 = 3e7a853d07608e519899b4c37cdfaa091659d7476bef70adccf3b754082dba302a367f10d0363ea507c9fef0ff0b825592235c229b4c163b08d17a23c76285b6732f0d3966e74ee4f0086a09d2095a75c5076d8d0f343fc22c2c6114369db6737d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uradcgzdlz\bdcf0682 = 75917b6a3db6e7033d268540662ce28388a974d23ebeeb39655a877dfe70aa198d6032b8da2770e2578d6e6f8110ee232caf356124cb0281b9d35b6599965fe3d43193b207ec49cb91ee4df3e34e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uradcgzdlz\57361e7 = 69efd54885328d0113a5f2f646b211b2bfce596ab20d6b6190be3cf91d0e817f429515dd0f87074e5ea01ad616bd76c35977ee859aeee582f01e45259dcf1662c7166b088a37803f3df49bd999e440360d30a844ce14319e2f504b161339260b805171f09baeeadcb4d22d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uradcgzdlz	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uradcgzdlz\4fa5de5f = b108a9cbe96cf572301c3471b6a54b6f3dc21f9b211d5b45a1	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1524 rundll32.exe
984 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1524 rundll32.exe
984 regsvr32.exe

pid	process
1524	rundll32.exe
984	regsvr32.exe

pid	process
1524	rundll32.exe
984	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1200 wrote to memory of 1524	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1524	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1524	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1524	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1524	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1524	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1524	1200	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 664	1524	rundll32.exe	explorer.exe
PID 1524 wrote to memory of 664	1524	rundll32.exe	explorer.exe
PID 1524 wrote to memory of 664	1524	rundll32.exe	explorer.exe
PID 1524 wrote to memory of 664	1524	rundll32.exe	explorer.exe
PID 1524 wrote to memory of 664	1524	rundll32.exe	explorer.exe
PID 1524 wrote to memory of 664	1524	rundll32.exe	explorer.exe
PID 664 wrote to memory of 1620	664	explorer.exe	schtasks.exe
PID 664 wrote to memory of 1620	664	explorer.exe	schtasks.exe
PID 664 wrote to memory of 1620	664	explorer.exe	schtasks.exe
PID 664 wrote to memory of 1620	664	explorer.exe	schtasks.exe
PID 1496 wrote to memory of 1152	1496	taskeng.exe	regsvr32.exe
PID 1496 wrote to memory of 1152	1496	taskeng.exe	regsvr32.exe
PID 1496 wrote to memory of 1152	1496	taskeng.exe	regsvr32.exe
PID 1496 wrote to memory of 1152	1496	taskeng.exe	regsvr32.exe
PID 1496 wrote to memory of 1152	1496	taskeng.exe	regsvr32.exe
PID 1152 wrote to memory of 984	1152	regsvr32.exe	regsvr32.exe
PID 1152 wrote to memory of 984	1152	regsvr32.exe	regsvr32.exe
PID 1152 wrote to memory of 984	1152	regsvr32.exe	regsvr32.exe
PID 1152 wrote to memory of 984	1152	regsvr32.exe	regsvr32.exe
PID 1152 wrote to memory of 984	1152	regsvr32.exe	regsvr32.exe
PID 1152 wrote to memory of 984	1152	regsvr32.exe	regsvr32.exe
PID 1152 wrote to memory of 984	1152	regsvr32.exe	regsvr32.exe
PID 984 wrote to memory of 1396	984	regsvr32.exe	explorer.exe
PID 984 wrote to memory of 1396	984	regsvr32.exe	explorer.exe
PID 984 wrote to memory of 1396	984	regsvr32.exe	explorer.exe
PID 984 wrote to memory of 1396	984	regsvr32.exe	explorer.exe
PID 984 wrote to memory of 1396	984	regsvr32.exe	explorer.exe
PID 984 wrote to memory of 1396	984	regsvr32.exe	explorer.exe
PID 1396 wrote to memory of 1632	1396	explorer.exe	reg.exe
PID 1396 wrote to memory of 1632	1396	explorer.exe	reg.exe
PID 1396 wrote to memory of 1632	1396	explorer.exe	reg.exe
PID 1396 wrote to memory of 1632	1396	explorer.exe	reg.exe
PID 1396 wrote to memory of 1056	1396	explorer.exe	reg.exe
PID 1396 wrote to memory of 1056	1396	explorer.exe	reg.exe
PID 1396 wrote to memory of 1056	1396	explorer.exe	reg.exe
PID 1396 wrote to memory of 1056	1396	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:664

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wppudnigju /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll\"" /SC ONCE /Z /ST 15:20 /ET 15:32
4⤵
- Creates scheduled task(s)
PID:1620

C:\Windows\system32\taskeng.exe
taskeng.exe {60394EFE-4B41-425C-A581-B74CF113542D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ubcynrk" /d "0"
5⤵
PID:1632

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Mlstkvc" /d "0"
5⤵
PID:1056

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll
MD5
932cf14b4f91d84439db9c977beee326

SHA1
e9eb1f908042d89d754e843b24b3f7b423fbff37

SHA256
5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88

SHA512
dc6428aa9f16f16d9880d75036a848331522bad5d91b5166ee4157240a05503ad515b4b303956ee80e6335b97c06a72d123b1777b4d5fc366a2ff1963aa97f95

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll
MD5
932cf14b4f91d84439db9c977beee326

SHA1
e9eb1f908042d89d754e843b24b3f7b423fbff37

SHA256
5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88

SHA512
dc6428aa9f16f16d9880d75036a848331522bad5d91b5166ee4157240a05503ad515b4b303956ee80e6335b97c06a72d123b1777b4d5fc366a2ff1963aa97f95

Download Submit
memory/664-61-0x00000000743A1000-0x00000000743A3000-memory.dmp

Filesize
8KB

Download
memory/664-63-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/664-58-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/664-59-0x0000000000000000-mapping.dmp

Download
memory/984-73-0x0000000073B50000-0x0000000073C0D000-memory.dmp

Filesize
756KB

Download
memory/984-68-0x0000000000000000-mapping.dmp

Download
memory/984-74-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/984-72-0x0000000073B50000-0x0000000073B71000-memory.dmp

Filesize
132KB

Download
memory/984-71-0x0000000073B50000-0x0000000073C0D000-memory.dmp

Filesize
756KB

Download
memory/1056-81-0x0000000000000000-mapping.dmp

Download
memory/1152-66-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Filesize
8KB

Download
memory/1152-65-0x0000000000000000-mapping.dmp

Download
memory/1396-76-0x0000000000000000-mapping.dmp

Download
memory/1396-82-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1524-56-0x00000000745A0000-0x00000000745C1000-memory.dmp

Filesize
132KB

Download
memory/1524-55-0x00000000745A0000-0x000000007465D000-memory.dmp

Filesize
756KB

Download
memory/1524-62-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/1524-53-0x0000000000000000-mapping.dmp

Download
memory/1524-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1524-57-0x00000000745A0000-0x000000007465D000-memory.dmp

Filesize
756KB

Download
memory/1620-64-0x0000000000000000-mapping.dmp

Download
memory/1632-80-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads