qakbot | 5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88

General

Target

44487.6724652778.dat.dll
Size

689KB
MD5

932cf14b4f91d84439db9c977beee326
SHA1

e9eb1f908042d89d754e843b24b3f7b423fbff37
SHA256

5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88
SHA512

dc6428aa9f16f16d9880d75036a848331522bad5d91b5166ee4157240a05503ad515b4b303956ee80e6335b97c06a72d123b1777b4d5fc366a2ff1963aa97f95

Score

10^/10

qakbot obama117 1634545803 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama117

Campaign

1634545803

C2

176.45.53.222:443

220.255.25.28:2222

91.178.126.51:995

2.222.167.138:443

65.100.174.110:995

105.198.236.99:995

115.96.64.9:995

196.207.140.40:995

24.231.209.2:2222

146.66.238.74:443

103.82.211.39:995

65.100.174.110:443

103.142.10.177:443

140.82.49.12:443

78.105.213.151:995

41.86.42.158:995

89.101.97.139:443

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

720 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3188 schtasks.exe

pid	process
720	regsvr32.exe

pid	process
3188	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqlcyluiuxt\147b6c9a = 4fcc51be5063eaba94163bd69cc961a764325141d762a21dde1a08293109552627aa700ba8ba06c74ac85b737bf2b8e09bff2615d3a63011ac7ee5bdf2ec87d04f07d5125ea47c55a2eff51f495994b54d9ec968e0378331491756a08197a81529a9a8986f5f4338f9ce20ad	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqlcyluiuxt\ae862b83 = cbfa4d278217cbc8f56ff6c869dd6455336b0a40d528c70cfbda2a869bee8cd582d48f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqlcyluiuxt	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqlcyluiuxt\23a59ca8 = a26b86f913221a8c9974a5db211747b4c3d59528891a86cc295e15d2dac338796df9ec980fccf887a1c42afa6ba333a059bb45bd0e216033a6e5978e18f387cd216f977779d65fd3785f4deda762dcaa2e63a33cbfb1d102bbeb2a9c0c23a75874d1756638	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqlcyluiuxt\163a4ce6 = d9636102449523bf757da6bcd1079ff725271caeec1a273c89cc9f061bebba8f383ea084d0bff0cf740054e3f0c79e8e16adccca0a05264d02e47a2ee9fbb7cfdecc5446c6989666ebe392d6b03c0d19beb6a3c7e64bdd583e5ac122ab64e8f28fad7adf3ccfec45facf921130e0394c62f859da01a5c32a343f42d7e9d78afd98be70cdb27803e70e79eaea098a009fb56e08bd691aeb6e98818e1d6f75a40f7518064f149c00f197e1d9d0853f887726	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqlcyluiuxt\acc70bff = 4a8d6aa4e5129d17a9f70f27cd7e942ef3f25228f6c72c577641d170e388b9d4a8b01970b93faab475af23d81713c1391049d956129ad259c4770b1fbbfe77ad000aa08c6ce911cda42c2a70b5ec9973a7af540338d9002e5fc44b74967b4ae735f21e07	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqlcyluiuxt\d1cf4475 = 944f769a8da35d290f7d256ab0c19cb94bbbd6c1535711bf0c29e94539a6b76bace1094250cdba863449d2ffe9bdd459ffff087f0b7387845dd93ba0333d8785ed549bf484bc3b25da6314a6fc6e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqlcyluiuxt\69732310 = adb43f70ac3bde2fa552e6318c81522a49d986de45f238ee8c89ee1dfc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqlcyluiuxt\5cecf35e = d9ef606e9dd646229d477483bfce82b466d11d52a08a9f6749f43e15141ced9ccf333e14c67a5a8fd27edf00c7b2a85e61	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqlcyluiuxt\23a59ca8 = a26b91f913222f77c53d8136f92d27e8ded5b5d578aff894f4b9b324feff5bf4a5f38db2ff6cf7a864c30de6fb8d8fec8e7a4d0f58de95a7346e04bf9101943618527ebdfb73488afa8ba1102c2cdc4bce70cccae299c392a8a2edb968c6428821df22b4aa77f57123a1e4bcb614898910c8abb2aaf54171d011	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3168 rundll32.exe
3168 rundll32.exe
720 regsvr32.exe
720 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3168 rundll32.exe
720 regsvr32.exe

pid	process
3168	rundll32.exe
3168	rundll32.exe
720	regsvr32.exe
720	regsvr32.exe

pid	process
3168	rundll32.exe
720	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2168 wrote to memory of 3168	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 3168	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 3168	2168	rundll32.exe	rundll32.exe
PID 3168 wrote to memory of 1952	3168	rundll32.exe	explorer.exe
PID 3168 wrote to memory of 1952	3168	rundll32.exe	explorer.exe
PID 3168 wrote to memory of 1952	3168	rundll32.exe	explorer.exe
PID 3168 wrote to memory of 1952	3168	rundll32.exe	explorer.exe
PID 3168 wrote to memory of 1952	3168	rundll32.exe	explorer.exe
PID 1952 wrote to memory of 3188	1952	explorer.exe	schtasks.exe
PID 1952 wrote to memory of 3188	1952	explorer.exe	schtasks.exe
PID 1952 wrote to memory of 3188	1952	explorer.exe	schtasks.exe
PID 832 wrote to memory of 720	832	regsvr32.exe	regsvr32.exe
PID 832 wrote to memory of 720	832	regsvr32.exe	regsvr32.exe
PID 832 wrote to memory of 720	832	regsvr32.exe	regsvr32.exe
PID 720 wrote to memory of 1532	720	regsvr32.exe	explorer.exe
PID 720 wrote to memory of 1532	720	regsvr32.exe	explorer.exe
PID 720 wrote to memory of 1532	720	regsvr32.exe	explorer.exe
PID 720 wrote to memory of 1532	720	regsvr32.exe	explorer.exe
PID 720 wrote to memory of 1532	720	regsvr32.exe	explorer.exe
PID 1532 wrote to memory of 3112	1532	explorer.exe	reg.exe
PID 1532 wrote to memory of 3112	1532	explorer.exe	reg.exe
PID 1532 wrote to memory of 4036	1532	explorer.exe	reg.exe
PID 1532 wrote to memory of 4036	1532	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3168

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qvcetiyjsw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll\"" /SC ONCE /Z /ST 02:53 /ET 03:05
4⤵
- Creates scheduled task(s)
PID:3188

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:832

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:720

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Qaumqurqr" /d "0"
4⤵
PID:3112

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Nondanlipw" /d "0"
4⤵
PID:4036

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll
MD5
932cf14b4f91d84439db9c977beee326

SHA1
e9eb1f908042d89d754e843b24b3f7b423fbff37

SHA256
5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88

SHA512
dc6428aa9f16f16d9880d75036a848331522bad5d91b5166ee4157240a05503ad515b4b303956ee80e6335b97c06a72d123b1777b4d5fc366a2ff1963aa97f95

Download Submit
\Users\Admin\AppData\Local\Temp\44487.6724652778.dat.dll
MD5
932cf14b4f91d84439db9c977beee326

SHA1
e9eb1f908042d89d754e843b24b3f7b423fbff37

SHA256
5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88

SHA512
dc6428aa9f16f16d9880d75036a848331522bad5d91b5166ee4157240a05503ad515b4b303956ee80e6335b97c06a72d123b1777b4d5fc366a2ff1963aa97f95

Download Submit
memory/720-130-0x0000000072800000-0x00000000728BD000-memory.dmp

Filesize
756KB

Download
memory/720-126-0x0000000000000000-mapping.dmp

Download
memory/720-131-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download
memory/720-129-0x0000000072800000-0x0000000072821000-memory.dmp

Filesize
132KB

Download
memory/720-128-0x0000000072800000-0x00000000728BD000-memory.dmp

Filesize
756KB

Download
memory/1532-133-0x0000000002FB0000-0x0000000002FD1000-memory.dmp

Filesize
132KB

Download
memory/1532-132-0x0000000000000000-mapping.dmp

Download
memory/1532-137-0x0000000003A10000-0x0000000003A11000-memory.dmp

Filesize
4KB

Download
memory/1532-136-0x0000000003A10000-0x0000000003A11000-memory.dmp

Filesize
4KB

Download
memory/1952-122-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/1952-120-0x0000000000000000-mapping.dmp

Download
memory/1952-123-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/1952-124-0x0000000002800000-0x0000000002821000-memory.dmp

Filesize
132KB

Download
memory/3112-134-0x0000000000000000-mapping.dmp

Download
memory/3168-116-0x0000000073AE0000-0x0000000073B9D000-memory.dmp

Filesize
756KB

Download
memory/3168-115-0x0000000000000000-mapping.dmp

Download
memory/3168-119-0x0000000000FC0000-0x000000000110A000-memory.dmp

Filesize
1.3MB

Download
memory/3168-118-0x0000000073AE0000-0x0000000073B9D000-memory.dmp

Filesize
756KB

Download
memory/3168-117-0x0000000073AE0000-0x0000000073B01000-memory.dmp

Filesize
132KB

Download
memory/3188-121-0x0000000000000000-mapping.dmp

Download
memory/4036-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads