qakbot | 3a908f08980e39a5c28c3a4054d52a3e665bda9a40e933455dfbfb1d381ab615

General

Target

44488.7444002315.dat.dll
Size

1.6MB
MD5

0e18a845d89e72012291c7ab32c23690
SHA1

bc213bced327f24d1aecde5c940e6682033a093f
SHA256

3a908f08980e39a5c28c3a4054d52a3e665bda9a40e933455dfbfb1d381ab615
SHA512

606311833f08ed014e212b477aac2595ca0ad7df723ae369ceebe75273b08f8a961adf619793af31d82cc2072a1ca1939a3c265ba876e9cb0eb3ec53abc98be0

Score

10^/10

qakbot obama118 1634629572 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama118

Campaign

1634629572

C2

81.241.252.59:2078

78.105.213.151:995

77.57.204.78:443

37.210.155.239:995

93.48.58.123:2222

24.231.209.2:2222

146.66.238.74:443

65.100.174.110:443

140.82.49.12:443

187.75.66.160:995

41.86.42.158:995

120.150.218.241:995

73.151.236.31:443

81.250.153.227:2222

24.231.209.2:6881

174.54.193.186:443

136.232.34.70:443

76.25.142.196:443

78.191.38.33:995

117.215.227.142:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3440 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4024 schtasks.exe

pid	process
3440	regsvr32.exe

pid	process
4024	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rjfvuac\6a647ed8 = 8adfa91541520e207a5bdf670ea523280a293da4a9a88f6a950418d5fdb497ab0d19e28682b3435e5bea521b2a083f75fe2d653fded5476698a31ab95de14e57ccffb561bbb68b338f80a45c5891ccdc5c5f7429116dc4fc506a687514beb25f5637188e80da169c81623e779fc2d79b87c8977827a726f60ff7c0a0a83e82a117f0b8da468dc7f1ad9d55e40e64dd3ef23c9b1b1cc7d277892ed5bb8b4e89fb4a0df1a2819c163b3d715728a86e1cd28f38044d86698317f646214d0071c91b8a54a2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rjfvuac\d09939c1 = 84043458966c5b651c887d07bd20526993e9e04e7a1b76eeaa4d505a7b2a8d6ad1f9f846ec6a64a400fca087cac7dabc4ccbb5ba8481fd92ec724f5fea47a48d065c7bf3b66acf5c71e972612326a45f75e146ed84295ae4c668be720206b7d4cb7b52	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rjfvuac\ad91764b = 963496808b2d15a3e186c404cf61dd99152d97662c3feb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rjfvuac\152d112e = 4c45847a829b5c2ae5aa2d29ec009127906ff1b6d303dbde1962041285be66e84e7e547a77	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rjfvuac\5ffbae96 = 921a02f23c382e204fdeaeb5a8d5e4ee0e4f98d91be7b48fdfb3dbcd81a7071f2bd58039fa42d55ff5194792a12ab730de2f91	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rjfvuac	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rjfvuac\5ffbae96 = 921a15f23c381bd6dbce0cb0297e17c3723bdb958bd5401706e7ff2ac2e0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rjfvuac\68255ea4 = 9e75b24922729d7b1bb2775e69026a70107c4f401c4157f755c5051cab9c29a4231fbdeabf9201c2de695ba9e42e2348ed4cebdce2497e540a367969f4f836f84a53c430ce34778b4275bde5e2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rjfvuac\d2d819bd = 4de65787b49386ef06c35fb9590d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rjfvuac\20b2c160 = c2eeb8e8679f3f7f20d84f7431eaa032d54dcd853af4f01b38b2bbc763ed56d601ff06bf48cea264b3	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3016 rundll32.exe
3016 rundll32.exe
3440 regsvr32.exe
3440 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3016 rundll32.exe
3440 regsvr32.exe

pid	process
3016	rundll32.exe
3016	rundll32.exe
3440	regsvr32.exe
3440	regsvr32.exe

pid	process
3016	rundll32.exe
3440	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1556 wrote to memory of 3016	1556	rundll32.exe	rundll32.exe
PID 1556 wrote to memory of 3016	1556	rundll32.exe	rundll32.exe
PID 1556 wrote to memory of 3016	1556	rundll32.exe	rundll32.exe
PID 3016 wrote to memory of 3888	3016	rundll32.exe	explorer.exe
PID 3016 wrote to memory of 3888	3016	rundll32.exe	explorer.exe
PID 3016 wrote to memory of 3888	3016	rundll32.exe	explorer.exe
PID 3016 wrote to memory of 3888	3016	rundll32.exe	explorer.exe
PID 3016 wrote to memory of 3888	3016	rundll32.exe	explorer.exe
PID 3888 wrote to memory of 4024	3888	explorer.exe	schtasks.exe
PID 3888 wrote to memory of 4024	3888	explorer.exe	schtasks.exe
PID 3888 wrote to memory of 4024	3888	explorer.exe	schtasks.exe
PID 1300 wrote to memory of 3440	1300	regsvr32.exe	regsvr32.exe
PID 1300 wrote to memory of 3440	1300	regsvr32.exe	regsvr32.exe
PID 1300 wrote to memory of 3440	1300	regsvr32.exe	regsvr32.exe
PID 3440 wrote to memory of 436	3440	regsvr32.exe	explorer.exe
PID 3440 wrote to memory of 436	3440	regsvr32.exe	explorer.exe
PID 3440 wrote to memory of 436	3440	regsvr32.exe	explorer.exe
PID 3440 wrote to memory of 436	3440	regsvr32.exe	explorer.exe
PID 3440 wrote to memory of 436	3440	regsvr32.exe	explorer.exe
PID 436 wrote to memory of 3524	436	explorer.exe	reg.exe
PID 436 wrote to memory of 3524	436	explorer.exe	reg.exe
PID 436 wrote to memory of 1492	436	explorer.exe	reg.exe
PID 436 wrote to memory of 1492	436	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44488.7444002315.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44488.7444002315.dat.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3016

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3888

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn sbniobbpo /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44488.7444002315.dat.dll\"" /SC ONCE /Z /ST 15:33 /ET 15:45
4⤵
- Creates scheduled task(s)
PID:4024

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44488.7444002315.dat.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\44488.7444002315.dat.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3440

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:436

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Iorliqoiapy" /d "0"
4⤵
PID:3524

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Rptfhlk" /d "0"
4⤵
PID:1492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44488.7444002315.dat.dll
MD5
0e18a845d89e72012291c7ab32c23690

SHA1
bc213bced327f24d1aecde5c940e6682033a093f

SHA256
3a908f08980e39a5c28c3a4054d52a3e665bda9a40e933455dfbfb1d381ab615

SHA512
606311833f08ed014e212b477aac2595ca0ad7df723ae369ceebe75273b08f8a961adf619793af31d82cc2072a1ca1939a3c265ba876e9cb0eb3ec53abc98be0

Download Submit
\Users\Admin\AppData\Local\Temp\44488.7444002315.dat.dll
MD5
0e18a845d89e72012291c7ab32c23690

SHA1
bc213bced327f24d1aecde5c940e6682033a093f

SHA256
3a908f08980e39a5c28c3a4054d52a3e665bda9a40e933455dfbfb1d381ab615

SHA512
606311833f08ed014e212b477aac2595ca0ad7df723ae369ceebe75273b08f8a961adf619793af31d82cc2072a1ca1939a3c265ba876e9cb0eb3ec53abc98be0

Download Submit
memory/436-137-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Filesize
132KB

Download
memory/436-135-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/436-136-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/436-132-0x0000000000000000-mapping.dmp

Download
memory/1492-134-0x0000000000000000-mapping.dmp

Download
memory/3016-116-0x0000000073910000-0x0000000073AC6000-memory.dmp

Filesize
1.7MB

Download
memory/3016-118-0x0000000073910000-0x0000000073AC6000-memory.dmp

Filesize
1.7MB

Download
memory/3016-117-0x0000000073910000-0x0000000073931000-memory.dmp

Filesize
132KB

Download
memory/3016-119-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/3016-115-0x0000000000000000-mapping.dmp

Download
memory/3440-130-0x0000000072640000-0x00000000727F6000-memory.dmp

Filesize
1.7MB

Download
memory/3440-128-0x0000000072640000-0x00000000727F6000-memory.dmp

Filesize
1.7MB

Download
memory/3440-129-0x0000000072640000-0x0000000072661000-memory.dmp

Filesize
132KB

Download
memory/3440-126-0x0000000000000000-mapping.dmp

Download
memory/3440-131-0x00000000027C0000-0x00000000027C1000-memory.dmp

Filesize
4KB

Download
memory/3524-133-0x0000000000000000-mapping.dmp

Download
memory/3888-124-0x0000000003A70000-0x0000000003A71000-memory.dmp

Filesize
4KB

Download
memory/3888-123-0x0000000003A70000-0x0000000003A71000-memory.dmp

Filesize
4KB

Download
memory/3888-121-0x0000000001040000-0x0000000001061000-memory.dmp

Filesize
132KB

Download
memory/3888-120-0x0000000000000000-mapping.dmp

Download
memory/4024-122-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads