qakbot | 3cde8a896848e9c28ccfcc2db7812602143de7be90aa44fcfe83c85ac7e53f9b

Analysis

max time kernel
129s
max time network
118s
platform
windows7_x64
resource
win7-en-20211014
submitted
17/11/2021, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2021-11-15-Qakbot-DLL-from-80.71.158.152.bin.dll
Size 552KB
Sample211117-bvm8baddaj
SHA256 3cde8a896848e9c28ccfcc2db7812602143de7be90aa44fcfe83c85ac7e53f9b
MD5 13fc44f206bcd75d2880d39a22d777a3
SHA1 5cd8cc40a71dc9a2b5ea8b023cb6f8bdb1c16748
SHA512 3e12bed7857bf1c1395127caf5714ab5eb5a28216c4cd6b0e7aba2d5a7756619d88e21de9100a27b63492ad44bcf592b32266a902e26e1403196d5abe2d7f22d
MD5 SHA1 SHA512

Score

10^/10

qakbot obama128b 1636996378 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama128b

Campaign

1636996378

93.48.80.198:995
189.135.61.226:443
96.246.158.154:995
94.200.181.154:443
50.194.160.233:465
50.194.160.233:443
50.194.160.233:32100
24.229.150.54:995
140.82.49.12:443
108.4.67.252:443
136.143.11.232:443
109.177.77.68:995
181.118.183.27:443
24.55.112.61:443
109.12.111.14:443
216.238.71.31:443
190.229.18.108:465
188.50.23.59:995
120.150.218.241:995
89.101.97.139:443
45.9.20.200:2211
68.186.192.69:443
111.250.0.242:443
24.139.72.117:443
96.21.251.127:2222
102.65.38.57:443
86.98.3.14:443
91.178.126.51:995
41.228.22.180:443
100.1.119.41:443
81.250.153.227:2222
190.73.3.148:2222
68.204.7.158:443
72.252.201.34:995
216.238.71.31:995
216.238.72.121:995
216.238.72.121:443
117.198.148.69:443
71.74.12.34:443
136.232.34.70:443
65.100.174.110:8443
96.37.113.36:993
197.89.109.187:443
94.60.254.81:443
103.142.10.177:443
39.49.46.75:995
117.248.109.38:21
103.116.178.85:61200
207.246.112.221:995
207.246.112.221:443
220.255.25.187:2222
86.8.177.143:443
89.137.52.44:443
105.198.236.99:995
188.27.119.243:443
173.21.10.71:2222
123.252.190.14:443
162.244.227.45:443
73.151.236.31:443
76.25.142.196:443
176.63.117.1:22
75.66.88.33:443
41.37.255.56:443
86.173.96.86:443
187.121.88.3:995
45.46.53.140:2222
75.169.58.229:32100
72.252.201.34:465
78.153.126.175:443
86.97.160.193:443
78.191.22.144:995
206.47.134.234:2222
189.152.18.180:80
93.147.212.206:443
71.13.93.154:2083
178.239.56.80:443
27.223.92.142:995
63.143.92.99:995
189.147.225.12:443
75.188.35.168:443
103.150.40.76:995
189.223.33.109:443
71.13.93.154:6881
2.222.167.138:443
182.176.180.73:443
94.196.209.83:995
103.143.8.71:995
115.186.190.72:995
73.140.38.124:443
79.160.207.214:443
83.223.164.163:443
71.13.93.154:2222
115.96.64.9:995
146.66.139.84:443
103.116.178.85:993
67.165.206.193:993
94.110.12.148:995
189.146.127.83:443
93.48.58.123:2222
92.59.35.196:2222
109.133.93.127:995
80.6.192.58:443
109.228.255.59:443
176.35.109.202:2222
72.27.126.188:995
103.143.8.71:443
185.53.147.51:443
216.201.162.158:443
39.52.224.170:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
1592	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
916	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hgbaemcyccyze\c3620536 = 94a4cdf733731bfa837fcb675cc2991169e71068bab5980f3d9a0b98c12d88a05dcc9372b99f041e9c3c381ec39ef379f062da4c03054d6f21a0f4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hgbaemcyccyze\7bde6253 = 4521d5a6a89e729c56851a3c816f1a779a9cb940db05f2b4d095f443a0828014663fab2fa17b8ca8034a49137100d1e9a862edbc150adbca5fbb70e07e834e9759f3c62b464cde54b3eda8afa4f58ea1a0b7eb31aada05e57601fe36d551d11f70ff6eb3c5ce1eb6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hgbaemcyccyze\6d62dd9 = f8512fb418c000e1d3533476f6cbe9ac25140a04b324add9fbcfd2f62ea1c14a5ffd74305a46e4766d3614baca9c89b42c6f73ab58d10579	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hgbaemcyccyze\be6a4abc = aaa64a5207d182e169861c213bc7	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hgbaemcyccyze	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hgbaemcyccyze\f4bcf504 = 827e7fa1746c1ca143d340863cc3383718e76f9305334a3c10cc7daf0fc65a782f295eff11bfe32917dbeedaac2e4bd931e95f22c450a436c5a13243817f7cac	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hgbaemcyccyze\c123254a = 177d6a992c006f79959f19ac9dcd450032cba57a04be22ece9a887898d26899588fa6651a965e37c7be60ad1b63283541166d34d312ace1dac95ec378445329ee413cbe39efbf9c16e1b3eaf1d11089d1fb1905f73168bb50f61f358230a7fdd4f9e87f83493bc378996e6188435c4c7a06a348f54	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hgbaemcyccyze\799f422f = c22f647903a0764380d4662c5b3257239a47078c4a6ffb1ec71dab5ad762cbec3e03330155f899136a93ebbe4b468fcfb8758e9d4870b7ae83250aa343fedc9cf8a8ebc009962d3d5172865640c9600faf834e7362dc0cbb426cbc485278298f032c81181c78	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hgbaemcyccyze\8bf59af2 = f4b3ab9e2e5f2ec7d88b00a2d58952884db3eca60c87fe705cbe2c56dc741dd726378ab3e9b80bac4cd1a42a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hgbaemcyccyze\f4bcf504 = 827e68a1746c29d83031b1d8dc637b94af3a59f78b187567715cb491c2db59a8c88103fb9568dc5c0dd53c3860a36a4cf2b7d00e965b6b7b2c6d25b04a724392710642f651eb97c0e03a103509e3cb8236800eb89a	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
552	rundll32.exe
1592	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
552	rundll32.exe
1592	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 552	900	rundll32.exe	27
PID 900 wrote to memory of 552	900	rundll32.exe	27
PID 900 wrote to memory of 552	900	rundll32.exe	27
PID 900 wrote to memory of 552	900	rundll32.exe	27
PID 900 wrote to memory of 552	900	rundll32.exe	27
PID 900 wrote to memory of 552	900	rundll32.exe	27
PID 900 wrote to memory of 552	900	rundll32.exe	27
PID 552 wrote to memory of 820	552	rundll32.exe	29
PID 552 wrote to memory of 820	552	rundll32.exe	29
PID 552 wrote to memory of 820	552	rundll32.exe	29
PID 552 wrote to memory of 820	552	rundll32.exe	29
PID 552 wrote to memory of 820	552	rundll32.exe	29
PID 552 wrote to memory of 820	552	rundll32.exe	29
PID 820 wrote to memory of 916	820	explorer.exe	30
PID 820 wrote to memory of 916	820	explorer.exe	30
PID 820 wrote to memory of 916	820	explorer.exe	30
PID 820 wrote to memory of 916	820	explorer.exe	30
PID 1052 wrote to memory of 1384	1052	taskeng.exe	33
PID 1052 wrote to memory of 1384	1052	taskeng.exe	33
PID 1052 wrote to memory of 1384	1052	taskeng.exe	33
PID 1052 wrote to memory of 1384	1052	taskeng.exe	33
PID 1052 wrote to memory of 1384	1052	taskeng.exe	33
PID 1384 wrote to memory of 1592	1384	regsvr32.exe	34
PID 1384 wrote to memory of 1592	1384	regsvr32.exe	34
PID 1384 wrote to memory of 1592	1384	regsvr32.exe	34
PID 1384 wrote to memory of 1592	1384	regsvr32.exe	34
PID 1384 wrote to memory of 1592	1384	regsvr32.exe	34
PID 1384 wrote to memory of 1592	1384	regsvr32.exe	34
PID 1384 wrote to memory of 1592	1384	regsvr32.exe	34
PID 1592 wrote to memory of 976	1592	regsvr32.exe	35
PID 1592 wrote to memory of 976	1592	regsvr32.exe	35
PID 1592 wrote to memory of 976	1592	regsvr32.exe	35
PID 1592 wrote to memory of 976	1592	regsvr32.exe	35
PID 1592 wrote to memory of 976	1592	regsvr32.exe	35
PID 1592 wrote to memory of 976	1592	regsvr32.exe	35
PID 976 wrote to memory of 1268	976	explorer.exe	36
PID 976 wrote to memory of 1268	976	explorer.exe	36
PID 976 wrote to memory of 1268	976	explorer.exe	36
PID 976 wrote to memory of 1268	976	explorer.exe	36
PID 976 wrote to memory of 2012	976	explorer.exe	38
PID 976 wrote to memory of 2012	976	explorer.exe	38
PID 976 wrote to memory of 2012	976	explorer.exe	38
PID 976 wrote to memory of 2012	976	explorer.exe	38

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2021-11-15-Qakbot-DLL-from-80.71.158.152.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2021-11-15-Qakbot-DLL-from-80.71.158.152.bin.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xzbkcffxam /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\2021-11-15-Qakbot-DLL-from-80.71.158.152.bin.dll\"" /SC ONCE /Z /ST 02:26 /ET 02:38
      4⤵
      Creates scheduled task(s)
      PID:916

C:\Windows\system32\taskeng.exe
taskeng.exe {FA4120F3-703F-4A51-9267-379AD9CEA707} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\2021-11-15-Qakbot-DLL-from-80.71.158.152.bin.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\2021-11-15-Qakbot-DLL-from-80.71.158.152.bin.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:976
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ghiptcozki" /d "0"
        5⤵
        
        PID:1268
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Rzhyiwz" /d "0"
        5⤵
        
        PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/552-63-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/552-60-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/552-61-0x0000000000570000-0x0000000000590000-memory.dmp

Download

memory/552-62-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/552-59-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/552-64-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/552-58-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/552-56-0x0000000076431000-0x0000000076433000-memory.dmp

Download

memory/552-57-0x00000000001B0000-0x000000000023F000-memory.dmp

Download

memory/820-65-0x00000000000B0000-0x00000000000B2000-memory.dmp

Download

memory/820-69-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/820-68-0x0000000074651000-0x0000000074653000-memory.dmp

Download

memory/976-90-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/1384-72-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmp

Download

memory/1592-78-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/1592-81-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/1592-82-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/1592-80-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/1592-79-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/1592-77-0x0000000000170000-0x0000000000171000-memory.dmp

Download