qakbot | 1391f43e8a0a46c8ea1fe17da52038405975d70ed24d0d5816ff405f62b1047a

General

Target

44540.5013858796.dat.dll
Size

789KB
MD5

30593b05921e0d869f766497b9a6f9da
SHA1

c0ac3dffa822c35df6d58a9df52b1176a69b0095
SHA256

1391f43e8a0a46c8ea1fe17da52038405975d70ed24d0d5816ff405f62b1047a
SHA512

76d1f5a1ac68ffa541fef8bae8e4153a3f3aad289e5226b9a31aae5196516746c0254298b5932e1911e3c9316b029ef37e1d6900d510ed6f120d3552f4d34087

Score

10^/10

qakbot obama149 1640166821 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama149

Campaign

1640166821

C2

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

24.53.49.240:443

94.200.181.154:995

149.135.101.20:443

67.209.195.198:443

209.210.95.228:32100

96.80.109.57:995

80.14.196.176:2222

38.70.253.226:2222

24.222.20.254:443

102.65.38.67:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1272 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1528 schtasks.exe

pid	process
1272	regsvr32.exe

pid	process
1528	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jthzouohemnv	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jthzouohemnv\448d4b3d = 5807575fdc429a0223f752cbd9e45ca9a75a25697ec205be5937c0574e31a25a807e5d8ec6200defd6a9772e46fd62e0b85a834e9c35c09e1bb09a99a685369071b36748bc1208ea36128eb8d549176493f85a1139e66d0ad6000a3f3c57b0d7421cd4940bcecd7770da4c3befd133	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jthzouohemnv\fe700c24 = da898306fd0619cf6e2ce7204dd6b6fe95cfcfd5fb7e1923c17b6c88650d2670b08644ad8de7c85868c06380ca661230e60f67cd0a2fef3808c5f8f22ed981916fb203f7a1bd5d688a1fc15789300ab0c14db991f30c9495053873dfb5cceb20c72fa212	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jthzouohemnv\837843ae = db230a6d5a51f4e5b11d946661f319a6341d5b5c8eba212e1ff5ba4cc2fc0b73a8ecfd0a02501e4288d72e2bace738d914f4223a5826dd8dab364d39220b1c68e4b75cfbcebd66a37857251d9b19e8703a2585dcfcbd479c7adf906f83673301d214	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jthzouohemnv\fc312c58 = 994d50049bf74ff29cb84aa17e747a94bb43f309e2f675049c8715	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jthzouohemnv\71129b73 = f6c0918fd5e33b2fc192b58cda8a7dacac2ef70d2aa082ffd552473f4272b6d3322d39a2873e2357424259f3aff5a18abb0d9e5aacf9e4e6f2f3d7111006b8adf11f99a39755e16f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jthzouohemnv\71129b73 = f6c0868fd5e30e481a0a627faf49d3ef4cbcbc60b31eaab2808150c9ecf32e5394df36b50ed3b99d1666a062c10f431e096c52	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jthzouohemnv\46cc6b41 = 3e9fc86b43903059b6df35eac98278fef71b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jthzouohemnv\3bc424cb = b6bc5b187b5a977293d46cfe69c033b3721cc38279	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jthzouohemnv\e5bf485 = 097ff1a6e8cc5277b49d0f961c4597119f7b271cb532595d4883488cdf50d183157235f720c1fc8ed43fe933c7e9f29551adf7f6d8457ad1d4619503ad4b5646077e0a4d211f2e3bffa6e85f46f5c887309521ed5d46ca6d	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1592 rundll32.exe
1272 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1592 rundll32.exe
1272 regsvr32.exe

pid	process
1592	rundll32.exe
1272	regsvr32.exe

pid	process
1592	rundll32.exe
1272	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 944 wrote to memory of 1592	944	rundll32.exe	rundll32.exe
PID 944 wrote to memory of 1592	944	rundll32.exe	rundll32.exe
PID 944 wrote to memory of 1592	944	rundll32.exe	rundll32.exe
PID 944 wrote to memory of 1592	944	rundll32.exe	rundll32.exe
PID 944 wrote to memory of 1592	944	rundll32.exe	rundll32.exe
PID 944 wrote to memory of 1592	944	rundll32.exe	rundll32.exe
PID 944 wrote to memory of 1592	944	rundll32.exe	rundll32.exe
PID 1592 wrote to memory of 428	1592	rundll32.exe	explorer.exe
PID 1592 wrote to memory of 428	1592	rundll32.exe	explorer.exe
PID 1592 wrote to memory of 428	1592	rundll32.exe	explorer.exe
PID 1592 wrote to memory of 428	1592	rundll32.exe	explorer.exe
PID 1592 wrote to memory of 428	1592	rundll32.exe	explorer.exe
PID 1592 wrote to memory of 428	1592	rundll32.exe	explorer.exe
PID 428 wrote to memory of 1528	428	explorer.exe	schtasks.exe
PID 428 wrote to memory of 1528	428	explorer.exe	schtasks.exe
PID 428 wrote to memory of 1528	428	explorer.exe	schtasks.exe
PID 428 wrote to memory of 1528	428	explorer.exe	schtasks.exe
PID 808 wrote to memory of 1876	808	taskeng.exe	regsvr32.exe
PID 808 wrote to memory of 1876	808	taskeng.exe	regsvr32.exe
PID 808 wrote to memory of 1876	808	taskeng.exe	regsvr32.exe
PID 808 wrote to memory of 1876	808	taskeng.exe	regsvr32.exe
PID 808 wrote to memory of 1876	808	taskeng.exe	regsvr32.exe
PID 1876 wrote to memory of 1272	1876	regsvr32.exe	regsvr32.exe
PID 1876 wrote to memory of 1272	1876	regsvr32.exe	regsvr32.exe
PID 1876 wrote to memory of 1272	1876	regsvr32.exe	regsvr32.exe
PID 1876 wrote to memory of 1272	1876	regsvr32.exe	regsvr32.exe
PID 1876 wrote to memory of 1272	1876	regsvr32.exe	regsvr32.exe
PID 1876 wrote to memory of 1272	1876	regsvr32.exe	regsvr32.exe
PID 1876 wrote to memory of 1272	1876	regsvr32.exe	regsvr32.exe
PID 1272 wrote to memory of 1700	1272	regsvr32.exe	explorer.exe
PID 1272 wrote to memory of 1700	1272	regsvr32.exe	explorer.exe
PID 1272 wrote to memory of 1700	1272	regsvr32.exe	explorer.exe
PID 1272 wrote to memory of 1700	1272	regsvr32.exe	explorer.exe
PID 1272 wrote to memory of 1700	1272	regsvr32.exe	explorer.exe
PID 1272 wrote to memory of 1700	1272	regsvr32.exe	explorer.exe
PID 1700 wrote to memory of 316	1700	explorer.exe	reg.exe
PID 1700 wrote to memory of 316	1700	explorer.exe	reg.exe
PID 1700 wrote to memory of 316	1700	explorer.exe	reg.exe
PID 1700 wrote to memory of 316	1700	explorer.exe	reg.exe
PID 1700 wrote to memory of 540	1700	explorer.exe	reg.exe
PID 1700 wrote to memory of 540	1700	explorer.exe	reg.exe
PID 1700 wrote to memory of 540	1700	explorer.exe	reg.exe
PID 1700 wrote to memory of 540	1700	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44540.5013858796.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44540.5013858796.dat.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:428

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xddultqm /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44540.5013858796.dat.dll\"" /SC ONCE /Z /ST 15:50 /ET 16:02
4⤵
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\taskeng.exe
taskeng.exe {88FC17C9-03DC-4E7F-9A46-58D0DD7FA4FC} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44540.5013858796.dat.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\44540.5013858796.dat.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Hcshu" /d "0"
5⤵
PID:316

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Posxiyjk" /d "0"
5⤵
PID:540

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44540.5013858796.dat.dll
MD5
30593b05921e0d869f766497b9a6f9da

SHA1
c0ac3dffa822c35df6d58a9df52b1176a69b0095

SHA256
1391f43e8a0a46c8ea1fe17da52038405975d70ed24d0d5816ff405f62b1047a

SHA512
76d1f5a1ac68ffa541fef8bae8e4153a3f3aad289e5226b9a31aae5196516746c0254298b5932e1911e3c9316b029ef37e1d6900d510ed6f120d3552f4d34087

Download Submit
\Users\Admin\AppData\Local\Temp\44540.5013858796.dat.dll
MD5
30593b05921e0d869f766497b9a6f9da

SHA1
c0ac3dffa822c35df6d58a9df52b1176a69b0095

SHA256
1391f43e8a0a46c8ea1fe17da52038405975d70ed24d0d5816ff405f62b1047a

SHA512
76d1f5a1ac68ffa541fef8bae8e4153a3f3aad289e5226b9a31aae5196516746c0254298b5932e1911e3c9316b029ef37e1d6900d510ed6f120d3552f4d34087

Download Submit
memory/316-85-0x0000000000000000-mapping.dmp

Download
memory/428-68-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/428-66-0x00000000748D1000-0x00000000748D3000-memory.dmp

Filesize
8KB

Download
memory/428-64-0x0000000000000000-mapping.dmp

Download
memory/428-63-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/540-86-0x0000000000000000-mapping.dmp

Download
memory/1272-75-0x00000000009B0000-0x0000000000A78000-memory.dmp

Filesize
800KB

Download
memory/1272-76-0x0000000000420000-0x0000000000441000-memory.dmp

Filesize
132KB

Download
memory/1272-77-0x0000000000420000-0x0000000000441000-memory.dmp

Filesize
132KB

Download
memory/1272-78-0x0000000000420000-0x0000000000441000-memory.dmp

Filesize
132KB

Download
memory/1272-79-0x0000000000420000-0x0000000000441000-memory.dmp

Filesize
132KB

Download
memory/1272-84-0x0000000000420000-0x0000000000441000-memory.dmp

Filesize
132KB

Download
memory/1272-72-0x0000000000000000-mapping.dmp

Download
memory/1528-67-0x0000000000000000-mapping.dmp

Download
memory/1592-61-0x0000000000590000-0x00000000005E1000-memory.dmp

Filesize
324KB

Download
memory/1592-62-0x0000000000390000-0x00000000003B1000-memory.dmp

Filesize
132KB

Download
memory/1592-54-0x0000000000000000-mapping.dmp

Download
memory/1592-60-0x0000000000390000-0x00000000003B1000-memory.dmp

Filesize
132KB

Download
memory/1592-59-0x0000000000390000-0x00000000003B1000-memory.dmp

Filesize
132KB

Download
memory/1592-58-0x0000000000390000-0x00000000003B1000-memory.dmp

Filesize
132KB

Download
memory/1592-57-0x0000000000390000-0x00000000003B1000-memory.dmp

Filesize
132KB

Download
memory/1592-56-0x00000000002C0000-0x0000000000388000-memory.dmp

Filesize
800KB

Download
memory/1592-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1700-81-0x0000000000000000-mapping.dmp

Download
memory/1700-87-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1876-70-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp

Filesize
8KB

Download
memory/1876-69-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads