qakbot | 53214f4721ef1221632de09fd853580056811ac6632b517d77fb326956129530

General

Target

53214f4721ef1221632de09fd853580056811ac6632b517d77fb326956129530.dll
Size

789KB
MD5

5c5fa09c80be9c2ec065085baf78cc05
SHA1

276544ad61abcabf90a12211f8b6d1492b34187c
SHA256

53214f4721ef1221632de09fd853580056811ac6632b517d77fb326956129530
SHA512

d0e20ed5400af21fcfdbc9587386662a712182820be4bf6ac9a67974b34366b76a5eeebbb1f3f8eab9a0b7ef0e56edc3bcba7478ec27a723e8e0e6ed443c038f

Score

10^/10

qakbot obama149 1640166821 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama149

Campaign

1640166821

C2

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

24.53.49.240:443

94.200.181.154:995

149.135.101.20:443

67.209.195.198:443

209.210.95.228:32100

96.80.109.57:995

80.14.196.176:2222

38.70.253.226:2222

24.222.20.254:443

102.65.38.67:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1220 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

740 schtasks.exe

pid	process
1220	regsvr32.exe

pid	process
740	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Izipekssbcxygh	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Izipekssbcxygh\c01c0815 = 293d4906a87f7b68d722dda1fe97b0ed5baa26a1262af8f84bd18dec853022f3ea8bafd200e5894845a4487d10e39a340e8b7f5320d57ff2541badda0c2a3bcc3f16c93b5ec050f9546ee728944a4869fb1f1004c0a9c042c69b86c17d97523ca44a66a71c58d2940ca983e2ab39008976301a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Izipekssbcxygh\c25d2869 = 0b0473fd14fb450ee94f572af83ed9f6ead4e73b594582de6984c40d625f264dc335375f115dd0704a23fff622fa4aeac1fb3d9ddbdcd4ff432701	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Izipekssbcxygh\bf5567e3 = 891b866ff9e690b41c69a3d648277e3777fba0c9b3fc8c128941bcc566ad394c05603f68b1dd3ada11e24b4cee09a4af1592e75b3c8fc042d47c143947cd9bbb173e0348f0e02d1f8ea755d3dca2a1bb567c22c78020d32a6299	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Izipekssbcxygh\78a06f70 = bf16b09e7a215702572a77f07cd79a8aab55919197115b0f65440bd12da088fc2888174d9272e861f89c50e4da96eb3d0d8b8ab02b60e488f9f9c181c490f7916f9587a8493cc20713d0fad363f10b15a87ac0d77171f7c74bd15ade876d8877f6d34de22739c341789c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Izipekssbcxygh\8acab7ad = c1739d913117df7c571b938ee55db39a6263ef88a2dab9122f60cb55bf7e584aa7d309475420f8e05e86f87dacc5ba02fbb0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Izipekssbcxygh\f583d85b = 58cf76a9fc7e41d82c96bb9399926422de8f7edefccec2a9d99676853b7caa6014634677723b0f51624bc835f4f8fd43355b2891c562679b18abb2db6c12f86d3b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Izipekssbcxygh\7ae14f0c = 1816d0d6a9bfd44e8a058e51415db6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Izipekssbcxygh\7e90086 = baa69dc2415243722bcb27788599	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Izipekssbcxygh\f583d85b = 58cf61a9fc7e74cde717ec49b53974e32635a31d014d6de7527da2e4b47bb34f77202f670ff0f8e5538e4b2e4f8b631615813d7a58d53c4fdf777de2ae07256a053e6e37c8d345223ddd992c2c00327771140ca05872	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1668 rundll32.exe
1220 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1668 rundll32.exe
1220 regsvr32.exe

pid	process
1668	rundll32.exe
1220	regsvr32.exe

pid	process
1668	rundll32.exe
1220	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1584 wrote to memory of 1668	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1668	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1668	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1668	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1668	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1668	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1668	1584	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 1104	1668	rundll32.exe	explorer.exe
PID 1668 wrote to memory of 1104	1668	rundll32.exe	explorer.exe
PID 1668 wrote to memory of 1104	1668	rundll32.exe	explorer.exe
PID 1668 wrote to memory of 1104	1668	rundll32.exe	explorer.exe
PID 1668 wrote to memory of 1104	1668	rundll32.exe	explorer.exe
PID 1668 wrote to memory of 1104	1668	rundll32.exe	explorer.exe
PID 1104 wrote to memory of 740	1104	explorer.exe	schtasks.exe
PID 1104 wrote to memory of 740	1104	explorer.exe	schtasks.exe
PID 1104 wrote to memory of 740	1104	explorer.exe	schtasks.exe
PID 1104 wrote to memory of 740	1104	explorer.exe	schtasks.exe
PID 364 wrote to memory of 1208	364	taskeng.exe	regsvr32.exe
PID 364 wrote to memory of 1208	364	taskeng.exe	regsvr32.exe
PID 364 wrote to memory of 1208	364	taskeng.exe	regsvr32.exe
PID 364 wrote to memory of 1208	364	taskeng.exe	regsvr32.exe
PID 364 wrote to memory of 1208	364	taskeng.exe	regsvr32.exe
PID 1208 wrote to memory of 1220	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 1220	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 1220	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 1220	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 1220	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 1220	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 1220	1208	regsvr32.exe	regsvr32.exe
PID 1220 wrote to memory of 1864	1220	regsvr32.exe	explorer.exe
PID 1220 wrote to memory of 1864	1220	regsvr32.exe	explorer.exe
PID 1220 wrote to memory of 1864	1220	regsvr32.exe	explorer.exe
PID 1220 wrote to memory of 1864	1220	regsvr32.exe	explorer.exe
PID 1220 wrote to memory of 1864	1220	regsvr32.exe	explorer.exe
PID 1220 wrote to memory of 1864	1220	regsvr32.exe	explorer.exe
PID 1864 wrote to memory of 580	1864	explorer.exe	reg.exe
PID 1864 wrote to memory of 580	1864	explorer.exe	reg.exe
PID 1864 wrote to memory of 580	1864	explorer.exe	reg.exe
PID 1864 wrote to memory of 580	1864	explorer.exe	reg.exe
PID 1864 wrote to memory of 1440	1864	explorer.exe	reg.exe
PID 1864 wrote to memory of 1440	1864	explorer.exe	reg.exe
PID 1864 wrote to memory of 1440	1864	explorer.exe	reg.exe
PID 1864 wrote to memory of 1440	1864	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53214f4721ef1221632de09fd853580056811ac6632b517d77fb326956129530.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53214f4721ef1221632de09fd853580056811ac6632b517d77fb326956129530.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ritzkiz /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\53214f4721ef1221632de09fd853580056811ac6632b517d77fb326956129530.dll\"" /SC ONCE /Z /ST 09:02 /ET 09:14
4⤵
- Creates scheduled task(s)
PID:740

C:\Windows\system32\taskeng.exe
taskeng.exe {4A23D593-C8A5-4541-B0E7-74347B4F014C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:364

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\53214f4721ef1221632de09fd853580056811ac6632b517d77fb326956129530.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\53214f4721ef1221632de09fd853580056811ac6632b517d77fb326956129530.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Erorvvvmjx" /d "0"
5⤵
PID:580

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Nabzll" /d "0"
5⤵
PID:1440

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\53214f4721ef1221632de09fd853580056811ac6632b517d77fb326956129530.dll
MD5
5c5fa09c80be9c2ec065085baf78cc05

SHA1
276544ad61abcabf90a12211f8b6d1492b34187c

SHA256
53214f4721ef1221632de09fd853580056811ac6632b517d77fb326956129530

SHA512
d0e20ed5400af21fcfdbc9587386662a712182820be4bf6ac9a67974b34366b76a5eeebbb1f3f8eab9a0b7ef0e56edc3bcba7478ec27a723e8e0e6ed443c038f

Download Submit
\Users\Admin\AppData\Local\Temp\53214f4721ef1221632de09fd853580056811ac6632b517d77fb326956129530.dll
MD5
5c5fa09c80be9c2ec065085baf78cc05

SHA1
276544ad61abcabf90a12211f8b6d1492b34187c

SHA256
53214f4721ef1221632de09fd853580056811ac6632b517d77fb326956129530

SHA512
d0e20ed5400af21fcfdbc9587386662a712182820be4bf6ac9a67974b34366b76a5eeebbb1f3f8eab9a0b7ef0e56edc3bcba7478ec27a723e8e0e6ed443c038f

Download Submit
memory/580-85-0x0000000000000000-mapping.dmp

Download
memory/740-69-0x0000000000000000-mapping.dmp

Download
memory/1104-65-0x0000000000000000-mapping.dmp

Download
memory/1104-68-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1104-67-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1104-64-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/1208-71-0x000007FEFC3A1000-0x000007FEFC3A3000-memory.dmp

Filesize
8KB

Download
memory/1208-70-0x0000000000000000-mapping.dmp

Download
memory/1220-77-0x0000000000B70000-0x0000000000B91000-memory.dmp

Filesize
132KB

Download
memory/1220-80-0x0000000000B70000-0x0000000000B91000-memory.dmp

Filesize
132KB

Download
memory/1220-86-0x0000000000B70000-0x0000000000B91000-memory.dmp

Filesize
132KB

Download
memory/1220-79-0x0000000000B70000-0x0000000000B91000-memory.dmp

Filesize
132KB

Download
memory/1220-78-0x0000000000B70000-0x0000000000B91000-memory.dmp

Filesize
132KB

Download
memory/1220-76-0x0000000000940000-0x0000000000A08000-memory.dmp

Filesize
800KB

Download
memory/1220-73-0x0000000000000000-mapping.dmp

Download
memory/1440-88-0x0000000000000000-mapping.dmp

Download
memory/1668-59-0x0000000000220000-0x0000000000241000-memory.dmp

Filesize
132KB

Download
memory/1668-57-0x00000000006F0000-0x00000000007B8000-memory.dmp

Filesize
800KB

Download
memory/1668-58-0x0000000000220000-0x0000000000241000-memory.dmp

Filesize
132KB

Download
memory/1668-61-0x0000000000220000-0x0000000000241000-memory.dmp

Filesize
132KB

Download
memory/1668-55-0x0000000000000000-mapping.dmp

Download
memory/1668-60-0x0000000000220000-0x0000000000241000-memory.dmp

Filesize
132KB

Download
memory/1668-63-0x0000000000220000-0x0000000000241000-memory.dmp

Filesize
132KB

Download
memory/1668-56-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1668-62-0x0000000000860000-0x00000000008B1000-memory.dmp

Filesize
324KB

Download
memory/1864-82-0x0000000000000000-mapping.dmp

Download
memory/1864-87-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads