qakbot | 17d57c8aa7536959e45dd55a6cae0b9b0c64c02f7a6b7545c2b5b1e350e70bd7

General

Target

17d57c8aa7536959e45dd55a6cae0b9b0c64c02f7a6b7545c2b5b1e350e70bd7.bin.dll
Size

789KB
MD5

69063f91e6dfb8f69722e871d5dbf802
SHA1

69530e80946049ad0637e5bee82d0932a7f2831e
SHA256

17d57c8aa7536959e45dd55a6cae0b9b0c64c02f7a6b7545c2b5b1e350e70bd7
SHA512

c136654d600e270ef5071e7cb675d65103c353802b2f59766488d451ad72fa60dd65562580e9d6b444bd57291b12eef938f5049e86cc8e3568c198310772364a

Score

10^/10

qakbot obama149 1640166821 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama149

Campaign

1640166821

C2

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

24.53.49.240:443

94.200.181.154:995

149.135.101.20:443

67.209.195.198:443

209.210.95.228:32100

96.80.109.57:995

80.14.196.176:2222

38.70.253.226:2222

24.222.20.254:443

102.65.38.67:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

984 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1680 schtasks.exe

pid	process
984	regsvr32.exe

pid	process
1680	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fyfuftrmegofvp\d8fee52d = 2f75b358ac30125151d9eb1c7b36a90d19396d43842012bee4534df9fe5d0b6fcd969ce9710f8e4eab9e59a9d7d6f53f50eef9656b2c847460981b38af484b88d809fa03b5f7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fyfuftrmegofvp\a5f6aaa7 = 4ecb165dcf79740658dcaf77adcc279c65ffe3510534a0caeb498014c2b059f13d152d921b85d2bd24e5871fa754779af0b98500ce11577fbc72cebfe09dd718	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fyfuftrmegofvp\1d4acdc2 = 2eb5e15f024f8864fdb7bbf1921330eb8ec4ceb7682c1d3ca39127448895e41a1557022ebf4299e11508ee452c1758bb4300b541d57bd2dec9a8e2f214015b87da536e37cdce31c44e85c23e8702591a8de9283d83e8a5f8c185333f21c49537f6edd3e59df970	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fyfuftrmegofvp\a7b78adb = 73417055a5aac42743162190f40dbbf64e0d3991910193656bc10b71631f66823e91815e72283a347fe6aaa9407465522e4346901cc11d8cbc62a39c470783c7538df15f1d97fb974ff086aa4af95418e02ffb339f144eaee4e80cdb3e16f7d8220f7f9e0e5745aae00dc72d1280e60164f4c10badfe5b4384a9184c2122f6959430a1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fyfuftrmegofvp\60428248 = 22084032d8a870d2962113bbcfbc1946ccb98dface96155fe82232b4a639709eb3c2fa72be3e5756498205442c3332da8e59b6614e65196166b278c23108618417178ff8c1e999ae32e522fccf8dcff17e050035b6ab61a71363bf6c4f2af3a23d58b4fd30afa3f67bfd3260	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fyfuftrmegofvp\1f0bedbe = f781f9d14ae8b3effcce5ade846d4c1c429612f1de603c652702f0f36161fdcc145a70d4e9fc6f807193598548f020c191998f2630b510d87dcd9437a2370e5a14b082f426b5f118be0b537828	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fyfuftrmegofvp\ed613563 = 258928a3b053bcf1063c1ccfa2856165c9701a9a0f711de97f4957440c6b787121552b9fcd794c940e87345457c4a9d7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fyfuftrmegofvp\92285a95 = 4bcde0d4a4ce22ce24fb87aff0aeb52ede529daf71131a32d99e7bd189a8eb690624f6fc371537a6c18eb7c211b632dcb98ca49ed0989f751b7f72357df367c86bc6e4aede92c17784d8bd81219890ac8e1d17	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fyfuftrmegofvp	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fyfuftrmegofvp\92285a95 = 4bcdf7d4a4ce1751de082863c733a7b82b7e71cbe0c432e9a1038ea60faeec901a4df159f0881aced99502fa3828b3185555321f73187ed60f955bf1e150	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1176 rundll32.exe
984 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1176 rundll32.exe
984 regsvr32.exe

pid	process
1176	rundll32.exe
984	regsvr32.exe

pid	process
1176	rundll32.exe
984	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1144 wrote to memory of 1176	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1176	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1176	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1176	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1176	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1176	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1176	1144	rundll32.exe	rundll32.exe
PID 1176 wrote to memory of 868	1176	rundll32.exe	explorer.exe
PID 1176 wrote to memory of 868	1176	rundll32.exe	explorer.exe
PID 1176 wrote to memory of 868	1176	rundll32.exe	explorer.exe
PID 1176 wrote to memory of 868	1176	rundll32.exe	explorer.exe
PID 1176 wrote to memory of 868	1176	rundll32.exe	explorer.exe
PID 1176 wrote to memory of 868	1176	rundll32.exe	explorer.exe
PID 868 wrote to memory of 1680	868	explorer.exe	schtasks.exe
PID 868 wrote to memory of 1680	868	explorer.exe	schtasks.exe
PID 868 wrote to memory of 1680	868	explorer.exe	schtasks.exe
PID 868 wrote to memory of 1680	868	explorer.exe	schtasks.exe
PID 1580 wrote to memory of 1652	1580	taskeng.exe	regsvr32.exe
PID 1580 wrote to memory of 1652	1580	taskeng.exe	regsvr32.exe
PID 1580 wrote to memory of 1652	1580	taskeng.exe	regsvr32.exe
PID 1580 wrote to memory of 1652	1580	taskeng.exe	regsvr32.exe
PID 1580 wrote to memory of 1652	1580	taskeng.exe	regsvr32.exe
PID 1652 wrote to memory of 984	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 984	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 984	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 984	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 984	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 984	1652	regsvr32.exe	regsvr32.exe
PID 1652 wrote to memory of 984	1652	regsvr32.exe	regsvr32.exe
PID 984 wrote to memory of 860	984	regsvr32.exe	explorer.exe
PID 984 wrote to memory of 860	984	regsvr32.exe	explorer.exe
PID 984 wrote to memory of 860	984	regsvr32.exe	explorer.exe
PID 984 wrote to memory of 860	984	regsvr32.exe	explorer.exe
PID 984 wrote to memory of 860	984	regsvr32.exe	explorer.exe
PID 984 wrote to memory of 860	984	regsvr32.exe	explorer.exe
PID 860 wrote to memory of 592	860	explorer.exe	reg.exe
PID 860 wrote to memory of 592	860	explorer.exe	reg.exe
PID 860 wrote to memory of 592	860	explorer.exe	reg.exe
PID 860 wrote to memory of 592	860	explorer.exe	reg.exe
PID 860 wrote to memory of 1792	860	explorer.exe	reg.exe
PID 860 wrote to memory of 1792	860	explorer.exe	reg.exe
PID 860 wrote to memory of 1792	860	explorer.exe	reg.exe
PID 860 wrote to memory of 1792	860	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17d57c8aa7536959e45dd55a6cae0b9b0c64c02f7a6b7545c2b5b1e350e70bd7.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17d57c8aa7536959e45dd55a6cae0b9b0c64c02f7a6b7545c2b5b1e350e70bd7.bin.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn odwepnou /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\17d57c8aa7536959e45dd55a6cae0b9b0c64c02f7a6b7545c2b5b1e350e70bd7.bin.dll\"" /SC ONCE /Z /ST 10:30 /ET 10:42
4⤵
- Creates scheduled task(s)
PID:1680

C:\Windows\system32\taskeng.exe
taskeng.exe {A0615A21-A86C-4B94-A1FD-AC310AE097DE} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\17d57c8aa7536959e45dd55a6cae0b9b0c64c02f7a6b7545c2b5b1e350e70bd7.bin.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\17d57c8aa7536959e45dd55a6cae0b9b0c64c02f7a6b7545c2b5b1e350e70bd7.bin.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Afhryd" /d "0"
5⤵
PID:592

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Iqdin" /d "0"
5⤵
PID:1792

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\17d57c8aa7536959e45dd55a6cae0b9b0c64c02f7a6b7545c2b5b1e350e70bd7.bin.dll
MD5
69063f91e6dfb8f69722e871d5dbf802

SHA1
69530e80946049ad0637e5bee82d0932a7f2831e

SHA256
17d57c8aa7536959e45dd55a6cae0b9b0c64c02f7a6b7545c2b5b1e350e70bd7

SHA512
c136654d600e270ef5071e7cb675d65103c353802b2f59766488d451ad72fa60dd65562580e9d6b444bd57291b12eef938f5049e86cc8e3568c198310772364a

Download Submit
\Users\Admin\AppData\Local\Temp\17d57c8aa7536959e45dd55a6cae0b9b0c64c02f7a6b7545c2b5b1e350e70bd7.bin.dll
MD5
69063f91e6dfb8f69722e871d5dbf802

SHA1
69530e80946049ad0637e5bee82d0932a7f2831e

SHA256
17d57c8aa7536959e45dd55a6cae0b9b0c64c02f7a6b7545c2b5b1e350e70bd7

SHA512
c136654d600e270ef5071e7cb675d65103c353802b2f59766488d451ad72fa60dd65562580e9d6b444bd57291b12eef938f5049e86cc8e3568c198310772364a

Download Submit
memory/592-84-0x0000000000000000-mapping.dmp

Download
memory/860-86-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/860-81-0x0000000000000000-mapping.dmp

Download
memory/868-63-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/868-68-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/868-66-0x00000000744B1000-0x00000000744B3000-memory.dmp

Filesize
8KB

Download
memory/868-64-0x0000000000000000-mapping.dmp

Download
memory/984-77-0x0000000000130000-0x0000000000151000-memory.dmp

Filesize
132KB

Download
memory/984-76-0x0000000000130000-0x0000000000151000-memory.dmp

Filesize
132KB

Download
memory/984-78-0x0000000000130000-0x0000000000151000-memory.dmp

Filesize
132KB

Download
memory/984-75-0x00000000004E0000-0x00000000005A8000-memory.dmp

Filesize
800KB

Download
memory/984-79-0x0000000000130000-0x0000000000151000-memory.dmp

Filesize
132KB

Download
memory/984-85-0x0000000000130000-0x0000000000151000-memory.dmp

Filesize
132KB

Download
memory/984-72-0x0000000000000000-mapping.dmp

Download
memory/1176-61-0x0000000000730000-0x0000000000781000-memory.dmp

Filesize
324KB

Download
memory/1176-62-0x0000000000790000-0x00000000007B1000-memory.dmp

Filesize
132KB

Download
memory/1176-54-0x0000000000000000-mapping.dmp

Download
memory/1176-59-0x0000000000790000-0x00000000007B1000-memory.dmp

Filesize
132KB

Download
memory/1176-60-0x0000000000790000-0x00000000007B1000-memory.dmp

Filesize
132KB

Download
memory/1176-58-0x0000000000790000-0x00000000007B1000-memory.dmp

Filesize
132KB

Download
memory/1176-57-0x0000000000790000-0x00000000007B1000-memory.dmp

Filesize
132KB

Download
memory/1176-56-0x0000000000890000-0x0000000000958000-memory.dmp

Filesize
800KB

Download
memory/1176-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1652-70-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

Filesize
8KB

Download
memory/1652-69-0x0000000000000000-mapping.dmp

Download
memory/1680-67-0x0000000000000000-mapping.dmp

Download
memory/1792-87-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads