qakbot | 427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409

General

Target

427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409.dll
Size

789KB
MD5

ae148cf88dae245103bb7476df5cf0d1
SHA1

413ae7baa965a4dba35269ffbf9a040aaeb0a745
SHA256

427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409
SHA512

2c845d4d7d057342c8752bffce5f0be215fb3f372a4eacb86b6afb47d3a777a7233842ec10aaa031a4e525b43acb62aa4e5275b91462062ede586eba09cffaba

Score

10^/10

qakbot obama149 1640166821 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama149

Campaign

1640166821

C2

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

24.53.49.240:443

94.200.181.154:995

149.135.101.20:443

67.209.195.198:443

209.210.95.228:32100

96.80.109.57:995

80.14.196.176:2222

38.70.253.226:2222

24.222.20.254:443

102.65.38.67:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1528 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

272 schtasks.exe

pid	process
1528	regsvr32.exe

pid	process
272	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zorcmlqa\47fe3b24 = 866e0a5b51132d1b4bcf5350240f4b89597a9263b9a38ffc69ca2c083b3f71fea9d53512d7c488fa10108d5ffe4b2dc7999bdd90b3b321ca8b67df1861985712298f9c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zorcmlqa\47fe3b24 = 866e1d5b5113180a4a192a851639704c5022fb1aa8daeb09563fbfbb811bd9f8b1339c4fe08526d708012e038a21	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zorcmlqa\c89cac73 = db27048b6a6ad4be646a5f295a2a3ec4e179ab0dfffed5221a770af0a8b57bdc2538103cab50729f8eacbc4f61624d3b152f642a84ef817a024d3744e556759e54079edb6882962bdb26e2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zorcmlqa\b594e3f9 = bf0b0229478426c95e39c6ad9c574ea759ca42e5ac51989f0812e87a445844	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zorcmlqa\d28849c = 498645cf3698a96e1ad663c885bd99a1b8bfb892138d2913df2bcc9ec6eceb6ec6d8e2137f03c148ef68f55f96f565855873ab48f3d0c6810abb1607e488df44110f68ebef09a559f2a3c3c6d45c9e23b09a59a02fcfcd1cd44450864790f19746ae38bcd1b79e787e8d0927eba9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zorcmlqa\cadd8c0f = 78412f1f3c3f6281357c3c8026365900a8e79d2e7308e6b9ecf97eaaaebbf0f93e25f6eeacb065e582fe325b6b74f81481833a81ec282ef5b76761ecdb0308d1451ebd14c538a359144cf519b0fdc2ddcd953356087b1cfebdf06bae5e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zorcmlqa\38b754d2 = 55204d0b1eb6391c809efad478526de72082e9148b220542a30f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zorcmlqa	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zorcmlqa\7261eb6a = e9c4cd43ac62317a020562a38e8b3f810ef25de60a8acf0e2cd93ff96509f596302fd6c12d8c811f1485303426f9f869e4b38ca079c7b27383b504fedcc281f8a0f3580efe2a68101bcb1923e7c40932f1887a9a26ae6976528f57bf1bf125235ca5ad9b127a9a502486b1049613e82c0d9dd811788dd893709009156bf110120d9e961b01142cfe476fe4ff58c82e97802aef4450907b14a14fa2333980e97fb62e4a6899046b50e1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zorcmlqa\7020cb16 = c155140b949937dba9a05fe337cee13aa5d761233552e02e2702	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1688 rundll32.exe
1528 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1688 rundll32.exe
1528 regsvr32.exe

pid	process
1688	rundll32.exe
1528	regsvr32.exe

pid	process
1688	rundll32.exe
1528	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1516 wrote to memory of 1688	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 1688	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 1688	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 1688	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 1688	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 1688	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 1688	1516	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 820	1688	rundll32.exe	explorer.exe
PID 1688 wrote to memory of 820	1688	rundll32.exe	explorer.exe
PID 1688 wrote to memory of 820	1688	rundll32.exe	explorer.exe
PID 1688 wrote to memory of 820	1688	rundll32.exe	explorer.exe
PID 1688 wrote to memory of 820	1688	rundll32.exe	explorer.exe
PID 1688 wrote to memory of 820	1688	rundll32.exe	explorer.exe
PID 820 wrote to memory of 272	820	explorer.exe	schtasks.exe
PID 820 wrote to memory of 272	820	explorer.exe	schtasks.exe
PID 820 wrote to memory of 272	820	explorer.exe	schtasks.exe
PID 820 wrote to memory of 272	820	explorer.exe	schtasks.exe
PID 1484 wrote to memory of 1404	1484	taskeng.exe	regsvr32.exe
PID 1484 wrote to memory of 1404	1484	taskeng.exe	regsvr32.exe
PID 1484 wrote to memory of 1404	1484	taskeng.exe	regsvr32.exe
PID 1484 wrote to memory of 1404	1484	taskeng.exe	regsvr32.exe
PID 1484 wrote to memory of 1404	1484	taskeng.exe	regsvr32.exe
PID 1404 wrote to memory of 1528	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1528	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1528	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1528	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1528	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1528	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1528	1404	regsvr32.exe	regsvr32.exe
PID 1528 wrote to memory of 2032	1528	regsvr32.exe	explorer.exe
PID 1528 wrote to memory of 2032	1528	regsvr32.exe	explorer.exe
PID 1528 wrote to memory of 2032	1528	regsvr32.exe	explorer.exe
PID 1528 wrote to memory of 2032	1528	regsvr32.exe	explorer.exe
PID 1528 wrote to memory of 2032	1528	regsvr32.exe	explorer.exe
PID 1528 wrote to memory of 2032	1528	regsvr32.exe	explorer.exe
PID 2032 wrote to memory of 1768	2032	explorer.exe	reg.exe
PID 2032 wrote to memory of 1768	2032	explorer.exe	reg.exe
PID 2032 wrote to memory of 1768	2032	explorer.exe	reg.exe
PID 2032 wrote to memory of 1768	2032	explorer.exe	reg.exe
PID 2032 wrote to memory of 1192	2032	explorer.exe	reg.exe
PID 2032 wrote to memory of 1192	2032	explorer.exe	reg.exe
PID 2032 wrote to memory of 1192	2032	explorer.exe	reg.exe
PID 2032 wrote to memory of 1192	2032	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:820

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cjfcjrlhp /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409.dll\"" /SC ONCE /Z /ST 12:05 /ET 12:17
4⤵
- Creates scheduled task(s)
PID:272

C:\Windows\system32\taskeng.exe
taskeng.exe {E9E0DE57-D6B4-4DB7-ABAE-1EF03B894A1F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Uihgwfmaggz" /d "0"
5⤵
PID:1768

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ehtwwe" /d "0"
5⤵
PID:1192

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409.dll
MD5
ae148cf88dae245103bb7476df5cf0d1

SHA1
413ae7baa965a4dba35269ffbf9a040aaeb0a745

SHA256
427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409

SHA512
2c845d4d7d057342c8752bffce5f0be215fb3f372a4eacb86b6afb47d3a777a7233842ec10aaa031a4e525b43acb62aa4e5275b91462062ede586eba09cffaba

Download Submit
\Users\Admin\AppData\Local\Temp\427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409.dll
MD5
ae148cf88dae245103bb7476df5cf0d1

SHA1
413ae7baa965a4dba35269ffbf9a040aaeb0a745

SHA256
427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409

SHA512
2c845d4d7d057342c8752bffce5f0be215fb3f372a4eacb86b6afb47d3a777a7233842ec10aaa031a4e525b43acb62aa4e5275b91462062ede586eba09cffaba

Download Submit
memory/272-66-0x0000000000000000-mapping.dmp

Download
memory/820-62-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/820-65-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/820-63-0x0000000000000000-mapping.dmp

Download
memory/1192-83-0x0000000000000000-mapping.dmp

Download
memory/1404-68-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download
memory/1404-67-0x0000000000000000-mapping.dmp

Download
memory/1528-73-0x0000000000A40000-0x0000000000B08000-memory.dmp

Filesize
800KB

Download
memory/1528-70-0x0000000000000000-mapping.dmp

Download
memory/1528-77-0x00000000004F0000-0x0000000000511000-memory.dmp

Filesize
132KB

Download
memory/1528-76-0x00000000004F0000-0x0000000000511000-memory.dmp

Filesize
132KB

Download
memory/1528-75-0x00000000004F0000-0x0000000000511000-memory.dmp

Filesize
132KB

Download
memory/1528-74-0x00000000004F0000-0x0000000000511000-memory.dmp

Filesize
132KB

Download
memory/1688-56-0x0000000000240000-0x0000000000261000-memory.dmp

Filesize
132KB

Download
memory/1688-57-0x0000000000240000-0x0000000000261000-memory.dmp

Filesize
132KB

Download
memory/1688-55-0x00000000002C0000-0x0000000000388000-memory.dmp

Filesize
800KB

Download
memory/1688-53-0x0000000000000000-mapping.dmp

Download
memory/1688-60-0x0000000000440000-0x0000000000491000-memory.dmp

Filesize
324KB

Download
memory/1688-59-0x0000000000240000-0x0000000000261000-memory.dmp

Filesize
132KB

Download
memory/1688-58-0x0000000000240000-0x0000000000261000-memory.dmp

Filesize
132KB

Download
memory/1688-61-0x0000000000240000-0x0000000000261000-memory.dmp

Filesize
132KB

Download
memory/1688-54-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download
memory/1768-82-0x0000000000000000-mapping.dmp

Download
memory/2032-79-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads