qakbot | 6e242b5ff1178785e03f5919c0e8a00bc758ce9c1ba8134b38bd6a5810c5a539

General

Target

5_.exe_.dll
Size

789KB
MD5

f15de54d18e9ddc19f4e8aaac3939f38
SHA1

aa86611e84fc8168d828a86b32ef4aef5a6befae
SHA256

6e242b5ff1178785e03f5919c0e8a00bc758ce9c1ba8134b38bd6a5810c5a539
SHA512

20a00a2810e1e25316713f188d5f11f05fd69bca51e8afa1eb3bad25e6a98ae9769f829533399f98f7d8836c766dcdbd8939653fc619017380269d7aebce90c6

Score

10^/10

qakbot obama149 1640166821 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama149

Campaign

1640166821

C2

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

24.53.49.240:443

94.200.181.154:995

149.135.101.20:443

67.209.195.198:443

209.210.95.228:32100

96.80.109.57:995

80.14.196.176:2222

38.70.253.226:2222

24.222.20.254:443

102.65.38.67:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

988 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1488 schtasks.exe

pid	process
988	regsvr32.exe

pid	process
1488	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Onytyhuhuuiag\222a0240 = f2296ada7980ef5db98975b7bb65a16492a6a37a88730273fe287d649b77c31ede3509	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Onytyhuhuuiag\9a966525 = 61f81cfcb6071a1b4e2074616f40680ecdaa459f156f3bc42cbb2cfe33f350b0dd1482a2c69cde10b83062c0589bf3bdf2c762c22eca20816e5e650bba	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Onytyhuhuuiag\98d74559 = 5dcf7d40e32d3579003269b579f23ca3084be4df991757742ab1cc0535fb01f3c6982067d5f9b5bf440904191ce17ce668bb4391ab15ce4f9f9c7cd838857c187b454c676ba3a9d9977264e8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Onytyhuhuuiag\6abd9d84 = 9a4c1e81ed4e0e18b6ae4dc7eeeeb3dac4ed9cfa3bf2de8bb2a038de70dd4d9ed0505a34f774b429f82178316d4acb116451630c34528a9b331c91e723d6fb1ce3	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Onytyhuhuuiag	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Onytyhuhuuiag\15f4f272 = b794955bda3c7a720f82723a9745c6e24ce69edb3d82c5d9967c8e1f67d82943578cd372f0bddd4d9d474254a1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Onytyhuhuuiag\206b223c = 8e7c8b35be8a3c439ebd78eaddea997d984927ebe74f08c6733dd995d23332d206558d9f1cbfb5cb665bae9ed518e0df6cfb517ba3050b5450a889b69630d6d4076459e8eee48352943b39427e84b30aff38ed2ca630b38042354ebcd0f1d97d7b9f497880128ea4dad38d5c3dc421c2f53958d648ff7b96727355d8c4b3ddffc3ff00e6b89c32d43c14649c2ab2ff8fe2b926bb91e19dfd5a9f67ae105f84d8842cd054fb3855c0f7664f668cfdbb9920aa1244c0e42115f23afb4bf12f65b472d8e23ddd203a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Onytyhuhuuiag\e79e2aaf = ba3240790dead2c12a3135637451372307763c388ef158a25dce2788e70c611ca25df1d871b67d65615968ee34eb825345e9617e9541ae4a1864557f5c571e0a22d5c45e0a7bc733fe82b84236430dd66c5f3d6bd7b25a97b557e7cc6043880e5b3d726fe5718bd980a85892cb4e8c8b3870	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Onytyhuhuuiag\5f224dca = c37fc15950bfe3c456b60d08295e83f6480db7b3c5b8d1280037046952a7f7ac682b4afb4cd6d47b01abcc67628b01808260c64aaafce834c52c109c6df22011de682f358f09d6c4b2e211eec8a5172793559e68b5ad	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Onytyhuhuuiag\15f4f272 = b794825bda3c4f577afbef47e8912627b1db36ac6656b998c8fd05ea265c9450a827066bf8186249e73683602c44ceec147cbc8167fcb632f65633d0608595c32d41	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1672 rundll32.exe
988 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1672 rundll32.exe
988 regsvr32.exe

pid	process
1672	rundll32.exe
988	regsvr32.exe

pid	process
1672	rundll32.exe
988	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 792 wrote to memory of 1672	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1672	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1672	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1672	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1672	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1672	792	rundll32.exe	rundll32.exe
PID 792 wrote to memory of 1672	792	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 560	1672	rundll32.exe	explorer.exe
PID 1672 wrote to memory of 560	1672	rundll32.exe	explorer.exe
PID 1672 wrote to memory of 560	1672	rundll32.exe	explorer.exe
PID 1672 wrote to memory of 560	1672	rundll32.exe	explorer.exe
PID 1672 wrote to memory of 560	1672	rundll32.exe	explorer.exe
PID 1672 wrote to memory of 560	1672	rundll32.exe	explorer.exe
PID 560 wrote to memory of 1488	560	explorer.exe	schtasks.exe
PID 560 wrote to memory of 1488	560	explorer.exe	schtasks.exe
PID 560 wrote to memory of 1488	560	explorer.exe	schtasks.exe
PID 560 wrote to memory of 1488	560	explorer.exe	schtasks.exe
PID 1444 wrote to memory of 1416	1444	taskeng.exe	regsvr32.exe
PID 1444 wrote to memory of 1416	1444	taskeng.exe	regsvr32.exe
PID 1444 wrote to memory of 1416	1444	taskeng.exe	regsvr32.exe
PID 1444 wrote to memory of 1416	1444	taskeng.exe	regsvr32.exe
PID 1444 wrote to memory of 1416	1444	taskeng.exe	regsvr32.exe
PID 1416 wrote to memory of 988	1416	regsvr32.exe	regsvr32.exe
PID 1416 wrote to memory of 988	1416	regsvr32.exe	regsvr32.exe
PID 1416 wrote to memory of 988	1416	regsvr32.exe	regsvr32.exe
PID 1416 wrote to memory of 988	1416	regsvr32.exe	regsvr32.exe
PID 1416 wrote to memory of 988	1416	regsvr32.exe	regsvr32.exe
PID 1416 wrote to memory of 988	1416	regsvr32.exe	regsvr32.exe
PID 1416 wrote to memory of 988	1416	regsvr32.exe	regsvr32.exe
PID 988 wrote to memory of 1724	988	regsvr32.exe	explorer.exe
PID 988 wrote to memory of 1724	988	regsvr32.exe	explorer.exe
PID 988 wrote to memory of 1724	988	regsvr32.exe	explorer.exe
PID 988 wrote to memory of 1724	988	regsvr32.exe	explorer.exe
PID 988 wrote to memory of 1724	988	regsvr32.exe	explorer.exe
PID 988 wrote to memory of 1724	988	regsvr32.exe	explorer.exe
PID 1724 wrote to memory of 1192	1724	explorer.exe	reg.exe
PID 1724 wrote to memory of 1192	1724	explorer.exe	reg.exe
PID 1724 wrote to memory of 1192	1724	explorer.exe	reg.exe
PID 1724 wrote to memory of 1192	1724	explorer.exe	reg.exe
PID 1724 wrote to memory of 2024	1724	explorer.exe	reg.exe
PID 1724 wrote to memory of 2024	1724	explorer.exe	reg.exe
PID 1724 wrote to memory of 2024	1724	explorer.exe	reg.exe
PID 1724 wrote to memory of 2024	1724	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5_.exe_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:792

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5_.exe_.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn azropen /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\5_.exe_.dll\"" /SC ONCE /Z /ST 14:56 /ET 15:08
4⤵
- Creates scheduled task(s)
PID:1488

C:\Windows\system32\taskeng.exe
taskeng.exe {77723FA8-7DB5-41A2-B4AD-C625793677BF} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\5_.exe_.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\5_.exe_.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:988

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Orbzhmcihm" /d "0"
5⤵
PID:1192

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Awdzgqu" /d "0"
5⤵
PID:2024

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5_.exe_.dll
MD5
f15de54d18e9ddc19f4e8aaac3939f38

SHA1
aa86611e84fc8168d828a86b32ef4aef5a6befae

SHA256
6e242b5ff1178785e03f5919c0e8a00bc758ce9c1ba8134b38bd6a5810c5a539

SHA512
20a00a2810e1e25316713f188d5f11f05fd69bca51e8afa1eb3bad25e6a98ae9769f829533399f98f7d8836c766dcdbd8939653fc619017380269d7aebce90c6

Download Submit
\Users\Admin\AppData\Local\Temp\5_.exe_.dll
MD5
f15de54d18e9ddc19f4e8aaac3939f38

SHA1
aa86611e84fc8168d828a86b32ef4aef5a6befae

SHA256
6e242b5ff1178785e03f5919c0e8a00bc758ce9c1ba8134b38bd6a5810c5a539

SHA512
20a00a2810e1e25316713f188d5f11f05fd69bca51e8afa1eb3bad25e6a98ae9769f829533399f98f7d8836c766dcdbd8939653fc619017380269d7aebce90c6

Download Submit
memory/560-61-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download
memory/560-68-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/560-66-0x0000000074B71000-0x0000000074B73000-memory.dmp

Filesize
8KB

Download
memory/560-62-0x0000000000000000-mapping.dmp

Download
memory/988-78-0x0000000000260000-0x0000000000281000-memory.dmp

Filesize
132KB

Download
memory/988-75-0x0000000000980000-0x0000000000A48000-memory.dmp

Filesize
800KB

Download
memory/988-80-0x0000000000260000-0x0000000000281000-memory.dmp

Filesize
132KB

Download
memory/988-79-0x0000000000260000-0x0000000000281000-memory.dmp

Filesize
132KB

Download
memory/988-77-0x0000000000260000-0x0000000000281000-memory.dmp

Filesize
132KB

Download
memory/988-76-0x0000000000260000-0x0000000000281000-memory.dmp

Filesize
132KB

Download
memory/988-72-0x0000000000000000-mapping.dmp

Download
memory/1192-85-0x0000000000000000-mapping.dmp

Download
memory/1416-69-0x0000000000000000-mapping.dmp

Download
memory/1416-70-0x000007FEFBEB1000-0x000007FEFBEB3000-memory.dmp

Filesize
8KB

Download
memory/1488-67-0x0000000000000000-mapping.dmp

Download
memory/1672-57-0x0000000000190000-0x00000000001B1000-memory.dmp

Filesize
132KB

Download
memory/1672-56-0x0000000075321000-0x0000000075323000-memory.dmp

Filesize
8KB

Download
memory/1672-58-0x0000000000190000-0x00000000001B1000-memory.dmp

Filesize
132KB

Download
memory/1672-60-0x0000000000190000-0x00000000001B1000-memory.dmp

Filesize
132KB

Download
memory/1672-55-0x0000000000000000-mapping.dmp

Download
memory/1672-59-0x0000000000190000-0x00000000001B1000-memory.dmp

Filesize
132KB

Download
memory/1672-65-0x0000000000190000-0x00000000001B1000-memory.dmp

Filesize
132KB

Download
memory/1672-64-0x0000000000300000-0x0000000000351000-memory.dmp

Filesize
324KB

Download
memory/1724-82-0x0000000000000000-mapping.dmp

Download
memory/1724-87-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2024-86-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads