qakbot | 427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409

General

Target

427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409.dll
Size

789KB
MD5

ae148cf88dae245103bb7476df5cf0d1
SHA1

413ae7baa965a4dba35269ffbf9a040aaeb0a745
SHA256

427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409
SHA512

2c845d4d7d057342c8752bffce5f0be215fb3f372a4eacb86b6afb47d3a777a7233842ec10aaa031a4e525b43acb62aa4e5275b91462062ede586eba09cffaba

Score

10^/10

qakbot obama149 1640166821 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama149

Campaign

1640166821

C2

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

24.53.49.240:443

94.200.181.154:995

149.135.101.20:443

67.209.195.198:443

209.210.95.228:32100

96.80.109.57:995

80.14.196.176:2222

38.70.253.226:2222

24.222.20.254:443

102.65.38.67:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1284 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1060 schtasks.exe

pid	process
1284	regsvr32.exe

pid	process
1060	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otjvvuvjfwhpqf\ab2b3a01 = ffbcc55980c76e151d1a9fac2ebe03bd6f8c86b3bc3d79a2b3c7663b2bd0048f54d5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otjvvuvjfwhpqf\9eb4ea4f = e7d16d5452df511a2765f0a4fb050c04ef41cd498b184430932a7370f7071ee81165ecffae6472a5edad3bdae8b48c6758a65cf5abb1d33ed6306f1ad280041b5d1ad6c935c2f5a159c65d3e1d0c97a6fcd83346cb5c716e0e859bba985b1142f25af524ed83887a340e9c54e7fdb857fb4d9069b5b9495400410aac2c97f13b34292d7db9b9bf4f61572045f9da5355e8e268d0199c2f0a80b058a3391d853ea0bf8526b0c3d4689eda3a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otjvvuvjfwhpqf\2449ad56 = 0270d12eb64f27b6a71c09b141b63f45428389131677a661d57b99bf56dabd87bc0ca71c7f618bea8c8d225779de6aaed7357b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otjvvuvjfwhpqf\ab2b3a01 = ffbcd25980c75bd6f2f40c3727d1280f5d37025c5594c1053629debe920767a31d29deaa1bf387d36076b4ab44569dc115e490ce5a2622	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otjvvuvjfwhpqf\d46255f7 = 01cda85c8541ae5f338b169244970dc5003e2f8b92f29fe8a0b736bbe6ed3f8dea516c37b84240fe5d242024ab42a616a488ab13616d369be7d78b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otjvvuvjfwhpqf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otjvvuvjfwhpqf\9cf5ca33 = 122592721e1cd51fc10ee5943d0317ba75087e6957e7837ee0241b377b994cf1e8b28a1be7b117aee5511446150b3063548b809586ee312f04570e1879b40ea364e7f45befbe	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otjvvuvjfwhpqf\5941e2dc = 41b14874979cd4aab151546484bd5de4eada112ed91180345aab7ec494de3ef082eb941e423ab28325d015681b4136c2e30ee297cd27d963fca85f65c43fc458948515d054cde7d31b8817935588e6f7c348a31f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otjvvuvjfwhpqf\e1fd85b9 = 2d8ef077c52ffd95f7ed55f358293b1cee66b84571319d7c94de64bc55e4b9f18cc77c9f64f93e85aed869accbcace87c2a4b50f1b54ae0001791ed891b0a91342d0ec5452e094b484e32cc11a509103175e104672ff390ceb79b42bc659c9771cc0d9ba09ebbde2402db1b4fce8d43e523f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Otjvvuvjfwhpqf\26088d2a = 0b4aec7aa3ff2d2ae5eb0b1d1b68d8912ebbdcb8734b2fdfecad4bbf0ed8e0e9af486d0d8fb66b5bbd80683ae907940f1c95	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1688 rundll32.exe
1284 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1688 rundll32.exe
1284 regsvr32.exe

pid	process
1688	rundll32.exe
1284	regsvr32.exe

pid	process
1688	rundll32.exe
1284	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1592 wrote to memory of 1688	1592	rundll32.exe	rundll32.exe
PID 1592 wrote to memory of 1688	1592	rundll32.exe	rundll32.exe
PID 1592 wrote to memory of 1688	1592	rundll32.exe	rundll32.exe
PID 1592 wrote to memory of 1688	1592	rundll32.exe	rundll32.exe
PID 1592 wrote to memory of 1688	1592	rundll32.exe	rundll32.exe
PID 1592 wrote to memory of 1688	1592	rundll32.exe	rundll32.exe
PID 1592 wrote to memory of 1688	1592	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 720	1688	rundll32.exe	explorer.exe
PID 1688 wrote to memory of 720	1688	rundll32.exe	explorer.exe
PID 1688 wrote to memory of 720	1688	rundll32.exe	explorer.exe
PID 1688 wrote to memory of 720	1688	rundll32.exe	explorer.exe
PID 1688 wrote to memory of 720	1688	rundll32.exe	explorer.exe
PID 1688 wrote to memory of 720	1688	rundll32.exe	explorer.exe
PID 720 wrote to memory of 1060	720	explorer.exe	schtasks.exe
PID 720 wrote to memory of 1060	720	explorer.exe	schtasks.exe
PID 720 wrote to memory of 1060	720	explorer.exe	schtasks.exe
PID 720 wrote to memory of 1060	720	explorer.exe	schtasks.exe
PID 1512 wrote to memory of 968	1512	taskeng.exe	regsvr32.exe
PID 1512 wrote to memory of 968	1512	taskeng.exe	regsvr32.exe
PID 1512 wrote to memory of 968	1512	taskeng.exe	regsvr32.exe
PID 1512 wrote to memory of 968	1512	taskeng.exe	regsvr32.exe
PID 1512 wrote to memory of 968	1512	taskeng.exe	regsvr32.exe
PID 968 wrote to memory of 1284	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 1284	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 1284	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 1284	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 1284	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 1284	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 1284	968	regsvr32.exe	regsvr32.exe
PID 1284 wrote to memory of 2036	1284	regsvr32.exe	explorer.exe
PID 1284 wrote to memory of 2036	1284	regsvr32.exe	explorer.exe
PID 1284 wrote to memory of 2036	1284	regsvr32.exe	explorer.exe
PID 1284 wrote to memory of 2036	1284	regsvr32.exe	explorer.exe
PID 1284 wrote to memory of 2036	1284	regsvr32.exe	explorer.exe
PID 1284 wrote to memory of 2036	1284	regsvr32.exe	explorer.exe
PID 2036 wrote to memory of 1948	2036	explorer.exe	reg.exe
PID 2036 wrote to memory of 1948	2036	explorer.exe	reg.exe
PID 2036 wrote to memory of 1948	2036	explorer.exe	reg.exe
PID 2036 wrote to memory of 1948	2036	explorer.exe	reg.exe
PID 2036 wrote to memory of 1008	2036	explorer.exe	reg.exe
PID 2036 wrote to memory of 1008	2036	explorer.exe	reg.exe
PID 2036 wrote to memory of 1008	2036	explorer.exe	reg.exe
PID 2036 wrote to memory of 1008	2036	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:720

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn uypvzieaio /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409.dll\"" /SC ONCE /Z /ST 14:41 /ET 14:53
4⤵
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\taskeng.exe
taskeng.exe {FB63865C-9B94-4C18-B9CC-7B29B99112DC} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Qpxujucczai" /d "0"
5⤵
PID:1948

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Weydflf" /d "0"
5⤵
PID:1008

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409.dll
MD5
ae148cf88dae245103bb7476df5cf0d1

SHA1
413ae7baa965a4dba35269ffbf9a040aaeb0a745

SHA256
427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409

SHA512
2c845d4d7d057342c8752bffce5f0be215fb3f372a4eacb86b6afb47d3a777a7233842ec10aaa031a4e525b43acb62aa4e5275b91462062ede586eba09cffaba

Download Submit
\Users\Admin\AppData\Local\Temp\427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409.dll
MD5
ae148cf88dae245103bb7476df5cf0d1

SHA1
413ae7baa965a4dba35269ffbf9a040aaeb0a745

SHA256
427edc374c47adce4bc7abbc949f83512ad56582420a9b69eda52e3b3fa50409

SHA512
2c845d4d7d057342c8752bffce5f0be215fb3f372a4eacb86b6afb47d3a777a7233842ec10aaa031a4e525b43acb62aa4e5275b91462062ede586eba09cffaba

Download Submit
memory/720-61-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download
memory/720-67-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/720-64-0x00000000748D1000-0x00000000748D3000-memory.dmp

Filesize
8KB

Download
memory/720-62-0x0000000000000000-mapping.dmp

Download
memory/968-69-0x0000000000000000-mapping.dmp

Download
memory/968-70-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp

Filesize
8KB

Download
memory/1008-85-0x0000000000000000-mapping.dmp

Download
memory/1060-68-0x0000000000000000-mapping.dmp

Download
memory/1284-78-0x0000000000470000-0x0000000000491000-memory.dmp

Filesize
132KB

Download
memory/1284-79-0x0000000000470000-0x0000000000491000-memory.dmp

Filesize
132KB

Download
memory/1284-86-0x0000000000470000-0x0000000000491000-memory.dmp

Filesize
132KB

Download
memory/1284-77-0x0000000000470000-0x0000000000491000-memory.dmp

Filesize
132KB

Download
memory/1284-76-0x0000000000470000-0x0000000000491000-memory.dmp

Filesize
132KB

Download
memory/1284-75-0x0000000000940000-0x0000000000A08000-memory.dmp

Filesize
800KB

Download
memory/1284-72-0x0000000000000000-mapping.dmp

Download
memory/1688-56-0x0000000000470000-0x0000000000538000-memory.dmp

Filesize
800KB

Download
memory/1688-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1688-58-0x0000000000250000-0x0000000000271000-memory.dmp

Filesize
132KB

Download
memory/1688-54-0x0000000000000000-mapping.dmp

Download
memory/1688-66-0x0000000000250000-0x0000000000271000-memory.dmp

Filesize
132KB

Download
memory/1688-60-0x0000000000250000-0x0000000000271000-memory.dmp

Filesize
132KB

Download
memory/1688-57-0x0000000000250000-0x0000000000271000-memory.dmp

Filesize
132KB

Download
memory/1688-59-0x0000000000250000-0x0000000000271000-memory.dmp

Filesize
132KB

Download
memory/1688-65-0x00000000002A0000-0x00000000002F1000-memory.dmp

Filesize
324KB

Download
memory/1948-84-0x0000000000000000-mapping.dmp

Download
memory/2036-81-0x0000000000000000-mapping.dmp

Download
memory/2036-87-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads