qakbot | bd72d58565c17bf5baac6202745afc14c8b40f58af27add05256cf5e041d6ac6

General

Target

bd72d58565c17bf5baac6202745afc14c8b40f58af27add05256cf5e041d6ac6.dll
Size

789KB
MD5

8eac118c3dd906020ee95e00d639eb75
SHA1

916ffa060883cb6f72d9e4b04b562c077d818891
SHA256

bd72d58565c17bf5baac6202745afc14c8b40f58af27add05256cf5e041d6ac6
SHA512

8744c055019f726879a78f82d11cabf55b83a4b2b528781244d0c57122b4d3a8c2b53bbf49b41b4cd6cf53933785c971cc5c812ada2a3e314d7dd7e606c2bc35

Score

10^/10

qakbot obama149 1640166821 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama149

Campaign

1640166821

C2

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

24.53.49.240:443

94.200.181.154:995

149.135.101.20:443

67.209.195.198:443

209.210.95.228:32100

96.80.109.57:995

80.14.196.176:2222

38.70.253.226:2222

24.222.20.254:443

102.65.38.67:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1568 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

828 schtasks.exe

pid	process
1568	regsvr32.exe

pid	process
828	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dpvnfxbuere	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dpvnfxbuere\89b70417 = dd537f46dffe5225ecaaa0724ebbd4997d0f70fe0838ba5be70a1ea2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dpvnfxbuere\4c032cf8 = 01734401837aa696d2197cb8671e540deb42a4c3170276c11b1082cb37db885242f8c18e8ae4c1f07b2fab4c4f16816fcbce11c606ce632c00b513c383118b79f746e6b2d7f7d965c476871b38	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dpvnfxbuere\8bf6246b = 5969f4ec2a932fcc32d227ee6f1b4dab999617f8c71ff27017a1eb1a0472930c5d21d735ca9704224ee7eb72c649b08db4fa0d6a77592f65e8405a3404aec1427fe2273aca2f0469ede1f9bb7e8f910802a75d91433e4f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dpvnfxbuere\6d59340 = 12aa966f0a000de13a2411395c4f764d47df07e6aa2b45d7fe2394d83d429c1ab2c88577edea0729ad31a128e11f3b8910205151542899bd015101fc5b27d24f60d84913cb15cddf94155534b37f5b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dpvnfxbuere\6d59340 = 12aa816f0a00382ae6215f9f9ee0826e6af31c27ca94bfccec23874413450bcfbea525545e5a970df7a02e8da157b3e8bcaafdd167c6e904a0f4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dpvnfxbuere\334a430e = 6754ab8e67a7445ad7406308b48c4c036d1113e14090f74db54ea096f4f08c759a0ac1d4e5d390f5a48c21627fa75943435aa9039f09dc9c2275407b573483fc2d42e4ab1ef57de753d8d37815474b53abd477aba6fdd092990d0d0a7985e00c7d24660720b60f1dbcae3e8685ebf6f18f242347ea8079a5dec0ad061b4e2759757bc22df71494441d4e41b70057857e7559c5259cb833e4d9885ada53fa70a4849ba2f37f5ca51ea694cd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dpvnfxbuere\310b6372 = 470caf0f749e648ab689432152f942e5ffdb112231eba633b349f4227f7fda613358b303d059e9b9d1bfbb47619e659d4cc7f3da1083b5ef54d9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dpvnfxbuere\f4bf4b9d = 3c3958494207795e7c9f2beffc93c180e64e4a8f03c12ed78dd186411641e740e3b3532c19d0e85036d944cf3ae3b71e19818e589c2d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dpvnfxbuere\799cfcb6 = d2e2546da32363d96c10bb578c223966a87de21afb01a3c39878096add5cc97c471b27e9f8d74cb4	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1272 rundll32.exe
1568 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1272 rundll32.exe
1568 regsvr32.exe

pid	process
1272	rundll32.exe
1568	regsvr32.exe

pid	process
1272	rundll32.exe
1568	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 972 wrote to memory of 1272	972	rundll32.exe	rundll32.exe
PID 972 wrote to memory of 1272	972	rundll32.exe	rundll32.exe
PID 972 wrote to memory of 1272	972	rundll32.exe	rundll32.exe
PID 972 wrote to memory of 1272	972	rundll32.exe	rundll32.exe
PID 972 wrote to memory of 1272	972	rundll32.exe	rundll32.exe
PID 972 wrote to memory of 1272	972	rundll32.exe	rundll32.exe
PID 972 wrote to memory of 1272	972	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1064	1272	rundll32.exe	explorer.exe
PID 1272 wrote to memory of 1064	1272	rundll32.exe	explorer.exe
PID 1272 wrote to memory of 1064	1272	rundll32.exe	explorer.exe
PID 1272 wrote to memory of 1064	1272	rundll32.exe	explorer.exe
PID 1272 wrote to memory of 1064	1272	rundll32.exe	explorer.exe
PID 1272 wrote to memory of 1064	1272	rundll32.exe	explorer.exe
PID 1064 wrote to memory of 828	1064	explorer.exe	schtasks.exe
PID 1064 wrote to memory of 828	1064	explorer.exe	schtasks.exe
PID 1064 wrote to memory of 828	1064	explorer.exe	schtasks.exe
PID 1064 wrote to memory of 828	1064	explorer.exe	schtasks.exe
PID 1512 wrote to memory of 1328	1512	taskeng.exe	regsvr32.exe
PID 1512 wrote to memory of 1328	1512	taskeng.exe	regsvr32.exe
PID 1512 wrote to memory of 1328	1512	taskeng.exe	regsvr32.exe
PID 1512 wrote to memory of 1328	1512	taskeng.exe	regsvr32.exe
PID 1512 wrote to memory of 1328	1512	taskeng.exe	regsvr32.exe
PID 1328 wrote to memory of 1568	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1568	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1568	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1568	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1568	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1568	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1568	1328	regsvr32.exe	regsvr32.exe
PID 1568 wrote to memory of 664	1568	regsvr32.exe	explorer.exe
PID 1568 wrote to memory of 664	1568	regsvr32.exe	explorer.exe
PID 1568 wrote to memory of 664	1568	regsvr32.exe	explorer.exe
PID 1568 wrote to memory of 664	1568	regsvr32.exe	explorer.exe
PID 1568 wrote to memory of 664	1568	regsvr32.exe	explorer.exe
PID 1568 wrote to memory of 664	1568	regsvr32.exe	explorer.exe
PID 664 wrote to memory of 1016	664	explorer.exe	reg.exe
PID 664 wrote to memory of 1016	664	explorer.exe	reg.exe
PID 664 wrote to memory of 1016	664	explorer.exe	reg.exe
PID 664 wrote to memory of 1016	664	explorer.exe	reg.exe
PID 664 wrote to memory of 1792	664	explorer.exe	reg.exe
PID 664 wrote to memory of 1792	664	explorer.exe	reg.exe
PID 664 wrote to memory of 1792	664	explorer.exe	reg.exe
PID 664 wrote to memory of 1792	664	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd72d58565c17bf5baac6202745afc14c8b40f58af27add05256cf5e041d6ac6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:972

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd72d58565c17bf5baac6202745afc14c8b40f58af27add05256cf5e041d6ac6.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kyoflftgef /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\bd72d58565c17bf5baac6202745afc14c8b40f58af27add05256cf5e041d6ac6.dll\"" /SC ONCE /Z /ST 17:04 /ET 17:16
4⤵
- Creates scheduled task(s)
PID:828

C:\Windows\system32\taskeng.exe
taskeng.exe {A9026602-2E1D-408F-8ECF-95719E97C52A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\bd72d58565c17bf5baac6202745afc14c8b40f58af27add05256cf5e041d6ac6.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\bd72d58565c17bf5baac6202745afc14c8b40f58af27add05256cf5e041d6ac6.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:664

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Dkelzbxssm" /d "0"
5⤵
PID:1016

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Wiofjap" /d "0"
5⤵
PID:1792

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bd72d58565c17bf5baac6202745afc14c8b40f58af27add05256cf5e041d6ac6.dll
MD5
8eac118c3dd906020ee95e00d639eb75

SHA1
916ffa060883cb6f72d9e4b04b562c077d818891

SHA256
bd72d58565c17bf5baac6202745afc14c8b40f58af27add05256cf5e041d6ac6

SHA512
8744c055019f726879a78f82d11cabf55b83a4b2b528781244d0c57122b4d3a8c2b53bbf49b41b4cd6cf53933785c971cc5c812ada2a3e314d7dd7e606c2bc35

Download Submit
\Users\Admin\AppData\Local\Temp\bd72d58565c17bf5baac6202745afc14c8b40f58af27add05256cf5e041d6ac6.dll
MD5
8eac118c3dd906020ee95e00d639eb75

SHA1
916ffa060883cb6f72d9e4b04b562c077d818891

SHA256
bd72d58565c17bf5baac6202745afc14c8b40f58af27add05256cf5e041d6ac6

SHA512
8744c055019f726879a78f82d11cabf55b83a4b2b528781244d0c57122b4d3a8c2b53bbf49b41b4cd6cf53933785c971cc5c812ada2a3e314d7dd7e606c2bc35

Download Submit
memory/664-82-0x0000000000000000-mapping.dmp

Download
memory/664-87-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/828-69-0x0000000000000000-mapping.dmp

Download
memory/1016-85-0x0000000000000000-mapping.dmp

Download
memory/1064-65-0x0000000000000000-mapping.dmp

Download
memory/1064-68-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/1064-67-0x00000000742A1000-0x00000000742A3000-memory.dmp

Filesize
8KB

Download
memory/1064-64-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download
memory/1272-58-0x0000000000990000-0x00000000009B1000-memory.dmp

Filesize
132KB

Download
memory/1272-62-0x00000000005A0000-0x00000000005F1000-memory.dmp

Filesize
324KB

Download
memory/1272-63-0x0000000000990000-0x00000000009B1000-memory.dmp

Filesize
132KB

Download
memory/1272-61-0x0000000000990000-0x00000000009B1000-memory.dmp

Filesize
132KB

Download
memory/1272-55-0x0000000000000000-mapping.dmp

Download
memory/1272-60-0x0000000000990000-0x00000000009B1000-memory.dmp

Filesize
132KB

Download
memory/1272-59-0x0000000000990000-0x00000000009B1000-memory.dmp

Filesize
132KB

Download
memory/1272-57-0x0000000000210000-0x00000000002D8000-memory.dmp

Filesize
800KB

Download
memory/1272-56-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download
memory/1328-70-0x0000000000000000-mapping.dmp

Download
memory/1328-71-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Filesize
8KB

Download
memory/1568-77-0x0000000000A20000-0x0000000000A41000-memory.dmp

Filesize
132KB

Download
memory/1568-78-0x0000000000A20000-0x0000000000A41000-memory.dmp

Filesize
132KB

Download
memory/1568-80-0x0000000000A20000-0x0000000000A41000-memory.dmp

Filesize
132KB

Download
memory/1568-79-0x0000000000A20000-0x0000000000A41000-memory.dmp

Filesize
132KB

Download
memory/1568-76-0x0000000000950000-0x0000000000A18000-memory.dmp

Filesize
800KB

Download
memory/1568-73-0x0000000000000000-mapping.dmp

Download
memory/1568-86-0x0000000000A20000-0x0000000000A41000-memory.dmp

Filesize
132KB

Download
memory/1792-88-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads