qakbot | 20c3a399101410c9de0fcdc46c00d88f8e18cc36163b1cf6e1377f170d752214

General

Target

download.dll
Size

1.7MB
MD5

c93d00511f737f095ec5d32603fa52ab
SHA1

fd4e92245cec5b14bfc59bd496971f5397460ade
SHA256

20c3a399101410c9de0fcdc46c00d88f8e18cc36163b1cf6e1377f170d752214
SHA512

af232bff616470a7940b03ec85ccfbb8e9ca6a37ff003b57b0701482fbeaf96c847c748f72ac9dfbab852be3a6738094ada3826d21b584dc585d2e338c0228b7

Score

10^/10

qakbot obama152 1643019304 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama152

Campaign

1643019304

C2

96.80.109.57:995

209.210.95.228:32100

180.233.150.134:995

149.135.101.20:443

38.70.253.226:2222

24.222.20.254:443

83.110.2.97:443

78.87.44.54:995

86.108.46.251:443

74.15.2.252:2222

102.65.38.67:443

37.203.225.248:443

75.139.7.190:2083

24.53.49.240:443

80.14.196.176:2222

94.60.254.81:443

86.98.32.228:443

130.164.129.3:443

176.67.56.94:443

31.167.160.170:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1780 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1644 schtasks.exe

pid	process
1780	regsvr32.exe

pid	process
1644	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuwexoy\69634e7a = d9d6f79a5b14eff4c8625f156be7f1a32112c47516af27eaeb82047e3eae	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuwexoy\162a218c = 651320fd3bb5861dbd16041caf23dec99052d86f061e12522a7a67482282f38d5dd6368d3083f6f9228638cb5065188d47816ccf1e89627b2059d5a49392f3c51f6145aa1f7a46ecc4f400ab4f4c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuwexoy\21f4d1be = 1b5107259faf8eb712aa7c8e7e527f45664cc24d63544e8cac49045ce60c6e5d9f0cff1b871c6eff82fa68295248781ca2b9626025c1815110e4a8196e8c9d40094dd4790aff735ca550907b21ccb5a9077cb0f5e7763faa05e1520e8adcbd08fd686309898fb4ec	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuwexoy\9948b6db = 99f0b8fe35ef3cf7e69061fea9ab43cc03f3ab65b0d64922f97686515e50786941833ecb330d5d5a8054d97381a199b750016c17cad720f9ad6205b57608394c222dc1246204dd50a96c76f9269ef0d528f482a8f94f80607e868f7df26966127322413eb02df0d1749f3102c7fa	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuwexoy\e440f951 = 9cab1416c37048d277f09053dbb84d958dffc988c46318e79edf5ca8ad8dbce828e37ed62ec5417f30985accd452ce8d1e3bc8a86718d9599330e494f41c852e2d5aba7a0369c3afaf02bd26a2aa3097d56efa471b0710eb79	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuwexoy\5cfc9e34 = 8511aa15cdd4e808da4420dadc94b1845b3aaa06fa703cec9bcc05dfb0e8b30c37cb0a4db957c70a4f15b175b962d098a6828f8377f895d96a26ad472a0972a7a89fe423350680c74f72046cbfdb3a11c09a8edd1b39b27a12c0acd45938bf9e1a7505b3cdb40b375a	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuwexoy	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuwexoy\23b5f1c2 = ded3c878c5f7c06a0be3d90e1a610ca03a46fe713a5500a3ff94eebac2d5888fbe7ff23558867d5202b86bc2c91d2dbd51ae61917d0151c695cbb073c81069a8fa4a9c54ab14d9efd5f435f8df959bff42a15ea60676cae9d1f7a6999fa233aa0571cf44aee7d2bbf58bfb11708b97937b3ec576912babda3c10b4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuwexoy\9b0996a7 = 2d41a5fd3fbf91f48bbf171fc8b89332cc13a85d1766c61e3f8d495b2e134577ed5fee9cb49a05c8df2304ff81de173617d7147ae3360ac9ed5fe26bb77ccbbe54e9ff2e46e2a5a83f9be13152aa93b3aec67af5188b1907df22938d6659fc037a3a01d9d8463673dcbc8ff3ad	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuwexoy\162a218c = 651337fd3bb5b347bd635132b617d1d96b952ccd52b960c7d7e144f98b66ff7e3874a1f6bce509e0d4f604c7f9bcf8a738e38b405c743888f66e76cfeada6026186f2c124f52bfe27aebcf3a169cf505547738adb828db0bbe25b65dd5d392d20cdef4	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1768 rundll32.exe
1780 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1768 rundll32.exe
1780 regsvr32.exe

pid	process
1768	rundll32.exe
1780	regsvr32.exe

pid	process
1768	rundll32.exe
1780	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1476 wrote to memory of 1768	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1768	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1768	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1768	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1768	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1768	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1768	1476	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 896	1768	rundll32.exe	explorer.exe
PID 1768 wrote to memory of 896	1768	rundll32.exe	explorer.exe
PID 1768 wrote to memory of 896	1768	rundll32.exe	explorer.exe
PID 1768 wrote to memory of 896	1768	rundll32.exe	explorer.exe
PID 1768 wrote to memory of 896	1768	rundll32.exe	explorer.exe
PID 1768 wrote to memory of 896	1768	rundll32.exe	explorer.exe
PID 896 wrote to memory of 1644	896	explorer.exe	schtasks.exe
PID 896 wrote to memory of 1644	896	explorer.exe	schtasks.exe
PID 896 wrote to memory of 1644	896	explorer.exe	schtasks.exe
PID 896 wrote to memory of 1644	896	explorer.exe	schtasks.exe
PID 1916 wrote to memory of 1368	1916	taskeng.exe	regsvr32.exe
PID 1916 wrote to memory of 1368	1916	taskeng.exe	regsvr32.exe
PID 1916 wrote to memory of 1368	1916	taskeng.exe	regsvr32.exe
PID 1916 wrote to memory of 1368	1916	taskeng.exe	regsvr32.exe
PID 1916 wrote to memory of 1368	1916	taskeng.exe	regsvr32.exe
PID 1368 wrote to memory of 1780	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 1780	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 1780	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 1780	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 1780	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 1780	1368	regsvr32.exe	regsvr32.exe
PID 1368 wrote to memory of 1780	1368	regsvr32.exe	regsvr32.exe
PID 1780 wrote to memory of 1332	1780	regsvr32.exe	explorer.exe
PID 1780 wrote to memory of 1332	1780	regsvr32.exe	explorer.exe
PID 1780 wrote to memory of 1332	1780	regsvr32.exe	explorer.exe
PID 1780 wrote to memory of 1332	1780	regsvr32.exe	explorer.exe
PID 1780 wrote to memory of 1332	1780	regsvr32.exe	explorer.exe
PID 1780 wrote to memory of 1332	1780	regsvr32.exe	explorer.exe
PID 1332 wrote to memory of 1764	1332	explorer.exe	reg.exe
PID 1332 wrote to memory of 1764	1332	explorer.exe	reg.exe
PID 1332 wrote to memory of 1764	1332	explorer.exe	reg.exe
PID 1332 wrote to memory of 1764	1332	explorer.exe	reg.exe
PID 1332 wrote to memory of 1976	1332	explorer.exe	reg.exe
PID 1332 wrote to memory of 1976	1332	explorer.exe	reg.exe
PID 1332 wrote to memory of 1976	1332	explorer.exe	reg.exe
PID 1332 wrote to memory of 1976	1332	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\download.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\download.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn gzontory /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\download.dll\"" /SC ONCE /Z /ST 14:42 /ET 14:54
4⤵
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\taskeng.exe
taskeng.exe {612BAC8A-AFC4-4B56-9E49-C49304F7349A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\download.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\download.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Tpajknwwus" /d "0"
5⤵
PID:1764

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Oiybc" /d "0"
5⤵
PID:1976

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\download.dll
MD5
c93d00511f737f095ec5d32603fa52ab

SHA1
fd4e92245cec5b14bfc59bd496971f5397460ade

SHA256
20c3a399101410c9de0fcdc46c00d88f8e18cc36163b1cf6e1377f170d752214

SHA512
af232bff616470a7940b03ec85ccfbb8e9ca6a37ff003b57b0701482fbeaf96c847c748f72ac9dfbab852be3a6738094ada3826d21b584dc585d2e338c0228b7

Download Submit
\Users\Admin\AppData\Local\Temp\download.dll
MD5
c93d00511f737f095ec5d32603fa52ab

SHA1
fd4e92245cec5b14bfc59bd496971f5397460ade

SHA256
20c3a399101410c9de0fcdc46c00d88f8e18cc36163b1cf6e1377f170d752214

SHA512
af232bff616470a7940b03ec85ccfbb8e9ca6a37ff003b57b0701482fbeaf96c847c748f72ac9dfbab852be3a6738094ada3826d21b584dc585d2e338c0228b7

Download Submit
memory/896-63-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/896-65-0x0000000074C31000-0x0000000074C33000-memory.dmp

Filesize
8KB

Download
memory/896-66-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/1332-81-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1368-67-0x000007FEFBF31000-0x000007FEFBF33000-memory.dmp

Filesize
8KB

Download
memory/1768-61-0x00000000002B0000-0x00000000002D1000-memory.dmp

Filesize
132KB

Download
memory/1768-55-0x00000000758A1000-0x00000000758A3000-memory.dmp

Filesize
8KB

Download
memory/1768-59-0x0000000000200000-0x0000000000243000-memory.dmp

Filesize
268KB

Download
memory/1768-58-0x00000000002B0000-0x00000000002D1000-memory.dmp

Filesize
132KB

Download
memory/1768-62-0x00000000002B0000-0x00000000002D1000-memory.dmp

Filesize
132KB

Download
memory/1768-57-0x00000000002B0000-0x00000000002D1000-memory.dmp

Filesize
132KB

Download
memory/1768-56-0x0000000002030000-0x00000000021D8000-memory.dmp

Filesize
1.7MB

Download
memory/1768-60-0x00000000002B0000-0x00000000002D1000-memory.dmp

Filesize
132KB

Download
memory/1780-71-0x0000000000CD0000-0x0000000000E78000-memory.dmp

Filesize
1.7MB

Download
memory/1780-79-0x0000000000730000-0x0000000000773000-memory.dmp

Filesize
268KB

Download
memory/1780-80-0x00000000004C0000-0x00000000004E1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads