qakbot | baad4165318587463cd3bd68857e6ebb43b8b184a8e9af133da1c786a0dd7a21

General

Target

baad4165318587463cd3bd68857e6ebb43b8b184a8e9af133da1c786a0dd7a21.dll
Size

1.6MB
MD5

e3f83088ef45ddc292cac1cae9889dbf
SHA1

28fabe1beaedcc10f6327c3d749d3683ff63da70
SHA256

baad4165318587463cd3bd68857e6ebb43b8b184a8e9af133da1c786a0dd7a21
SHA512

ad7e91594bb7a40f1594d702fc50933606a9325409b0e6c1f46b2c174e05016c15cda61738969383b4076e9b4b17551df7e3930317649f5fa2cc9c58cf284741

Score

10^/10

qakbot obama152 1643038242 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama152

Campaign

1643038242

C2

67.209.195.198:443

75.156.151.34:443

89.101.97.139:443

23.229.117.237:443

45.9.20.200:443

70.45.174.173:443

140.82.49.12:443

86.98.47.119:61200

96.246.158.154:995

185.249.85.209:443

89.114.156.182:995

92.99.167.144:2078

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

37.210.172.200:2222

82.152.39.39:443

70.51.153.245:2222

103.143.8.71:6881

39.49.110.129:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1708 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

832 schtasks.exe

pid	process
1708	regsvr32.exe

pid	process
832	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uocellan	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uocellan\8773cbfb = a0e01380078dba0f5330b8f82b145c4e18dfe9aaaa23bb015a9126c1947b388bc19f18a1eb28b1fa585813cd1775ded185370d57fd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uocellan\b2ec1bb5 = 57da7665b6c6145736eaa3e8cc73a3c33c1737774932fd4f4fc59a20611a2242ac531f4fed8da04d2d86e68f929e617ee3ad6e6d89e7b2c5ea6e8292c04022bf2ea2e5f3064cbe004791b5c87bc91c9410e77036dbd699f44777860f481c3fa7ff9ba9a6908a3c7636ee268926d666022914752a762cdd2182cecb3ea5751b4f8f338751f3fb5b4bb923bb6b8bb619669c2ab8c7d81ab6434675bb3f5a008ad3f0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uocellan\75191326 = 0000e58da55abef20aa89668f39f60b0fc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uocellan\a507cd0 = 543174f9d6ed5aca5a4d9184c65b9a443309ca924ebf7ff55e97cac9e32b4360a3f8eaf418fce1c79bc62f762d7f18ad27f0ccee429490bc32c57e63af0b252821e1d35a7cc167a916bca3dcb0b05e0e84494e117c7ccdebb1fd8bf0b4eda074	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uocellan\f83aa40d = 035ee81dde5eb15a32d0f27874d9e03671e232aed6ad5dc6fe4ba9a48ab8c985299ebf84684043c63e09cacdd4807a54908905d7b0513bbf2ba63d56df4653c2f401e5d0b1b0d30f8b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uocellan\b0ad3bc9 = e46c3b2d1264b0d75a88bbfb8febb6fca43428d24b1c1bb892a365cba5a18d69e12881f617170be63001d8ad3676b99564aca5390f70140951e2afc6ac27a44a6de9b290fb0ab3583ce217	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uocellan\8115cac = e7dab52a964c69efe37304f847af0860275bd0e8f8308a777a18acfbcb335a14895b511d962aa9df52e5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uocellan\cda57443 = 35f9394b3dc1a951ddd852c13794	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uocellan\8773cbfb = a0e00480078d8f539871acf4db0f59da38a488461e1361518ac79d309143cbea76080fbe71cfbca4e7c66a144931dc3d04030be15df149d6be6eabffce5073abc151f6581fe910b4c82f	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1736 rundll32.exe
1708 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1736 rundll32.exe
1708 regsvr32.exe

pid	process
1736	rundll32.exe
1708	regsvr32.exe

pid	process
1736	rundll32.exe
1708	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1532 wrote to memory of 1736	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1736	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1736	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1736	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1736	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1736	1532	rundll32.exe	rundll32.exe
PID 1532 wrote to memory of 1736	1532	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 864	1736	rundll32.exe	explorer.exe
PID 1736 wrote to memory of 864	1736	rundll32.exe	explorer.exe
PID 1736 wrote to memory of 864	1736	rundll32.exe	explorer.exe
PID 1736 wrote to memory of 864	1736	rundll32.exe	explorer.exe
PID 1736 wrote to memory of 864	1736	rundll32.exe	explorer.exe
PID 1736 wrote to memory of 864	1736	rundll32.exe	explorer.exe
PID 864 wrote to memory of 832	864	explorer.exe	schtasks.exe
PID 864 wrote to memory of 832	864	explorer.exe	schtasks.exe
PID 864 wrote to memory of 832	864	explorer.exe	schtasks.exe
PID 864 wrote to memory of 832	864	explorer.exe	schtasks.exe
PID 1664 wrote to memory of 1824	1664	taskeng.exe	regsvr32.exe
PID 1664 wrote to memory of 1824	1664	taskeng.exe	regsvr32.exe
PID 1664 wrote to memory of 1824	1664	taskeng.exe	regsvr32.exe
PID 1664 wrote to memory of 1824	1664	taskeng.exe	regsvr32.exe
PID 1664 wrote to memory of 1824	1664	taskeng.exe	regsvr32.exe
PID 1824 wrote to memory of 1708	1824	regsvr32.exe	regsvr32.exe
PID 1824 wrote to memory of 1708	1824	regsvr32.exe	regsvr32.exe
PID 1824 wrote to memory of 1708	1824	regsvr32.exe	regsvr32.exe
PID 1824 wrote to memory of 1708	1824	regsvr32.exe	regsvr32.exe
PID 1824 wrote to memory of 1708	1824	regsvr32.exe	regsvr32.exe
PID 1824 wrote to memory of 1708	1824	regsvr32.exe	regsvr32.exe
PID 1824 wrote to memory of 1708	1824	regsvr32.exe	regsvr32.exe
PID 1708 wrote to memory of 2024	1708	regsvr32.exe	explorer.exe
PID 1708 wrote to memory of 2024	1708	regsvr32.exe	explorer.exe
PID 1708 wrote to memory of 2024	1708	regsvr32.exe	explorer.exe
PID 1708 wrote to memory of 2024	1708	regsvr32.exe	explorer.exe
PID 1708 wrote to memory of 2024	1708	regsvr32.exe	explorer.exe
PID 1708 wrote to memory of 2024	1708	regsvr32.exe	explorer.exe
PID 2024 wrote to memory of 1792	2024	explorer.exe	reg.exe
PID 2024 wrote to memory of 1792	2024	explorer.exe	reg.exe
PID 2024 wrote to memory of 1792	2024	explorer.exe	reg.exe
PID 2024 wrote to memory of 1792	2024	explorer.exe	reg.exe
PID 2024 wrote to memory of 1812	2024	explorer.exe	reg.exe
PID 2024 wrote to memory of 1812	2024	explorer.exe	reg.exe
PID 2024 wrote to memory of 1812	2024	explorer.exe	reg.exe
PID 2024 wrote to memory of 1812	2024	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\baad4165318587463cd3bd68857e6ebb43b8b184a8e9af133da1c786a0dd7a21.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\baad4165318587463cd3bd68857e6ebb43b8b184a8e9af133da1c786a0dd7a21.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hzxdsks /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\baad4165318587463cd3bd68857e6ebb43b8b184a8e9af133da1c786a0dd7a21.dll\"" /SC ONCE /Z /ST 16:11 /ET 16:23
4⤵
- Creates scheduled task(s)
PID:832

C:\Windows\system32\taskeng.exe
taskeng.exe {92F3499A-FDCE-453C-9C6C-B091232C9A1C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\baad4165318587463cd3bd68857e6ebb43b8b184a8e9af133da1c786a0dd7a21.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\baad4165318587463cd3bd68857e6ebb43b8b184a8e9af133da1c786a0dd7a21.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Movppz" /d "0"
5⤵
PID:1792

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Gkftphmszc" /d "0"
5⤵
PID:1812

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\baad4165318587463cd3bd68857e6ebb43b8b184a8e9af133da1c786a0dd7a21.dll
MD5
e3f83088ef45ddc292cac1cae9889dbf

SHA1
28fabe1beaedcc10f6327c3d749d3683ff63da70

SHA256
baad4165318587463cd3bd68857e6ebb43b8b184a8e9af133da1c786a0dd7a21

SHA512
ad7e91594bb7a40f1594d702fc50933606a9325409b0e6c1f46b2c174e05016c15cda61738969383b4076e9b4b17551df7e3930317649f5fa2cc9c58cf284741

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\baad4165318587463cd3bd68857e6ebb43b8b184a8e9af133da1c786a0dd7a21.dll
MD5
e3f83088ef45ddc292cac1cae9889dbf

SHA1
28fabe1beaedcc10f6327c3d749d3683ff63da70

SHA256
baad4165318587463cd3bd68857e6ebb43b8b184a8e9af133da1c786a0dd7a21

SHA512
ad7e91594bb7a40f1594d702fc50933606a9325409b0e6c1f46b2c174e05016c15cda61738969383b4076e9b4b17551df7e3930317649f5fa2cc9c58cf284741

Download Submit
memory/864-63-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download
memory/864-66-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/864-65-0x0000000075031000-0x0000000075033000-memory.dmp

Filesize
8KB

Download
memory/1708-73-0x0000000000850000-0x0000000000871000-memory.dmp

Filesize
132KB

Download
memory/1708-71-0x0000000000AF0000-0x0000000000C98000-memory.dmp

Filesize
1.7MB

Download
memory/1708-80-0x0000000000850000-0x0000000000871000-memory.dmp

Filesize
132KB

Download
memory/1708-74-0x0000000000850000-0x0000000000871000-memory.dmp

Filesize
132KB

Download
memory/1708-75-0x0000000000850000-0x0000000000871000-memory.dmp

Filesize
132KB

Download
memory/1708-72-0x0000000000850000-0x0000000000871000-memory.dmp

Filesize
132KB

Download
memory/1736-59-0x0000000000280000-0x00000000002A1000-memory.dmp

Filesize
132KB

Download
memory/1736-58-0x0000000000280000-0x00000000002A1000-memory.dmp

Filesize
132KB

Download
memory/1736-57-0x0000000000280000-0x00000000002A1000-memory.dmp

Filesize
132KB

Download
memory/1736-55-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download
memory/1736-62-0x0000000000280000-0x00000000002A1000-memory.dmp

Filesize
132KB

Download
memory/1736-60-0x0000000000280000-0x00000000002A1000-memory.dmp

Filesize
132KB

Download
memory/1736-56-0x0000000001DE0000-0x0000000001F88000-memory.dmp

Filesize
1.7MB

Download
memory/1736-61-0x00000000002C0000-0x0000000000303000-memory.dmp

Filesize
268KB

Download
memory/1824-67-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

Filesize
8KB

Download
memory/2024-81-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads