qakbot | eb53eb381f10eae793890008dc03387d87cc48bceabd22c190d62a9c66f85d9a

General

Target

eb53eb381f10eae793890008dc03387d87cc48bceabd22c190d62a9c66f85d9a.dll
Size

1.7MB
MD5

4e48b4dad167c049f715822ddd5802af
SHA1

1d0dd0b48364f17dbfc68f4a5bd6dcaccf00b614
SHA256

eb53eb381f10eae793890008dc03387d87cc48bceabd22c190d62a9c66f85d9a
SHA512

05c2945dc017bdc9233e8ac93c39faa26c6a1b37b300c2bb678cb7ec25fd73ce7253707ebe0972d995860b992f7b856a66035a54a2d9d5070d536d8bece8f653

Score

10^/10

qakbot obama153 1643117667 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama153

Campaign

1643117667

C2

217.128.93.27:2222

94.200.181.154:995

24.95.61.62:443

39.44.254.218:995

69.14.172.24:443

31.215.68.214:443

173.25.166.81:443

70.163.1.219:443

24.178.196.158:2222

89.101.97.139:443

108.4.67.252:443

217.128.171.34:2222

149.135.101.20:443

38.70.253.226:2222

24.222.20.254:443

74.15.2.252:2222

185.152.45.170:995

209.210.95.228:32100

71.74.12.34:443

180.233.150.134:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1716 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1056 schtasks.exe

pid	process
1716	regsvr32.exe

pid	process
1056	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kuhsxidre\fc319f48 = 7b8d8f5b20a5b53fcb00fa4d97264c6444923d2476e2ce6c08ac2fbfe0ee911e775f12bad4a5d3b4503d88df0fd69aa33ee69ad87f3657a82a7b506381cf625d399505d3cac2448f6fc6f8e11831632cee7da3ce2797fa4ad319825ab3e9327f4d1a20b62311d3e9b22fcb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kuhsxidre\8378f0be = acf9613407f5ba168b7d3423b07156826e7d1b5708dffb0c46dc2a2c4002944ee58c7d230d9d1d2a7c3ffe1883b78cf0e1af1988bd6bbff8292ee417e655f247c493a44cfe423d127debbb12396b02bc6b12445f463c3dc5cb78ded40ca0795647b781d5238c90ff25f05414	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kuhsxidre	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kuhsxidre\3985b7a7 = d5931d157610149e8e6d35765b5fffdddb23c560dbedeeff3946727ee5d3b0a1d9dd69064022577bf5311cc165cab7a86e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kuhsxidre\8139d0c2 = 44015257edb13598a4ec859eb94378e6e26446e24191272190d397028802c54c09905f0ac8641f03c09e8a536dda742c0db8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kuhsxidre\71122863 = 245d73240d7dad79e600ce29332da34fd2420d9f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kuhsxidre\e5b4795 = 894c9595162f3ba16d15fd8812a82d6b41017acbc9f8a4a81f09ee1e21b47dc80319f4dec5e82011a24f5fe063cddbee3558946f471ecf12f3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kuhsxidre\e5b4795 = 894c8295162f0e292e2b52f7fe0f9b4bd074ad5e2a16d643af3b17ae20a890fc2f5e3471	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kuhsxidre\3bc497db = 30bc1ffa0e1b7c667bd748d36cc41b68db04a37c643a64fc267b26cdd3e604628e908d8c242558a01a79c8900f2195d1ee48a13fefb0ca1bd105c067e2e039bc5ebe1f5b1c5b202caf996de0bdd304d240effa313fdcb22b7dfb0e0425bbbca5b435c636d88f5aa32a07cb19b5994528ef799b98e427d2a3ced057e2d240ad0776b82a4e512e1a750b39edf785324841a3aa41e57dd75c5e5600938640af	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Kuhsxidre\448df82d = 8780dd6fc6a25a01861c964867dbd47293ed2411a145aa54c7060928ebfed4599ad926928a60473981ce8b389b95d77b25	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

900 rundll32.exe
1716 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

900 rundll32.exe
1716 regsvr32.exe

pid	process
900	rundll32.exe
1716	regsvr32.exe

pid	process
900	rundll32.exe
1716	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1752 wrote to memory of 900	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 900	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 900	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 900	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 900	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 900	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 900	1752	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 576	900	rundll32.exe	explorer.exe
PID 900 wrote to memory of 576	900	rundll32.exe	explorer.exe
PID 900 wrote to memory of 576	900	rundll32.exe	explorer.exe
PID 900 wrote to memory of 576	900	rundll32.exe	explorer.exe
PID 900 wrote to memory of 576	900	rundll32.exe	explorer.exe
PID 900 wrote to memory of 576	900	rundll32.exe	explorer.exe
PID 576 wrote to memory of 1056	576	explorer.exe	schtasks.exe
PID 576 wrote to memory of 1056	576	explorer.exe	schtasks.exe
PID 576 wrote to memory of 1056	576	explorer.exe	schtasks.exe
PID 576 wrote to memory of 1056	576	explorer.exe	schtasks.exe
PID 1536 wrote to memory of 1736	1536	taskeng.exe	regsvr32.exe
PID 1536 wrote to memory of 1736	1536	taskeng.exe	regsvr32.exe
PID 1536 wrote to memory of 1736	1536	taskeng.exe	regsvr32.exe
PID 1536 wrote to memory of 1736	1536	taskeng.exe	regsvr32.exe
PID 1536 wrote to memory of 1736	1536	taskeng.exe	regsvr32.exe
PID 1736 wrote to memory of 1716	1736	regsvr32.exe	regsvr32.exe
PID 1736 wrote to memory of 1716	1736	regsvr32.exe	regsvr32.exe
PID 1736 wrote to memory of 1716	1736	regsvr32.exe	regsvr32.exe
PID 1736 wrote to memory of 1716	1736	regsvr32.exe	regsvr32.exe
PID 1736 wrote to memory of 1716	1736	regsvr32.exe	regsvr32.exe
PID 1736 wrote to memory of 1716	1736	regsvr32.exe	regsvr32.exe
PID 1736 wrote to memory of 1716	1736	regsvr32.exe	regsvr32.exe
PID 1716 wrote to memory of 972	1716	regsvr32.exe	explorer.exe
PID 1716 wrote to memory of 972	1716	regsvr32.exe	explorer.exe
PID 1716 wrote to memory of 972	1716	regsvr32.exe	explorer.exe
PID 1716 wrote to memory of 972	1716	regsvr32.exe	explorer.exe
PID 1716 wrote to memory of 972	1716	regsvr32.exe	explorer.exe
PID 1716 wrote to memory of 972	1716	regsvr32.exe	explorer.exe
PID 972 wrote to memory of 1828	972	explorer.exe	reg.exe
PID 972 wrote to memory of 1828	972	explorer.exe	reg.exe
PID 972 wrote to memory of 1828	972	explorer.exe	reg.exe
PID 972 wrote to memory of 1828	972	explorer.exe	reg.exe
PID 972 wrote to memory of 1908	972	explorer.exe	reg.exe
PID 972 wrote to memory of 1908	972	explorer.exe	reg.exe
PID 972 wrote to memory of 1908	972	explorer.exe	reg.exe
PID 972 wrote to memory of 1908	972	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb53eb381f10eae793890008dc03387d87cc48bceabd22c190d62a9c66f85d9a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb53eb381f10eae793890008dc03387d87cc48bceabd22c190d62a9c66f85d9a.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lcozntssft /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\eb53eb381f10eae793890008dc03387d87cc48bceabd22c190d62a9c66f85d9a.dll\"" /SC ONCE /Z /ST 02:02 /ET 02:14
4⤵
- Creates scheduled task(s)
PID:1056

C:\Windows\system32\taskeng.exe
taskeng.exe {40C406C6-6AAC-4686-9CC8-B2AB94258B40} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\eb53eb381f10eae793890008dc03387d87cc48bceabd22c190d62a9c66f85d9a.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\eb53eb381f10eae793890008dc03387d87cc48bceabd22c190d62a9c66f85d9a.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:972

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Fgyykyteyggu" /d "0"
5⤵
PID:1828

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Eygunqc" /d "0"
5⤵
PID:1908

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\eb53eb381f10eae793890008dc03387d87cc48bceabd22c190d62a9c66f85d9a.dll
MD5
4e48b4dad167c049f715822ddd5802af

SHA1
1d0dd0b48364f17dbfc68f4a5bd6dcaccf00b614

SHA256
eb53eb381f10eae793890008dc03387d87cc48bceabd22c190d62a9c66f85d9a

SHA512
05c2945dc017bdc9233e8ac93c39faa26c6a1b37b300c2bb678cb7ec25fd73ce7253707ebe0972d995860b992f7b856a66035a54a2d9d5070d536d8bece8f653

Download Submit
\Users\Admin\AppData\Local\Temp\eb53eb381f10eae793890008dc03387d87cc48bceabd22c190d62a9c66f85d9a.dll
MD5
4e48b4dad167c049f715822ddd5802af

SHA1
1d0dd0b48364f17dbfc68f4a5bd6dcaccf00b614

SHA256
eb53eb381f10eae793890008dc03387d87cc48bceabd22c190d62a9c66f85d9a

SHA512
05c2945dc017bdc9233e8ac93c39faa26c6a1b37b300c2bb678cb7ec25fd73ce7253707ebe0972d995860b992f7b856a66035a54a2d9d5070d536d8bece8f653

Download Submit
memory/576-63-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/576-66-0x0000000000140000-0x0000000000161000-memory.dmp

Filesize
132KB

Download
memory/576-65-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/900-60-0x0000000000130000-0x0000000000151000-memory.dmp

Filesize
132KB

Download
memory/900-58-0x0000000000130000-0x0000000000151000-memory.dmp

Filesize
132KB

Download
memory/900-62-0x0000000000130000-0x0000000000151000-memory.dmp

Filesize
132KB

Download
memory/900-55-0x00000000769D1000-0x00000000769D3000-memory.dmp

Filesize
8KB

Download
memory/900-59-0x0000000000130000-0x0000000000151000-memory.dmp

Filesize
132KB

Download
memory/900-57-0x0000000000130000-0x0000000000151000-memory.dmp

Filesize
132KB

Download
memory/900-56-0x0000000000920000-0x0000000000ACD000-memory.dmp

Filesize
1.7MB

Download
memory/900-61-0x0000000000340000-0x0000000000383000-memory.dmp

Filesize
268KB

Download
memory/972-79-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1716-71-0x0000000000BD0000-0x0000000000D7D000-memory.dmp

Filesize
1.7MB

Download
memory/1716-73-0x0000000000850000-0x0000000000871000-memory.dmp

Filesize
132KB

Download
memory/1716-72-0x0000000000850000-0x0000000000871000-memory.dmp

Filesize
132KB

Download
memory/1716-74-0x0000000000850000-0x0000000000871000-memory.dmp

Filesize
132KB

Download
memory/1716-75-0x0000000000850000-0x0000000000871000-memory.dmp

Filesize
132KB

Download
memory/1716-80-0x0000000000850000-0x0000000000871000-memory.dmp

Filesize
132KB

Download
memory/1736-67-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads