qakbot | 6db209cc52bbdf83633245e100130fd17d04fa50c923ddcfb2d616b750d4d557

General

Target

1338454339264410.dll
Size

1.6MB
MD5

8723cb4113dc8061fc8bb411829b4353
SHA1

99c75155c7a1aef5aa23c99256dc28905d9bc27b
SHA256

6db209cc52bbdf83633245e100130fd17d04fa50c923ddcfb2d616b750d4d557
SHA512

47b4b573a96f512a7c946c2fca157ae333a3f4a73fc480a1fbce6f2511fd6e57e9de1a250c628ea7a2f556f538134ccfa30e3147932418a76ea84f56f2ce0f2a

Score

10^/10

qakbot obama152 1643038242 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama152

Campaign

1643038242

C2

67.209.195.198:443

75.156.151.34:443

89.101.97.139:443

23.229.117.237:443

45.9.20.200:443

70.45.174.173:443

140.82.49.12:443

86.98.47.119:61200

96.246.158.154:995

185.249.85.209:443

89.114.156.182:995

92.99.167.144:2078

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

37.210.172.200:2222

82.152.39.39:443

70.51.153.245:2222

103.143.8.71:6881

39.49.110.129:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1580 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1812 schtasks.exe

pid	process
1580	regsvr32.exe

pid	process
1812	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ricgekiltmio\c8622c14 = 08c1101088f76542583ad509bb3c7146461b71177cc11a9c8ad262d3b6e4c551cd7d240a46d94f6ec2ed69ea7cc94855234317ffa38eda78d9f5df1c4f49729e287deebe55c323012fae927640310430f47def13a8db01177c0861276ad9ffe9d32abf6912578a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ricgekiltmio\729f6b0d = 11c67d38a71b45c857a904439f306814dd092fca61884d1e07a3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ricgekiltmio\f972487 = 6266746f137b868c7c045f424d1c27f9c7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ricgekiltmio\b72b43e2 = b077b398e28b103896b575c4596286b3793d61d2f3670cd0317099d584077c97cf9e6118b83ac485c6f9108eb8b992dcdeb88794045dabe1434effe5b828ce59d046d6b2f73bd6876f8e2433	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ricgekiltmio\82b493ac = 2ccd79ec2825ebdbf8dad1683323da30918d6322e0e9a6b17b72fe	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ricgekiltmio	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ricgekiltmio\fdfdfc5a = ea9c61a25402b98bce17b146993b1418470bf18c4ca411816cc9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ricgekiltmio\ca230c68 = 4b7f04e4ffd82827e5251539a2e2dbe866144adefcde7ffcd6e67c36a4c9ebf3a9c3ad2878bd3983907a45ca8ae4deb92713e84b0733a1dcc6701d9ff5656bacc93a0d363a21add53dec1a7a76296d323a60ceecefa3b5f50da1d06ff7e047d122fb7d192631eb27c7faf247dcaef9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ricgekiltmio\70de4b71 = 46b667a3d6ec77bd40abf6328a3e249c799f89ae880ab26d28598b6ce41ecc6e553701a103cfb231d7f7899278b1857437966c1e0e27647e89da757a8514b396be62684b062fddc8357f60e56c4f9b0ed7f63cfe700524c910565d47593b9db8fcb094a16222833d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ricgekiltmio\fdfdfc5a = ea9c76a254028c10ee137001eaa330fda3a460635f0b2c89e0fc97eef0cd0f408d4f26f483943e27aa99a0086ff141	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1556 rundll32.exe
1580 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1556 rundll32.exe
1580 regsvr32.exe

pid	process
1556	rundll32.exe
1580	regsvr32.exe

pid	process
1556	rundll32.exe
1580	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1272 wrote to memory of 1556	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1556	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1556	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1556	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1556	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1556	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 1556	1272	rundll32.exe	rundll32.exe
PID 1556 wrote to memory of 1504	1556	rundll32.exe	explorer.exe
PID 1556 wrote to memory of 1504	1556	rundll32.exe	explorer.exe
PID 1556 wrote to memory of 1504	1556	rundll32.exe	explorer.exe
PID 1556 wrote to memory of 1504	1556	rundll32.exe	explorer.exe
PID 1556 wrote to memory of 1504	1556	rundll32.exe	explorer.exe
PID 1556 wrote to memory of 1504	1556	rundll32.exe	explorer.exe
PID 1504 wrote to memory of 1812	1504	explorer.exe	schtasks.exe
PID 1504 wrote to memory of 1812	1504	explorer.exe	schtasks.exe
PID 1504 wrote to memory of 1812	1504	explorer.exe	schtasks.exe
PID 1504 wrote to memory of 1812	1504	explorer.exe	schtasks.exe
PID 1560 wrote to memory of 1752	1560	taskeng.exe	regsvr32.exe
PID 1560 wrote to memory of 1752	1560	taskeng.exe	regsvr32.exe
PID 1560 wrote to memory of 1752	1560	taskeng.exe	regsvr32.exe
PID 1560 wrote to memory of 1752	1560	taskeng.exe	regsvr32.exe
PID 1560 wrote to memory of 1752	1560	taskeng.exe	regsvr32.exe
PID 1752 wrote to memory of 1580	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1580	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1580	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1580	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1580	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1580	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 1580	1752	regsvr32.exe	regsvr32.exe
PID 1580 wrote to memory of 1052	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 1052	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 1052	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 1052	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 1052	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 1052	1580	regsvr32.exe	explorer.exe
PID 1052 wrote to memory of 1876	1052	explorer.exe	reg.exe
PID 1052 wrote to memory of 1876	1052	explorer.exe	reg.exe
PID 1052 wrote to memory of 1876	1052	explorer.exe	reg.exe
PID 1052 wrote to memory of 1876	1052	explorer.exe	reg.exe
PID 1052 wrote to memory of 1808	1052	explorer.exe	reg.exe
PID 1052 wrote to memory of 1808	1052	explorer.exe	reg.exe
PID 1052 wrote to memory of 1808	1052	explorer.exe	reg.exe
PID 1052 wrote to memory of 1808	1052	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1338454339264410.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1338454339264410.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yaqsgfkj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\1338454339264410.dll\"" /SC ONCE /Z /ST 17:39 /ET 17:51
4⤵
- Creates scheduled task(s)
PID:1812

C:\Windows\system32\taskeng.exe
taskeng.exe {7439DB27-340B-48D3-9191-4F296E3B69F5} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\1338454339264410.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\1338454339264410.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Fpfwbifez" /d "0"
5⤵
PID:1876

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Zeruun" /d "0"
5⤵
PID:1808

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1338454339264410.dll
MD5
8723cb4113dc8061fc8bb411829b4353

SHA1
99c75155c7a1aef5aa23c99256dc28905d9bc27b

SHA256
6db209cc52bbdf83633245e100130fd17d04fa50c923ddcfb2d616b750d4d557

SHA512
47b4b573a96f512a7c946c2fca157ae333a3f4a73fc480a1fbce6f2511fd6e57e9de1a250c628ea7a2f556f538134ccfa30e3147932418a76ea84f56f2ce0f2a

Download Submit
\Users\Admin\AppData\Local\Temp\1338454339264410.dll
MD5
8723cb4113dc8061fc8bb411829b4353

SHA1
99c75155c7a1aef5aa23c99256dc28905d9bc27b

SHA256
6db209cc52bbdf83633245e100130fd17d04fa50c923ddcfb2d616b750d4d557

SHA512
47b4b573a96f512a7c946c2fca157ae333a3f4a73fc480a1fbce6f2511fd6e57e9de1a250c628ea7a2f556f538134ccfa30e3147932418a76ea84f56f2ce0f2a

Download Submit
memory/1052-80-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1504-63-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/1504-66-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1504-65-0x00000000742A1000-0x00000000742A3000-memory.dmp

Filesize
8KB

Download
memory/1556-60-0x00000000003A0000-0x00000000003C1000-memory.dmp

Filesize
132KB

Download
memory/1556-58-0x00000000003A0000-0x00000000003C1000-memory.dmp

Filesize
132KB

Download
memory/1556-61-0x0000000000410000-0x0000000000453000-memory.dmp

Filesize
268KB

Download
memory/1556-55-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download
memory/1556-59-0x00000000003A0000-0x00000000003C1000-memory.dmp

Filesize
132KB

Download
memory/1556-56-0x0000000001F10000-0x00000000020B8000-memory.dmp

Filesize
1.7MB

Download
memory/1556-57-0x00000000003A0000-0x00000000003C1000-memory.dmp

Filesize
132KB

Download
memory/1556-62-0x00000000003A0000-0x00000000003C1000-memory.dmp

Filesize
132KB

Download
memory/1580-71-0x0000000000AA0000-0x0000000000C48000-memory.dmp

Filesize
1.7MB

Download
memory/1580-72-0x00000000003D0000-0x00000000003F1000-memory.dmp

Filesize
132KB

Download
memory/1580-73-0x00000000003D0000-0x00000000003F1000-memory.dmp

Filesize
132KB

Download
memory/1580-74-0x00000000003D0000-0x00000000003F1000-memory.dmp

Filesize
132KB

Download
memory/1580-75-0x00000000003D0000-0x00000000003F1000-memory.dmp

Filesize
132KB

Download
memory/1580-79-0x00000000003D0000-0x00000000003F1000-memory.dmp

Filesize
132KB

Download
memory/1752-67-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads