qakbot | d2444eb17f713452c16ff5b0b6f11dcd9ba424f318e7f96d61e2460d490d5394

General

Target

d2444eb17f713452c16ff5b0b6f11dcd9ba424f318e7f96d61e2460d490d5394.dll
Size

1.7MB
MD5

d94f84eef2dfb0498734b4bdc57ef7af
SHA1

abed6df13f5fa09bb977023ce16fdc3372f77ab0
SHA256

d2444eb17f713452c16ff5b0b6f11dcd9ba424f318e7f96d61e2460d490d5394
SHA512

0d09ad95185561ed7682f11dccf384bfbd0c1a402d587f1e09a3b479a987b5c9aa6cc24b7d9bed4d191efabc0ea05f0d20e089bb39b73ed4626ee4503dd49353

Score

10^/10

qakbot obama153 1643117667 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama153

Campaign

1643117667

C2

217.128.93.27:2222

94.200.181.154:995

24.95.61.62:443

39.44.254.218:995

69.14.172.24:443

31.215.68.214:443

173.25.166.81:443

70.163.1.219:443

24.178.196.158:2222

89.101.97.139:443

108.4.67.252:443

217.128.171.34:2222

149.135.101.20:443

38.70.253.226:2222

24.222.20.254:443

74.15.2.252:2222

185.152.45.170:995

209.210.95.228:32100

71.74.12.34:443

180.233.150.134:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1556 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1520 schtasks.exe

pid	process
1556	regsvr32.exe

pid	process
1520	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Azegrkuounc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azegrkuounc\6119ef94 = a1741cfd74c5e4cf5ae1f2f55d5be4178b528401e7e175e1afc8dc7d4b55d12b77b836f83500ca61d094743e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azegrkuounc\1c11a01e = bdbe39be8eb8fb9b228453e43d235be2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azegrkuounc\6358cfe8 = aeb5bd4143406fa628c928fdd4b64d97231dc7c785dac33517f3f7507c436c21712bb941738d5abea128ee	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azegrkuounc\ee7b78c3 = 17a08ccab7a552b8d295693aaaf2c61dc689da298b2874f782764360896e97e78f238845a58a4723ae4c7e0b199ca11e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azegrkuounc\ee7b78c3 = 17a09bcab7a5678b2c30bcb01a292e48a92030717c27935ecdee42	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azegrkuounc\dbe4a88d = 22018dac7cdc9dfe6b33fc52d52c2215bcf98cb29db65ea665452b593fda06f979a7d89d7b3fbe06a5fc45187873cbf870e9b3c28c9a375d079d172b27ecfe2787f18b5e8cb96b8434562bba124ed4827f0d59f9115ecdec5f4c48ccdc299cebf73ebca07cb2167de6ac403e41a09e9ef8f691a2a786abb09201f40afb5262cf6db185c8428decc527751ccd96eab6ccd02813a34953bd89bb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azegrkuounc\d9a588f1 = a138271196990e89123c7ffe62642e11dc211241f14d4ab4a785f3f6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azegrkuounc\a4adc77b = f7fedf1142f7941625342093e6c47d88cfad1ab375ec6ed7bd9396481685c0f918e937068e132c7161f7aeaf7a1aa4dde4f9d417af31	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azegrkuounc\91321735 = 35a63205f0a47dec9913b91612dbdc77be09de78e8715053a5708399	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2040 rundll32.exe
1556 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2040 rundll32.exe
1556 regsvr32.exe

pid	process
2040	rundll32.exe
1556	regsvr32.exe

pid	process
2040	rundll32.exe
1556	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1900 wrote to memory of 2040	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 2040	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 2040	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 2040	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 2040	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 2040	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 2040	1900	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1064	2040	rundll32.exe	explorer.exe
PID 2040 wrote to memory of 1064	2040	rundll32.exe	explorer.exe
PID 2040 wrote to memory of 1064	2040	rundll32.exe	explorer.exe
PID 2040 wrote to memory of 1064	2040	rundll32.exe	explorer.exe
PID 2040 wrote to memory of 1064	2040	rundll32.exe	explorer.exe
PID 2040 wrote to memory of 1064	2040	rundll32.exe	explorer.exe
PID 1064 wrote to memory of 1520	1064	explorer.exe	schtasks.exe
PID 1064 wrote to memory of 1520	1064	explorer.exe	schtasks.exe
PID 1064 wrote to memory of 1520	1064	explorer.exe	schtasks.exe
PID 1064 wrote to memory of 1520	1064	explorer.exe	schtasks.exe
PID 1624 wrote to memory of 1104	1624	taskeng.exe	regsvr32.exe
PID 1624 wrote to memory of 1104	1624	taskeng.exe	regsvr32.exe
PID 1624 wrote to memory of 1104	1624	taskeng.exe	regsvr32.exe
PID 1624 wrote to memory of 1104	1624	taskeng.exe	regsvr32.exe
PID 1624 wrote to memory of 1104	1624	taskeng.exe	regsvr32.exe
PID 1104 wrote to memory of 1556	1104	regsvr32.exe	regsvr32.exe
PID 1104 wrote to memory of 1556	1104	regsvr32.exe	regsvr32.exe
PID 1104 wrote to memory of 1556	1104	regsvr32.exe	regsvr32.exe
PID 1104 wrote to memory of 1556	1104	regsvr32.exe	regsvr32.exe
PID 1104 wrote to memory of 1556	1104	regsvr32.exe	regsvr32.exe
PID 1104 wrote to memory of 1556	1104	regsvr32.exe	regsvr32.exe
PID 1104 wrote to memory of 1556	1104	regsvr32.exe	regsvr32.exe
PID 1556 wrote to memory of 1756	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 1756	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 1756	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 1756	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 1756	1556	regsvr32.exe	explorer.exe
PID 1556 wrote to memory of 1756	1556	regsvr32.exe	explorer.exe
PID 1756 wrote to memory of 308	1756	explorer.exe	reg.exe
PID 1756 wrote to memory of 308	1756	explorer.exe	reg.exe
PID 1756 wrote to memory of 308	1756	explorer.exe	reg.exe
PID 1756 wrote to memory of 308	1756	explorer.exe	reg.exe
PID 1756 wrote to memory of 1752	1756	explorer.exe	reg.exe
PID 1756 wrote to memory of 1752	1756	explorer.exe	reg.exe
PID 1756 wrote to memory of 1752	1756	explorer.exe	reg.exe
PID 1756 wrote to memory of 1752	1756	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2444eb17f713452c16ff5b0b6f11dcd9ba424f318e7f96d61e2460d490d5394.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2444eb17f713452c16ff5b0b6f11dcd9ba424f318e7f96d61e2460d490d5394.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lzuezblh /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\d2444eb17f713452c16ff5b0b6f11dcd9ba424f318e7f96d61e2460d490d5394.dll\"" /SC ONCE /Z /ST 18:02 /ET 18:14
4⤵
- Creates scheduled task(s)
PID:1520

C:\Windows\system32\taskeng.exe
taskeng.exe {0E7E7B8D-DCFC-4D10-A585-177DF09E2F27} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\d2444eb17f713452c16ff5b0b6f11dcd9ba424f318e7f96d61e2460d490d5394.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\d2444eb17f713452c16ff5b0b6f11dcd9ba424f318e7f96d61e2460d490d5394.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Qzyhbkkzm" /d "0"
5⤵
PID:308

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Xnizxwxcpu" /d "0"
5⤵
PID:1752

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d2444eb17f713452c16ff5b0b6f11dcd9ba424f318e7f96d61e2460d490d5394.dll
MD5
d94f84eef2dfb0498734b4bdc57ef7af

SHA1
abed6df13f5fa09bb977023ce16fdc3372f77ab0

SHA256
d2444eb17f713452c16ff5b0b6f11dcd9ba424f318e7f96d61e2460d490d5394

SHA512
0d09ad95185561ed7682f11dccf384bfbd0c1a402d587f1e09a3b479a987b5c9aa6cc24b7d9bed4d191efabc0ea05f0d20e089bb39b73ed4626ee4503dd49353

Download Submit
\Users\Admin\AppData\Local\Temp\d2444eb17f713452c16ff5b0b6f11dcd9ba424f318e7f96d61e2460d490d5394.dll
MD5
d94f84eef2dfb0498734b4bdc57ef7af

SHA1
abed6df13f5fa09bb977023ce16fdc3372f77ab0

SHA256
d2444eb17f713452c16ff5b0b6f11dcd9ba424f318e7f96d61e2460d490d5394

SHA512
0d09ad95185561ed7682f11dccf384bfbd0c1a402d587f1e09a3b479a987b5c9aa6cc24b7d9bed4d191efabc0ea05f0d20e089bb39b73ed4626ee4503dd49353

Download Submit
memory/1064-63-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download
memory/1064-66-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/1064-65-0x0000000074C41000-0x0000000074C43000-memory.dmp

Filesize
8KB

Download
memory/1104-67-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Filesize
8KB

Download
memory/1556-73-0x0000000000660000-0x0000000000681000-memory.dmp

Filesize
132KB

Download
memory/1556-71-0x0000000000C10000-0x0000000000DBD000-memory.dmp

Filesize
1.7MB

Download
memory/1556-79-0x0000000000350000-0x0000000000393000-memory.dmp

Filesize
268KB

Download
memory/1556-80-0x0000000000660000-0x0000000000681000-memory.dmp

Filesize
132KB

Download
memory/1556-74-0x0000000000660000-0x0000000000681000-memory.dmp

Filesize
132KB

Download
memory/1556-75-0x0000000000660000-0x0000000000681000-memory.dmp

Filesize
132KB

Download
memory/1556-72-0x0000000000660000-0x0000000000681000-memory.dmp

Filesize
132KB

Download
memory/1756-81-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2040-59-0x0000000000180000-0x00000000001A1000-memory.dmp

Filesize
132KB

Download
memory/2040-55-0x00000000760F1000-0x00000000760F3000-memory.dmp

Filesize
8KB

Download
memory/2040-56-0x0000000001F50000-0x00000000020FD000-memory.dmp

Filesize
1.7MB

Download
memory/2040-57-0x00000000002D0000-0x0000000000313000-memory.dmp

Filesize
268KB

Download
memory/2040-58-0x0000000000180000-0x00000000001A1000-memory.dmp

Filesize
132KB

Download
memory/2040-62-0x0000000000180000-0x00000000001A1000-memory.dmp

Filesize
132KB

Download
memory/2040-60-0x0000000000180000-0x00000000001A1000-memory.dmp

Filesize
132KB

Download
memory/2040-61-0x0000000000180000-0x00000000001A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads