qakbot | 3b4de7c37664c56a2b5ba8feef2b41b11fab5e208421d148fe4717fc6da6f4db

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-en-20211208
submitted
17/02/2022, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3b4de7c37664c56a2b5ba8feef2b41b11fab5e208421d148fe4717fc6da6f4db.dll
Size 1.5MB
Sample220217-rl99gsbcc2
SHA256 3b4de7c37664c56a2b5ba8feef2b41b11fab5e208421d148fe4717fc6da6f4db
MD5 7c989f9bca28b50ed51bad93c652abc7
SHA1 e22361d62b04a11667d4f0cf6f468a313707ce41
SHA512 1313cd5cd37591e7fc4d677b1793f381641feac4d13f1ae8b9f567a9f57f867d79889c0f4ac697212c2bd151679a307fcd53df1af8a0b54ef3a7453fcd50bc97
MD5 SHA1 SHA512

Score

10^/10

qakbot obama157 1645089451 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.509

Botnet

obama157

Campaign

1645089451

190.73.3.148:2222
217.164.115.166:2222
136.232.34.70:443
92.177.45.46:2078
102.47.31.216:995
217.128.171.34:2222
149.135.101.20:443
105.184.116.32:995
136.143.11.232:443
103.142.10.177:443
197.89.21.163:443
197.92.132.79:443
176.67.56.94:443
66.230.104.103:443
206.217.0.154:995
186.64.87.194:443
47.180.172.159:50010
82.152.39.39:443
140.82.49.12:443
119.158.116.122:995
47.180.172.159:443
209.210.95.228:32100
75.99.168.194:443
103.17.101.139:995
111.125.245.116:995
31.215.206.13:443
116.72.55.13:443
45.241.208.225:995
39.44.150.120:995
39.52.21.207:993
180.233.150.134:995
41.230.62.211:993
180.183.99.37:2222
24.178.196.158:2222
89.101.97.139:443
173.174.216.62:443
182.191.92.203:995
86.98.156.24:32101
103.139.242.30:990
32.221.231.1:443
89.211.179.202:2222
67.209.195.198:443
39.52.21.207:995
69.14.172.24:443
173.220.98.101:443
75.156.151.34:443
1.161.88.84:995
39.53.161.84:995
208.107.221.224:443
2.50.41.69:61200
31.35.28.29:443
176.45.252.83:995
175.137.153.178:443
120.61.1.152:443
189.146.51.56:443
37.211.176.26:61202
217.128.122.65:2222
128.106.122.39:443
102.65.38.67:443
1.161.88.84:443
75.188.35.168:443
74.15.2.252:2222
139.64.13.189:443
217.165.109.191:993
67.165.206.193:993
173.21.10.71:2222
75.99.168.194:61201
73.151.236.31:443
71.74.12.34:443
72.66.116.235:995
70.51.137.204:2222
200.104.16.99:993
108.4.67.252:443
184.149.30.83:2222
190.206.211.182:443
100.1.108.246:443
72.252.201.34:995
86.198.170.170:2222
177.204.115.148:443
70.45.27.254:443
72.252.201.34:990
41.228.22.180:443
96.21.251.127:2222
78.96.235.245:443
76.25.142.196:443
120.150.218.241:995
45.46.53.140:2222
45.9.20.200:443
24.231.158.110:995
24.152.219.253:995
96.246.158.154:995
109.12.111.14:443
217.164.117.243:1194
86.108.123.52:443
196.206.66.89:443
217.164.117.243:2222
107.171.241.236:2222
41.84.233.153:443
89.86.33.217:443
114.79.148.170:443
39.49.125.85:995
5.48.205.15:443
86.98.151.68:995
103.116.178.85:443
78.87.41.5:995
182.176.180.73:443
102.132.145.147:443
47.180.172.159:993
177.205.28.80:443
78.191.55.146:995
86.98.11.110:443
24.53.49.240:443
72.12.115.90:22
139.64.34.193:443
72.12.115.90:995
72.12.115.90:2083
72.12.115.90:990
161.142.54.62:443
72.12.115.90:993
72.12.115.90:2078
72.12.115.90:465
72.12.115.90:3389
72.12.115.90:443
41.205.12.24:443
68.204.7.158:443
117.248.109.38:21
24.222.20.254:443
89.137.52.44:443
67.69.166.79:2222
86.98.55.231:995
122.96.50.104:2222
75.67.73.144:443
73.59.201.174:443
96.37.113.36:993
38.70.253.226:2222
109.51.132.148:995
76.23.237.163:995
220.255.25.1:2222
82.41.63.217:443
86.97.161.184:443
184.100.174.73:443
87.71.18.6:443
218.101.110.3:995
94.60.254.81:443
103.27.22.162:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
1488	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
292	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Worknreygend\a162aab7 = bbf4cd26161af045a652c010586c07c7c6859dc1b19159fbd4f250fc0ad799a7de5ff88821	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Worknreygend\6697a224 = 34ab898f3a60eaa0420d46f7f88b627ac3c968f61f9bdeeec0208d3145d4abd115baca1d3a7c249f4d5f8b3202bfb367b31e79ff68836635eed7f161c243b1b968276bc05a3c89b7f58f75b68a9f1ea569985c8b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Worknreygend\ebb4150f = 46c1e375f7b24ac3cd3fb2b9b1507622865460c3b218bf711706d042742c3818244da52fdb6dbcdbd94ab7c7fe7932098b60ed35bb254d509f142eeea77c6ff713f7f358f2a7e2312f21491a46c553f75eeb9c8116113b0dc3c8b6b372b3ec055ae42bed556fd7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Worknreygend\de2bc541 = 7b72b986dccc87d89242ed255f829ae2238c32383ae89b7ca42b1f62a504115618398245a03efbcbc98abff6ea57b9dd9d698385844453cc11686025f55be629684d40985f6b4b03052d338d7993227768d2f421909706031170c5d48a00f9d4c471afa25af08c6e14aa9be31404a58c5663250732120c540a2d72b7818fd96621d15a3c031db3cbaffff2ba2780e56d86a700b0ae14a93840db3d47c690093af77bd90ecb020042007334d5fb817200b5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Worknreygend\19decdd2 = e97a7cb5f48dd218498d34d59815f1cd8145f584c3318cfac7be445808f8aa9c9ad2029a6652369c3b2eb4922d6bf68630f314f6deac674061d2d8f4dbe9bab4f3a38381d7cb74898dd50760559ad2d5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Worknreygend\dc6ae53d = e3466b310660ca1b1f70d809255a2ed3019df5bfc48a72b5d09ee92a39864ab69483cb810a92c14a78ebdc17124c60bd19f3a777747ddae962439c51bf6db7b9dee8267bed330c391c24def6361a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Worknreygend\64d68258 = f4ef907d6b1a4e53103d74c3a8061d5bfd3f7f4932c8bff6a6e9fa25399199173dbf1109df	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Worknreygend\94fd7af9 = f649eaad13ecdc8b308322fd337f2e1ec9cedeeeff3de1145f95302243efe5db6ef4ea824c8868f6a87c85f6672e3dbef2c25171aa988a8e235b8c6c1eb41f204855f21df7acf95488dae9d28a917c8f76991c1ef21abd	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Worknreygend	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Worknreygend\ebb4150f = 46c1f475f7b27f3affa8841f1c81f7461eb193d52faa0ee940c1dcd33658dcd1592a70f65ca47cc1a487d72f33ad7d64916a17c71ee2a783505f399afe20669be4b8bfb58e1ea7c599fd10c7431aaa7bc4c5	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1588	rundll32.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1588	rundll32.exe
1488	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1588	1368	rundll32.exe	27
PID 1368 wrote to memory of 1588	1368	rundll32.exe	27
PID 1368 wrote to memory of 1588	1368	rundll32.exe	27
PID 1368 wrote to memory of 1588	1368	rundll32.exe	27
PID 1368 wrote to memory of 1588	1368	rundll32.exe	27
PID 1368 wrote to memory of 1588	1368	rundll32.exe	27
PID 1368 wrote to memory of 1588	1368	rundll32.exe	27
PID 1588 wrote to memory of 1200	1588	rundll32.exe	28
PID 1588 wrote to memory of 1200	1588	rundll32.exe	28
PID 1588 wrote to memory of 1200	1588	rundll32.exe	28
PID 1588 wrote to memory of 1200	1588	rundll32.exe	28
PID 1588 wrote to memory of 1200	1588	rundll32.exe	28
PID 1588 wrote to memory of 1200	1588	rundll32.exe	28
PID 1200 wrote to memory of 292	1200	explorer.exe	29
PID 1200 wrote to memory of 292	1200	explorer.exe	29
PID 1200 wrote to memory of 292	1200	explorer.exe	29
PID 1200 wrote to memory of 292	1200	explorer.exe	29
PID 1348 wrote to memory of 836	1348	taskeng.exe	34
PID 1348 wrote to memory of 836	1348	taskeng.exe	34
PID 1348 wrote to memory of 836	1348	taskeng.exe	34
PID 1348 wrote to memory of 836	1348	taskeng.exe	34
PID 1348 wrote to memory of 836	1348	taskeng.exe	34
PID 836 wrote to memory of 1488	836	regsvr32.exe	35
PID 836 wrote to memory of 1488	836	regsvr32.exe	35
PID 836 wrote to memory of 1488	836	regsvr32.exe	35
PID 836 wrote to memory of 1488	836	regsvr32.exe	35
PID 836 wrote to memory of 1488	836	regsvr32.exe	35
PID 836 wrote to memory of 1488	836	regsvr32.exe	35
PID 836 wrote to memory of 1488	836	regsvr32.exe	35
PID 1488 wrote to memory of 1920	1488	regsvr32.exe	36
PID 1488 wrote to memory of 1920	1488	regsvr32.exe	36
PID 1488 wrote to memory of 1920	1488	regsvr32.exe	36
PID 1488 wrote to memory of 1920	1488	regsvr32.exe	36
PID 1488 wrote to memory of 1920	1488	regsvr32.exe	36
PID 1488 wrote to memory of 1920	1488	regsvr32.exe	36
PID 1920 wrote to memory of 1464	1920	explorer.exe	37
PID 1920 wrote to memory of 1464	1920	explorer.exe	37
PID 1920 wrote to memory of 1464	1920	explorer.exe	37
PID 1920 wrote to memory of 1464	1920	explorer.exe	37
PID 1920 wrote to memory of 1060	1920	explorer.exe	39
PID 1920 wrote to memory of 1060	1920	explorer.exe	39
PID 1920 wrote to memory of 1060	1920	explorer.exe	39
PID 1920 wrote to memory of 1060	1920	explorer.exe	39

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b4de7c37664c56a2b5ba8feef2b41b11fab5e208421d148fe4717fc6da6f4db.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b4de7c37664c56a2b5ba8feef2b41b11fab5e208421d148fe4717fc6da6f4db.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn uojbklw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\3b4de7c37664c56a2b5ba8feef2b41b11fab5e208421d148fe4717fc6da6f4db.dll\"" /SC ONCE /Z /ST 15:20 /ET 15:32
      4⤵
      Creates scheduled task(s)
      PID:292

C:\Windows\system32\taskeng.exe
taskeng.exe {BB6AE764-A354-47BE-80C7-E2139F3B9950} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\3b4de7c37664c56a2b5ba8feef2b41b11fab5e208421d148fe4717fc6da6f4db.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\3b4de7c37664c56a2b5ba8feef2b41b11fab5e208421d148fe4717fc6da6f4db.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1920
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Hpfyqaxcdpuv" /d "0"
        5⤵
        
        PID:1464
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Juruuuujynrf" /d "0"
        5⤵
        
        PID:1060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-67-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

Download

memory/1200-63-0x00000000000F0000-0x00000000000F2000-memory.dmp

Download

memory/1200-66-0x0000000000080000-0x00000000000EC000-memory.dmp

Download

memory/1200-65-0x00000000746F1000-0x00000000746F3000-memory.dmp

Download

memory/1488-72-0x0000000000FE0000-0x000000000104C000-memory.dmp

Download

memory/1488-71-0x00000000009D0000-0x0000000000B60000-memory.dmp

Download

memory/1488-77-0x0000000000FE0000-0x000000000104C000-memory.dmp

Download

memory/1488-76-0x0000000000820000-0x0000000000887000-memory.dmp

Download

memory/1488-75-0x0000000000FE0000-0x000000000104C000-memory.dmp

Download

memory/1488-74-0x0000000000FE0000-0x000000000104C000-memory.dmp

Download

memory/1488-73-0x0000000000FE0000-0x000000000104C000-memory.dmp

Download

memory/1588-60-0x0000000002270000-0x00000000022DC000-memory.dmp

Download

memory/1588-56-0x0000000000910000-0x0000000000AA0000-memory.dmp

Download

memory/1588-55-0x0000000076371000-0x0000000076373000-memory.dmp

Download

memory/1588-58-0x0000000002270000-0x00000000022DC000-memory.dmp

Download

memory/1588-57-0x0000000002270000-0x00000000022DC000-memory.dmp

Download

memory/1588-62-0x0000000002270000-0x00000000022DC000-memory.dmp

Download

memory/1588-59-0x0000000002270000-0x00000000022DC000-memory.dmp

Download

memory/1588-61-0x00000000002E0000-0x0000000000347000-memory.dmp

Download

memory/1920-81-0x00000000001B0000-0x000000000021C000-memory.dmp

Download