qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
4294187s
max time network
126s
platform
windows7_x64
resource
win7-20220311-en
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll
Size

469KB
MD5

f0bd4b7b006bf160b6fe97a0d6670738
SHA1

3ecf978f460879155310d9564ff30d0ff56815de
SHA256

021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf
SHA512

2bc7751e6a0af6bc5c706431dc207216ffb12a69367f2590a53d860e3efa30aa417f5c8db4b39712a50e0ce36d48d0013ffa89545a21ba10b0cf94e47d6f6de2

Score

10^/10

qakbot obama147 1639647898 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama147

Campaign

1639647898

136.143.11.232:443

120.150.218.241:995

218.101.110.3:995

93.48.58.123:2222

190.73.3.148:2222

186.64.87.213:443

65.100.174.110:443

24.95.61.62:443

41.228.22.180:443

86.97.9.219:443

103.142.10.177:443

140.82.49.12:443

24.152.219.253:995

117.248.109.38:21

136.232.34.70:443

93.48.80.198:995

173.21.10.71:2222

78.180.163.25:995

194.36.28.26:443

45.9.20.200:2211

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1340 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1192 schtasks.exe

pid	process
1340	regsvr32.exe

pid	process
1192	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyxfreymlc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lyxfreymlc\1006553b = 9edd05d9f7f748a6154af6efdd083757955c9f73f3419de9a0f58bc04f885baebb236078ef5b11dc0e00	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lyxfreymlc\aafb1222 = 10bfe22536b3b1c1d887da1c192f734b1847f0a76287a328237ebbadd09ecb427cdf2f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lyxfreymlc\5891caff = 2bc9f080d726834afef28395aaa3ee07a1576d08bf10c5d0eb6cf1d3de2aba300379f6c346fd3f7511d64894b54ee06dbefcbc0b476a1673cd5b474f7ab76ba6b450e6996ce48dc7d4afc7cb541baa9b4eaa78eb17787dd143c49eb01cd480de485e29f30858e0cd72d4d3217bb2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lyxfreymlc\27d8a509 = 18aaf2a45afab0c9dfef7d5960550d2c4706a8fbc394dd6efa8f1fec0cbbeecb6f53f8bcca	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lyxfreymlc\27d8a509 = 18aae5a45afa85284e2523013491ab18	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lyxfreymlc\12477547 = b876ef0bf57695349fe37d2f5e232766b0cd3a6b55e9b63da1f60c07efc59a26c024ff9049f410ecb2cf4e0756bd5f16907a1a3f271e89d275687e409b958bc10ce6c570c15c4aa6de94109c304ccbb9fb11cb18f5f6b624f97325dfa66b6a5afa2d0c62a515f2ef2a0b9877443d47a405c5ac066c204394e66a0535cd5270f9ea1f7a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lyxfreymlc\a8ba325e = d7fc2c036a560eedb5f35aac456f653dacc3cfc6e5581504920fd86265fd16c657f63b5c8ca966db05c3afe78107006289d19a83cbab25994e29ebb2f42490e298d8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lyxfreymlc\d5b27dd4 = 35f95df96a7859a06fac38742639a59906	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lyxfreymlc\6d0e1ab1 = f05d866cec3d4990b6be9b7c9769819c8f60ee2b457fca3555ade41ba47376e101aaf88f10299f5d2a27125aff2164a84134f5f76c5822c357caffc285c343e654c2525450e54b5c5d7ca4fbd77ed068fc8a4f9b44204d97ae8e995c17	explorer.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe
1340	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1980 regsvr32.exe
1340 regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2000 wrote to memory of 1980	2000	regsvr32.exe	regsvr32.exe
PID 2000 wrote to memory of 1980	2000	regsvr32.exe	regsvr32.exe
PID 2000 wrote to memory of 1980	2000	regsvr32.exe	regsvr32.exe
PID 2000 wrote to memory of 1980	2000	regsvr32.exe	regsvr32.exe
PID 2000 wrote to memory of 1980	2000	regsvr32.exe	regsvr32.exe
PID 2000 wrote to memory of 1980	2000	regsvr32.exe	regsvr32.exe
PID 2000 wrote to memory of 1980	2000	regsvr32.exe	regsvr32.exe
PID 1980 wrote to memory of 468	1980	regsvr32.exe	explorer.exe
PID 1980 wrote to memory of 468	1980	regsvr32.exe	explorer.exe
PID 1980 wrote to memory of 468	1980	regsvr32.exe	explorer.exe
PID 1980 wrote to memory of 468	1980	regsvr32.exe	explorer.exe
PID 1980 wrote to memory of 468	1980	regsvr32.exe	explorer.exe
PID 1980 wrote to memory of 468	1980	regsvr32.exe	explorer.exe
PID 468 wrote to memory of 1192	468	explorer.exe	schtasks.exe
PID 468 wrote to memory of 1192	468	explorer.exe	schtasks.exe
PID 468 wrote to memory of 1192	468	explorer.exe	schtasks.exe
PID 468 wrote to memory of 1192	468	explorer.exe	schtasks.exe
PID 980 wrote to memory of 1036	980	taskeng.exe	regsvr32.exe
PID 980 wrote to memory of 1036	980	taskeng.exe	regsvr32.exe
PID 980 wrote to memory of 1036	980	taskeng.exe	regsvr32.exe
PID 980 wrote to memory of 1036	980	taskeng.exe	regsvr32.exe
PID 980 wrote to memory of 1036	980	taskeng.exe	regsvr32.exe
PID 1036 wrote to memory of 1340	1036	regsvr32.exe	regsvr32.exe
PID 1036 wrote to memory of 1340	1036	regsvr32.exe	regsvr32.exe
PID 1036 wrote to memory of 1340	1036	regsvr32.exe	regsvr32.exe
PID 1036 wrote to memory of 1340	1036	regsvr32.exe	regsvr32.exe
PID 1036 wrote to memory of 1340	1036	regsvr32.exe	regsvr32.exe
PID 1036 wrote to memory of 1340	1036	regsvr32.exe	regsvr32.exe
PID 1036 wrote to memory of 1340	1036	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1516	1340	regsvr32.exe	explorer.exe
PID 1340 wrote to memory of 1516	1340	regsvr32.exe	explorer.exe
PID 1340 wrote to memory of 1516	1340	regsvr32.exe	explorer.exe
PID 1340 wrote to memory of 1516	1340	regsvr32.exe	explorer.exe
PID 1340 wrote to memory of 1516	1340	regsvr32.exe	explorer.exe
PID 1340 wrote to memory of 1516	1340	regsvr32.exe	explorer.exe
PID 1516 wrote to memory of 552	1516	explorer.exe	reg.exe
PID 1516 wrote to memory of 552	1516	explorer.exe	reg.exe
PID 1516 wrote to memory of 552	1516	explorer.exe	reg.exe
PID 1516 wrote to memory of 552	1516	explorer.exe	reg.exe
PID 1516 wrote to memory of 624	1516	explorer.exe	reg.exe
PID 1516 wrote to memory of 624	1516	explorer.exe	reg.exe
PID 1516 wrote to memory of 624	1516	explorer.exe	reg.exe
PID 1516 wrote to memory of 624	1516	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:468

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn sphczkxhxt /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll\"" /SC ONCE /Z /ST 11:23 /ET 11:35
4⤵
- Creates scheduled task(s)
PID:1192

C:\Windows\system32\taskeng.exe
taskeng.exe {38843208-A0D0-48F4-A7A0-7308B7453144} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Biyrfeue" /d "0"
5⤵
PID:552

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ryflju" /d "0"
5⤵
PID:624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll
MD5
f0bd4b7b006bf160b6fe97a0d6670738

SHA1
3ecf978f460879155310d9564ff30d0ff56815de

SHA256
021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf

SHA512
2bc7751e6a0af6bc5c706431dc207216ffb12a69367f2590a53d860e3efa30aa417f5c8db4b39712a50e0ce36d48d0013ffa89545a21ba10b0cf94e47d6f6de2

Download Submit
\Users\Admin\AppData\Local\Temp\021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll
MD5
f0bd4b7b006bf160b6fe97a0d6670738

SHA1
3ecf978f460879155310d9564ff30d0ff56815de

SHA256
021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf

SHA512
2bc7751e6a0af6bc5c706431dc207216ffb12a69367f2590a53d860e3efa30aa417f5c8db4b39712a50e0ce36d48d0013ffa89545a21ba10b0cf94e47d6f6de2

Download Submit
memory/468-62-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/468-66-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/468-65-0x00000000740C1000-0x00000000740C3000-memory.dmp

Filesize
8KB

Download
memory/1340-73-0x0000000000B80000-0x0000000000BFB000-memory.dmp

Filesize
492KB

Download
memory/1340-71-0x00000000008D0000-0x0000000000948000-memory.dmp

Filesize
480KB

Download
memory/1340-74-0x0000000077030000-0x00000000771B0000-memory.dmp

Filesize
1.5MB

Download
memory/1340-75-0x0000000000D90000-0x0000000000F10000-memory.dmp

Filesize
1.5MB

Download
memory/1340-76-0x00000000008D0000-0x0000000000948000-memory.dmp

Filesize
480KB

Download
memory/1516-81-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1980-61-0x0000000001D50000-0x0000000001DD0000-memory.dmp

Filesize
512KB

Download
memory/1980-60-0x0000000002050000-0x00000000021D0000-memory.dmp

Filesize
1.5MB

Download
memory/1980-59-0x0000000077030000-0x00000000771B0000-memory.dmp

Filesize
1.5MB

Download
memory/1980-58-0x0000000001FD0000-0x000000000204B000-memory.dmp

Filesize
492KB

Download
memory/1980-55-0x0000000074C61000-0x0000000074C63000-memory.dmp

Filesize
8KB

Download
memory/2000-54-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Filesize
8KB

Download