qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
134s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58878537dcf0d621aeffb66a32a40c52fa8588c832d631b988e59673bede9914.dll
Size

276KB
MD5

92ed637108b0bbfbb8434207447183bc
SHA1

1b529f3422024ce6b431435f5d37b88393ff9f02
SHA256

58878537dcf0d621aeffb66a32a40c52fa8588c832d631b988e59673bede9914
SHA512

25cf828fd0818bbabf06738cc32aabca798d430eabfe659cfa0bf62ac1d9e980af64885d432a3af3fe62838b55187980534a048789a522ce092f84fbde993d1b

Score

10^/10

qakbot obama127 1636711808 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama127

Campaign

1636711808

136.232.34.70:443

181.118.183.31:443

72.252.147.208:465

94.200.181.154:443

71.13.93.154:2083

96.21.251.127:2222

182.176.180.73:443

88.234.20.155:995

41.228.22.180:443

89.137.52.44:443

102.65.38.57:443

94.196.209.83:995

207.246.112.221:995

207.246.112.221:443

39.49.116.108:995

190.73.3.148:2222

63.143.92.99:995

216.238.71.31:443

216.238.71.31:995

216.238.72.121:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4056 regsvr32.exe

pid	process
4056	regsvr32.exe

Drops file in System32 directory 21 IoCs

Processes:

regsvr32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\J0OJOAp\qG0XKb\a5Wn5fI	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\mkFpM\4CSzvAQzMlj	regsvr32.exe
File created	C:\Windows\SysWOW64\Cb\eyFrmsaUMc3\QO\m80oim	regsvr32.exe
File created	C:\Windows\SysWOW64\A6kc5VDz\l45rVhrFwb\AW5VEBOZGoC\XE	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\X0MQ5n6vH8A\C3Eil\XKwgHjkB\uOvzDQL5	regsvr32.exe
File created	C:\Windows\SysWOW64\sdiGfuHDJ\8XDnS2\3YbrtkFc0Q\iyR	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\BFHudU\T6AUG2kMXWB\fPLvA8YJ0f	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\am\v1naycqAd	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\VO\mYKCri	regsvr32.exe
File created	C:\Windows\SysWOW64\TNUq8Cq5UI\1zfm\GAEc7\FX415vUkEk	regsvr32.exe
File created	C:\Windows\SysWOW64\kBJvNX3uGa\7xkC1aLmJ4\Trb\BfoY5	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\HV33mP0a2J\mdHPqT6G	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\462pF9E\ZlfPcyTQq	regsvr32.exe
File created	C:\Windows\SysWOW64\3d\pLbDvlaH\Ll5vgZiR	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\IMO\6m0tTEjT9\kj4D0	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\tgrT\Or3	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\NXKG\Ug5	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\ci\jZiznap\Cfnc	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\anwBjeKj\OD1OUg0yc	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\yG31feCkrs\Yzf0jlmB\I9pwaim2C8J\YjAFUS	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\pEDGYin\s7g64m	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2400 schtasks.exe

pid	process
2400	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Syultnkrnaeuy\bcaca2cb = 83348c668cf396cab9ebaf9404002fb18e17626412303a0fc7a8a1061d1b7fa06f6e69a9e736065b62c4054ed9abc23c37297648cf0fda3460076cf20dd4bde2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Syultnkrnaeuy\89337285 = d472dc20576eb4ba48aba37e80828e6d875bc4481f54f90b71b2c655b8be8c69018145e3d9d7b40218483fa8626dfb655fd213a00df76ef170c37065e8065799f888e004d1ee2f0dd49ca407134fec15e5bbebfbbf5036cca473ee267503631e4570ac5d077d76494821c1ed064b5755ad02b1af28b157a8529dabcf3b2f94fa6077f8bb3cfc3b423295a5b6b2b4f5a0ef214356113ff0a25e3c6cd9483a399bff023b9bd66ec54371312ad2933afbca9ee6483904652aba7d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Syultnkrnaeuy\8b7252f9 = daba457561f9ff283928a989df7eaa35bc5d7cdb3b4187aabbdebb60fc723d666f5037df1937d581b890a6b1a189bfee58965f1aba188ee589573235c5965985d9def21ebad360d6f561452dd65754	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Syultnkrnaeuy\4ec67a16 = c463f57e37564c2212102336d8179734f7851fc5a6b9c3af5f53fdb42dc4cc1f94736ae56dafdda8163c4c758220c7b6a346e29a94	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Syultnkrnaeuy\f67a1d73 = 0a011b5591acab5197c94e46e52fd69ac57e10508ae99193aaa8b600597e16a98de74f73abc3a00241	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Syultnkrnaeuy\318f15e0 = 71f37c9f9a3baa0b2835827a6a884f20143c0c7f4f690c97fd61f8621cd2bbd9da3e1d505b840b6778ae561aed3b93bd2005ed0a8aefad22599867717a893e4e77c400094b4f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Syultnkrnaeuy	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Syultnkrnaeuy\c3e5cd3d = a0dca77dae1798275f5e2a998c5faa74f538bcd16b1cf7a59b73a1644720134e3c340f8ef3b8914da496f3046ddacf1814d51ca67234b6c205816d8b3d52c4ea868ad2eafa5f749cbffe324ce15bb5aa7b4af2c17717324cd744a071a845d760ef1c0fcb4b3bbddf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Syultnkrnaeuy\bcaca2cb = 83349b668cf3a33774caf9443e50b0a9ba2a0bb3537c49a72b905ac14e0d6e14278350d1978612d68b022721132197bd6df9ca4889a92d3259fb410dd0393ffff101858ffae1a03e2836a09e23d5fd65d382a07b58	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Syultnkrnaeuy\33ce359c = e3b800e0e5b019a8d6c020425ad7043c685b7e0a57bd60d5346a8b692dcee427b31c2020ccded97d006f8f4f6eb8d984a989021f53a3a810729be2e16db418b87f48d151	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1912 rundll32.exe
1912 rundll32.exe
4056 regsvr32.exe
4056 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1912 rundll32.exe
4056 regsvr32.exe

pid	process
1912	rundll32.exe
1912	rundll32.exe
4056	regsvr32.exe
4056	regsvr32.exe

pid	process
1912	rundll32.exe
4056	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1600 wrote to memory of 1912	1600	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 1912	1600	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 1912	1600	rundll32.exe	rundll32.exe
PID 1912 wrote to memory of 2112	1912	rundll32.exe	explorer.exe
PID 1912 wrote to memory of 2112	1912	rundll32.exe	explorer.exe
PID 1912 wrote to memory of 2112	1912	rundll32.exe	explorer.exe
PID 1912 wrote to memory of 2112	1912	rundll32.exe	explorer.exe
PID 1912 wrote to memory of 2112	1912	rundll32.exe	explorer.exe
PID 2112 wrote to memory of 2400	2112	explorer.exe	schtasks.exe
PID 2112 wrote to memory of 2400	2112	explorer.exe	schtasks.exe
PID 2112 wrote to memory of 2400	2112	explorer.exe	schtasks.exe
PID 3200 wrote to memory of 4056	3200	regsvr32.exe	regsvr32.exe
PID 3200 wrote to memory of 4056	3200	regsvr32.exe	regsvr32.exe
PID 3200 wrote to memory of 4056	3200	regsvr32.exe	regsvr32.exe
PID 4056 wrote to memory of 3084	4056	regsvr32.exe	explorer.exe
PID 4056 wrote to memory of 3084	4056	regsvr32.exe	explorer.exe
PID 4056 wrote to memory of 3084	4056	regsvr32.exe	explorer.exe
PID 4056 wrote to memory of 3084	4056	regsvr32.exe	explorer.exe
PID 4056 wrote to memory of 3084	4056	regsvr32.exe	explorer.exe
PID 3084 wrote to memory of 3532	3084	explorer.exe	reg.exe
PID 3084 wrote to memory of 3532	3084	explorer.exe	reg.exe
PID 3084 wrote to memory of 3024	3084	explorer.exe	reg.exe
PID 3084 wrote to memory of 3024	3084	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58878537dcf0d621aeffb66a32a40c52fa8588c832d631b988e59673bede9914.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58878537dcf0d621aeffb66a32a40c52fa8588c832d631b988e59673bede9914.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2112

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn nbunnynzp /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\58878537dcf0d621aeffb66a32a40c52fa8588c832d631b988e59673bede9914.dll\"" /SC ONCE /Z /ST 11:23 /ET 11:35
4⤵
- Creates scheduled task(s)
PID:2400

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\58878537dcf0d621aeffb66a32a40c52fa8588c832d631b988e59673bede9914.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3200

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\58878537dcf0d621aeffb66a32a40c52fa8588c832d631b988e59673bede9914.dll"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4056

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3084

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ibhvyduayq" /d "0"
4⤵
PID:3532

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Rpupprr" /d "0"
4⤵
PID:3024

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\58878537dcf0d621aeffb66a32a40c52fa8588c832d631b988e59673bede9914.dll
MD5
92ed637108b0bbfbb8434207447183bc

SHA1
1b529f3422024ce6b431435f5d37b88393ff9f02

SHA256
58878537dcf0d621aeffb66a32a40c52fa8588c832d631b988e59673bede9914

SHA512
25cf828fd0818bbabf06738cc32aabca798d430eabfe659cfa0bf62ac1d9e980af64885d432a3af3fe62838b55187980534a048789a522ce092f84fbde993d1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\58878537dcf0d621aeffb66a32a40c52fa8588c832d631b988e59673bede9914.dll
MD5
92ed637108b0bbfbb8434207447183bc

SHA1
1b529f3422024ce6b431435f5d37b88393ff9f02

SHA256
58878537dcf0d621aeffb66a32a40c52fa8588c832d631b988e59673bede9914

SHA512
25cf828fd0818bbabf06738cc32aabca798d430eabfe659cfa0bf62ac1d9e980af64885d432a3af3fe62838b55187980534a048789a522ce092f84fbde993d1b

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1912-130-0x00000000025E0000-0x0000000002601000-memory.dmp

Filesize
132KB

Download
memory/1912-131-0x0000000075670000-0x00000000756BA000-memory.dmp

Filesize
296KB

Download
memory/2112-132-0x0000000000830000-0x0000000000851000-memory.dmp

Filesize
132KB

Download
memory/3084-138-0x0000000000730000-0x0000000000751000-memory.dmp

Filesize
132KB

Download
memory/4056-136-0x0000000000E40000-0x0000000000E61000-memory.dmp

Filesize
132KB

Download
memory/4056-137-0x00000000755E0000-0x000000007562A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads