qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
4294214s
max time network
136s
platform
windows7_x64
resource
win7-20220310-en
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll
Size

378KB
MD5

aaceb347b2357beeda3fcbc5c87e8799
SHA1

d4e4a777bf303114408f2df57cfb091c7bd08f8b
SHA256

6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37
SHA512

f275a4cff8c9c092c1cae00573fd7d43b17b887b6931d8a30df4dd2d81fc20bb6b5b9274560fa4f6d430ba9e974d8417751c2a65bae56959bacfeaff5640eacb

Score

10^/10

qakbot obama104 1632729661 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

obama104

Campaign

1632729661

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1472 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1356 schtasks.exe

pid	process
1472	regsvr32.exe

pid	process
1356	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uavbaougbt	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uavbaougbt\8f0c383d = 6c5d0e4757b008766782b20d1efc5c355d265843ba313c675600dca305acdba665b59a81d2db0c7e4f8ca2147c110eadc23abce5d478cc9bc85d73437ebda967bbeba5616662f1dd749a24ec306fb77737db80	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uavbaougbt\ba93e873 = 674c5a593620cf4562522acb709d50606719cc2a0df32ee9f35704ae20a7a4af81ee49dbebbbaed69104c85b96e5d7cfc95ce74403a4b32d087268646496917bbb18215bf8d97c2e661affb72e5e27fbb477ce05eeb55816f1aa34e1fe99e7ce287ff2748180c779c54e979a131ba7ca8c0d2edfa73f7d78848398c09547afe31408985e810aab24cbda799a4b80fb82847625967b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uavbaougbt\22f8f16 = eb4df732f001426ab8e56627b5fdada80597ac2c650150aa11595675f2146f0d8020fd1389f1552ab1ca8017787c52fd68cf5e5ba7dc8966b31976ab06fcff0da6ef391ee6c8fc50cdb9e8264e2005ae	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uavbaougbt\f04557cb = ef46c1ea242b9248d8b51261a366e96064eefeb24f2c471c33df4356c73b02b93fd61fd89f2457818701f6c972f5960e4387355cdbb8849189d3a2450c7485054ae2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uavbaougbt\b8d2c80f = 0776512471dd20404eae04837bded6479c588f94e88fe168810ef438ae76993e48dc7925a0ac5e908ee577af4efc5e8de5f7d7dcbddfb37ab226b903e8e6797bf236f1283e67366b73f8501091ce53aeaf9e91bc222dd79c799686	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uavbaougbt\6eaf6a = b2ebafee38f002fe27856526989b54ac99078e63c3704d6ef14c8672a15b5adfcf89ee635d4acfea	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uavbaougbt\7d66e0e0 = 74a7c4fceb710cbe410af5640609bf77890a11cde2a0c8a4a9b2c6cc1beb1f6d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uavbaougbt\c5da8785 = 745207dc4d12d642a9448bde069563545aaea275867bab160b7bd38d3c732b1f5ee8a152deafe38ed6497e7825609552d15fb125e12f1b13cd357463	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uavbaougbt\8f0c383d = 6c5d194757b03d6c9209fd85a2827f696ec4891f0361393e26cb470a9e0cd9a67482c9fd0a72122fe2fd38f89d2b96226d8b37f9a932810ccb36b786f899e6bab9f768757dd3963ee375102a8cddd87eafa7bdfc23d43b3dee7917514e9fe8eb02ea4c72ea2db963	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1644 rundll32.exe
1472 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1644 rundll32.exe
1472 regsvr32.exe

pid	process
1644	rundll32.exe
1472	regsvr32.exe

pid	process
1644	rundll32.exe
1472	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 748 wrote to memory of 1644	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1644	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1644	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1644	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1644	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1644	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1644	748	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 648	1644	rundll32.exe	explorer.exe
PID 1644 wrote to memory of 648	1644	rundll32.exe	explorer.exe
PID 1644 wrote to memory of 648	1644	rundll32.exe	explorer.exe
PID 1644 wrote to memory of 648	1644	rundll32.exe	explorer.exe
PID 1644 wrote to memory of 648	1644	rundll32.exe	explorer.exe
PID 1644 wrote to memory of 648	1644	rundll32.exe	explorer.exe
PID 648 wrote to memory of 1356	648	explorer.exe	schtasks.exe
PID 648 wrote to memory of 1356	648	explorer.exe	schtasks.exe
PID 648 wrote to memory of 1356	648	explorer.exe	schtasks.exe
PID 648 wrote to memory of 1356	648	explorer.exe	schtasks.exe
PID 384 wrote to memory of 1628	384	taskeng.exe	regsvr32.exe
PID 384 wrote to memory of 1628	384	taskeng.exe	regsvr32.exe
PID 384 wrote to memory of 1628	384	taskeng.exe	regsvr32.exe
PID 384 wrote to memory of 1628	384	taskeng.exe	regsvr32.exe
PID 384 wrote to memory of 1628	384	taskeng.exe	regsvr32.exe
PID 1628 wrote to memory of 1472	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1472	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1472	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1472	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1472	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1472	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1472	1628	regsvr32.exe	regsvr32.exe
PID 1472 wrote to memory of 1756	1472	regsvr32.exe	explorer.exe
PID 1472 wrote to memory of 1756	1472	regsvr32.exe	explorer.exe
PID 1472 wrote to memory of 1756	1472	regsvr32.exe	explorer.exe
PID 1472 wrote to memory of 1756	1472	regsvr32.exe	explorer.exe
PID 1472 wrote to memory of 1756	1472	regsvr32.exe	explorer.exe
PID 1472 wrote to memory of 1756	1472	regsvr32.exe	explorer.exe
PID 1756 wrote to memory of 1740	1756	explorer.exe	reg.exe
PID 1756 wrote to memory of 1740	1756	explorer.exe	reg.exe
PID 1756 wrote to memory of 1740	1756	explorer.exe	reg.exe
PID 1756 wrote to memory of 1740	1756	explorer.exe	reg.exe
PID 1756 wrote to memory of 524	1756	explorer.exe	reg.exe
PID 1756 wrote to memory of 524	1756	explorer.exe	reg.exe
PID 1756 wrote to memory of 524	1756	explorer.exe	reg.exe
PID 1756 wrote to memory of 524	1756	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn faffsgtnws /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll\"" /SC ONCE /Z /ST 12:23 /ET 12:35
4⤵
- Creates scheduled task(s)
PID:1356

C:\Windows\system32\taskeng.exe
taskeng.exe {EA2C1BB3-2914-4942-AF72-FA561F521174} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:384

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Icyqw" /d "0"
5⤵
PID:1740

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Jzaipg" /d "0"
5⤵
PID:524

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll
MD5
aaceb347b2357beeda3fcbc5c87e8799

SHA1
d4e4a777bf303114408f2df57cfb091c7bd08f8b

SHA256
6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37

SHA512
f275a4cff8c9c092c1cae00573fd7d43b17b887b6931d8a30df4dd2d81fc20bb6b5b9274560fa4f6d430ba9e974d8417751c2a65bae56959bacfeaff5640eacb

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll
MD5
aaceb347b2357beeda3fcbc5c87e8799

SHA1
d4e4a777bf303114408f2df57cfb091c7bd08f8b

SHA256
6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37

SHA512
f275a4cff8c9c092c1cae00573fd7d43b17b887b6931d8a30df4dd2d81fc20bb6b5b9274560fa4f6d430ba9e974d8417751c2a65bae56959bacfeaff5640eacb

Download Submit
memory/648-57-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/648-60-0x0000000074CF1000-0x0000000074CF3000-memory.dmp

Filesize
8KB

Download
memory/648-61-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1472-66-0x0000000000130000-0x0000000000172000-memory.dmp

Filesize
264KB

Download
memory/1472-67-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/1628-62-0x000007FEFC221000-0x000007FEFC223000-memory.dmp

Filesize
8KB

Download
memory/1644-56-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/1644-54-0x00000000761D1000-0x00000000761D3000-memory.dmp

Filesize
8KB

Download
memory/1644-55-0x0000000000170000-0x00000000001B2000-memory.dmp

Filesize
264KB

Download
memory/1756-73-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads