qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll
Size

378KB
MD5

aaceb347b2357beeda3fcbc5c87e8799
SHA1

d4e4a777bf303114408f2df57cfb091c7bd08f8b
SHA256

6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37
SHA512

f275a4cff8c9c092c1cae00573fd7d43b17b887b6931d8a30df4dd2d81fc20bb6b5b9274560fa4f6d430ba9e974d8417751c2a65bae56959bacfeaff5640eacb

Score

10^/10

qakbot obama104 1632729661 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

obama104

Campaign

1632729661

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

5084 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4940 schtasks.exe

pid	process
5084	regsvr32.exe

pid	process
4940	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vljqins\220c1b3 = de2edd8fd70c6414fc33c5ddd62124eade3cfc581360910c4a7b3a6774	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vljqins\f04a196e = 0c7490bc51cc4133106f5596e6337ca7127d1fcd2a34bb89d0ec5eea19ba65d054e3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vljqins\8f037698 = 85960d73e5d9bc282c933ffbdd9628e1989b4ef174e2bf52a837c450f36143ae396509e2d2841fb9759a04	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vljqins\c5d5c920 = 24e48fce2d5eb7349f163111ce6cdafc82f4e37478	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vljqins	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vljqins\8f037698 = 85961a73e5d9893a09a11e91b0b41c51063224226c4b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vljqins\ba9ca6d6 = 772977f5b5cc9fd15e1a406a6ddd8dfff9cf3c832e492b167fc9991a3cb90c6c1f3dc81595a3225e77293363e84c5991d6dc0834a85e9194ea36bc259ed99bb67cdd814c5393336b07ddd0a25713846b70d0535f345dfee684886e0712143b9cb57433295fc4efcf3326a2dce564af2d2fc302ddd8feb5fd7e9ed2d4eb967338962f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vljqins\b8dd86aa = 9a4569f91bbbd5e660c73621c19fe649ef67417484f38d0217d90201ec9d84b12dcb06	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vljqins\61e1cf = 1fb947c8d9fd155c077f4118c40e3e51c8ac8494b8b11c5c6913712b8f186be97f4554b5065888317340ae6d4580e5ab85af662151a55811591dce245bf07ec23bb9b6cff2aa399d35573bf4d8a7b953679b7f4126d9c753a1a9eccc51464c66efcd3629040228819b0d68	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vljqins\7d69ae45 = 95eb5bac173c55d4ee384fb9e875034a11	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3716 rundll32.exe
3716 rundll32.exe
5084 regsvr32.exe
5084 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3716 rundll32.exe
5084 regsvr32.exe

pid	process
3716	rundll32.exe
3716	rundll32.exe
5084	regsvr32.exe
5084	regsvr32.exe

pid	process
3716	rundll32.exe
5084	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3096 wrote to memory of 3716	3096	rundll32.exe	rundll32.exe
PID 3096 wrote to memory of 3716	3096	rundll32.exe	rundll32.exe
PID 3096 wrote to memory of 3716	3096	rundll32.exe	rundll32.exe
PID 3716 wrote to memory of 4784	3716	rundll32.exe	explorer.exe
PID 3716 wrote to memory of 4784	3716	rundll32.exe	explorer.exe
PID 3716 wrote to memory of 4784	3716	rundll32.exe	explorer.exe
PID 3716 wrote to memory of 4784	3716	rundll32.exe	explorer.exe
PID 3716 wrote to memory of 4784	3716	rundll32.exe	explorer.exe
PID 4784 wrote to memory of 4940	4784	explorer.exe	schtasks.exe
PID 4784 wrote to memory of 4940	4784	explorer.exe	schtasks.exe
PID 4784 wrote to memory of 4940	4784	explorer.exe	schtasks.exe
PID 3112 wrote to memory of 5084	3112	regsvr32.exe	regsvr32.exe
PID 3112 wrote to memory of 5084	3112	regsvr32.exe	regsvr32.exe
PID 3112 wrote to memory of 5084	3112	regsvr32.exe	regsvr32.exe
PID 5084 wrote to memory of 3488	5084	regsvr32.exe	explorer.exe
PID 5084 wrote to memory of 3488	5084	regsvr32.exe	explorer.exe
PID 5084 wrote to memory of 3488	5084	regsvr32.exe	explorer.exe
PID 5084 wrote to memory of 3488	5084	regsvr32.exe	explorer.exe
PID 5084 wrote to memory of 3488	5084	regsvr32.exe	explorer.exe
PID 3488 wrote to memory of 3560	3488	explorer.exe	reg.exe
PID 3488 wrote to memory of 3560	3488	explorer.exe	reg.exe
PID 3488 wrote to memory of 4184	3488	explorer.exe	reg.exe
PID 3488 wrote to memory of 4184	3488	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3096

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3716

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4784

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn gzuyneyyy /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll\"" /SC ONCE /Z /ST 11:23 /ET 11:35
4⤵
- Creates scheduled task(s)
PID:4940

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3112

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5084

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3488

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Jeqvk" /d "0"
4⤵
PID:3560

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Asovhocwp" /d "0"
4⤵
PID:4184

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll
MD5
aaceb347b2357beeda3fcbc5c87e8799

SHA1
d4e4a777bf303114408f2df57cfb091c7bd08f8b

SHA256
6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37

SHA512
f275a4cff8c9c092c1cae00573fd7d43b17b887b6931d8a30df4dd2d81fc20bb6b5b9274560fa4f6d430ba9e974d8417751c2a65bae56959bacfeaff5640eacb

Download Submit
C:\Users\Admin\AppData\Local\Temp\6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll
MD5
aaceb347b2357beeda3fcbc5c87e8799

SHA1
d4e4a777bf303114408f2df57cfb091c7bd08f8b

SHA256
6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37

SHA512
f275a4cff8c9c092c1cae00573fd7d43b17b887b6931d8a30df4dd2d81fc20bb6b5b9274560fa4f6d430ba9e974d8417751c2a65bae56959bacfeaff5640eacb

Download Submit
memory/3488-137-0x0000000001200000-0x0000000001221000-memory.dmp

Filesize
132KB

Download
memory/3716-130-0x00000000024E0000-0x000000000256D000-memory.dmp

Filesize
564KB

Download
memory/3716-131-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/4784-132-0x00000000007B0000-0x00000000007D1000-memory.dmp

Filesize
132KB

Download
memory/5084-135-0x0000000001680000-0x00000000016C2000-memory.dmp

Filesize
264KB

Download
memory/5084-136-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download