qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
4294229s
max time network
134s
platform
windows7_x64
resource
win7-20220310-en
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ce8fbedc5fd65785ce950cd2c6e670f89c6f3e9cdd41d6abcf86b61eee911f2.dll
Size

469KB
MD5

1494919946474545be95298955974403
SHA1

4eb68f8e0efa346aa8cd1976554a26f787537f41
SHA256

6ce8fbedc5fd65785ce950cd2c6e670f89c6f3e9cdd41d6abcf86b61eee911f2
SHA512

912cdb166f92a447d61d94420bfad02776ad22babb390da1f4e72cb2a523e8e3ed5b2b6dc063d73ad6dd22d0704f2f9022355698a2fd93734a62ab61de770247

Score

10^/10

qakbot obama147 1639647898 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama147

Campaign

1639647898

136.143.11.232:443

120.150.218.241:995

218.101.110.3:995

93.48.58.123:2222

190.73.3.148:2222

186.64.87.213:443

65.100.174.110:443

24.95.61.62:443

41.228.22.180:443

86.97.9.219:443

103.142.10.177:443

140.82.49.12:443

24.152.219.253:995

117.248.109.38:21

136.232.34.70:443

93.48.80.198:995

173.21.10.71:2222

78.180.163.25:995

194.36.28.26:443

45.9.20.200:2211

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

976 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2004 schtasks.exe

pid	process
976	regsvr32.exe

pid	process
2004	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xotimiyjltdtin\e60e4426 = d8a1d2ef5d9926dfd87d9f47f1572f6bcbb9f3226fcc8b6f559a78c2907a1f70149020dc049e5764f7eba516f7fa21d4cd986cc4e3f9937866f3d068a19c1ee7aac8998bd81b624bcd4fb0f6508647bbe274efa426e02e4817564c4b043b665f0990e195e10f3a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xotimiyjltdtin\21fb4cb5 = d9abd5ca980f4be3427702aa41875614e43f6c5e7ece2e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xotimiyjltdtin\d3919468 = 850c6d270c5a97d4165178a609aef285235b16b134a9c310a4323eb1ed658576d86f350c3e4cad5beaa0ee89402dfb8b3d196d5f4fc9f65a7872dc77ff64584e2cfd6bd36082856f028fc1161bd215b84b74da3c9b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xotimiyjltdtin	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xotimiyjltdtin\e44f645a = 7c33192359dfa27a8e6aad12f75944deb4635d16a577b642bd808495d4905c4022c2ae703ea8f4f0c1ac3d8e2667520ecc3fa8095c999601e2ba530c5f45eb7338f8c3a8a519bcc82657f503a49287	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xotimiyjltdtin\5cf3033f = eebcc8d89644b9e20b77ca92c3ec88e9c0b093078f81c9d0fddc811e1ea3a89e44c5d47e9886c99b021ebc7fda05e0fdd91a54e20e19fd38008db5ed4d4e42c9a2c74508642bfdd01123d5d4a94f9feba09e03ef22c4d0d4f994ad184786ccfaa5a1a5f5d49f5b8003a524	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xotimiyjltdtin\99472bd0 = 12d6661181552c8f04979692c45fe6dea648878a5185c82883819effc533681c36d622ee30ab12a42af07e0b849ee1d4edd446898630e61ae989a4478df5b7c0fd7a9fb6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xotimiyjltdtin\5eb22343 = 606085919f758ad8ab93a2b593e3d18c4dbf17b24eb9d281f1c7d75186f002ecb1b964a8aa250896e738114eeeafcd0bb09581562e1bc0d57b7da7c106ae737d8ce10fc2b0048e0209bdb3a4c3b3c2b2c708c37bd6e916662f98	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xotimiyjltdtin\acd8fb9e = f63f5ac4c99799de01a251020de20abb2bc058e778987003c462a58e56496d45c4c4cc34b22b80fc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xotimiyjltdtin\d3919468 = 850c7a270c5aa2cb47254051abcb1bc25c35a43a7ecbc10b52cbf6780c2fb2382adf6e2b9b1d91616db68673eba6e17a1c3bb4e7f53fb4a5bd4f02d2cecbbb0b	explorer.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
1952	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe
976	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1952 regsvr32.exe
976 regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1732 wrote to memory of 1952	1732	regsvr32.exe	regsvr32.exe
PID 1732 wrote to memory of 1952	1732	regsvr32.exe	regsvr32.exe
PID 1732 wrote to memory of 1952	1732	regsvr32.exe	regsvr32.exe
PID 1732 wrote to memory of 1952	1732	regsvr32.exe	regsvr32.exe
PID 1732 wrote to memory of 1952	1732	regsvr32.exe	regsvr32.exe
PID 1732 wrote to memory of 1952	1732	regsvr32.exe	regsvr32.exe
PID 1732 wrote to memory of 1952	1732	regsvr32.exe	regsvr32.exe
PID 1952 wrote to memory of 1292	1952	regsvr32.exe	explorer.exe
PID 1952 wrote to memory of 1292	1952	regsvr32.exe	explorer.exe
PID 1952 wrote to memory of 1292	1952	regsvr32.exe	explorer.exe
PID 1952 wrote to memory of 1292	1952	regsvr32.exe	explorer.exe
PID 1952 wrote to memory of 1292	1952	regsvr32.exe	explorer.exe
PID 1952 wrote to memory of 1292	1952	regsvr32.exe	explorer.exe
PID 1292 wrote to memory of 2004	1292	explorer.exe	schtasks.exe
PID 1292 wrote to memory of 2004	1292	explorer.exe	schtasks.exe
PID 1292 wrote to memory of 2004	1292	explorer.exe	schtasks.exe
PID 1292 wrote to memory of 2004	1292	explorer.exe	schtasks.exe
PID 272 wrote to memory of 996	272	taskeng.exe	regsvr32.exe
PID 272 wrote to memory of 996	272	taskeng.exe	regsvr32.exe
PID 272 wrote to memory of 996	272	taskeng.exe	regsvr32.exe
PID 272 wrote to memory of 996	272	taskeng.exe	regsvr32.exe
PID 272 wrote to memory of 996	272	taskeng.exe	regsvr32.exe
PID 996 wrote to memory of 976	996	regsvr32.exe	regsvr32.exe
PID 996 wrote to memory of 976	996	regsvr32.exe	regsvr32.exe
PID 996 wrote to memory of 976	996	regsvr32.exe	regsvr32.exe
PID 996 wrote to memory of 976	996	regsvr32.exe	regsvr32.exe
PID 996 wrote to memory of 976	996	regsvr32.exe	regsvr32.exe
PID 996 wrote to memory of 976	996	regsvr32.exe	regsvr32.exe
PID 996 wrote to memory of 976	996	regsvr32.exe	regsvr32.exe
PID 976 wrote to memory of 1220	976	regsvr32.exe	explorer.exe
PID 976 wrote to memory of 1220	976	regsvr32.exe	explorer.exe
PID 976 wrote to memory of 1220	976	regsvr32.exe	explorer.exe
PID 976 wrote to memory of 1220	976	regsvr32.exe	explorer.exe
PID 976 wrote to memory of 1220	976	regsvr32.exe	explorer.exe
PID 976 wrote to memory of 1220	976	regsvr32.exe	explorer.exe
PID 1220 wrote to memory of 1380	1220	explorer.exe	reg.exe
PID 1220 wrote to memory of 1380	1220	explorer.exe	reg.exe
PID 1220 wrote to memory of 1380	1220	explorer.exe	reg.exe
PID 1220 wrote to memory of 1380	1220	explorer.exe	reg.exe
PID 1220 wrote to memory of 700	1220	explorer.exe	reg.exe
PID 1220 wrote to memory of 700	1220	explorer.exe	reg.exe
PID 1220 wrote to memory of 700	1220	explorer.exe	reg.exe
PID 1220 wrote to memory of 700	1220	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6ce8fbedc5fd65785ce950cd2c6e670f89c6f3e9cdd41d6abcf86b61eee911f2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\6ce8fbedc5fd65785ce950cd2c6e670f89c6f3e9cdd41d6abcf86b61eee911f2.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn siljuxfri /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\6ce8fbedc5fd65785ce950cd2c6e670f89c6f3e9cdd41d6abcf86b61eee911f2.dll\"" /SC ONCE /Z /ST 12:24 /ET 12:36
4⤵
- Creates scheduled task(s)
PID:2004

C:\Windows\system32\taskeng.exe
taskeng.exe {980A1415-6452-4816-958B-54132D19C5BC} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:272

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\6ce8fbedc5fd65785ce950cd2c6e670f89c6f3e9cdd41d6abcf86b61eee911f2.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\6ce8fbedc5fd65785ce950cd2c6e670f89c6f3e9cdd41d6abcf86b61eee911f2.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:976

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Dlobcozl" /d "0"
5⤵
PID:1380

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ycpuxvesi" /d "0"
5⤵
PID:700

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6ce8fbedc5fd65785ce950cd2c6e670f89c6f3e9cdd41d6abcf86b61eee911f2.dll
MD5
1494919946474545be95298955974403

SHA1
4eb68f8e0efa346aa8cd1976554a26f787537f41

SHA256
6ce8fbedc5fd65785ce950cd2c6e670f89c6f3e9cdd41d6abcf86b61eee911f2

SHA512
912cdb166f92a447d61d94420bfad02776ad22babb390da1f4e72cb2a523e8e3ed5b2b6dc063d73ad6dd22d0704f2f9022355698a2fd93734a62ab61de770247

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\6ce8fbedc5fd65785ce950cd2c6e670f89c6f3e9cdd41d6abcf86b61eee911f2.dll
MD5
1494919946474545be95298955974403

SHA1
4eb68f8e0efa346aa8cd1976554a26f787537f41

SHA256
6ce8fbedc5fd65785ce950cd2c6e670f89c6f3e9cdd41d6abcf86b61eee911f2

SHA512
912cdb166f92a447d61d94420bfad02776ad22babb390da1f4e72cb2a523e8e3ed5b2b6dc063d73ad6dd22d0704f2f9022355698a2fd93734a62ab61de770247

Download Submit
memory/976-75-0x00000000001B0000-0x0000000000228000-memory.dmp

Filesize
480KB

Download
memory/976-74-0x0000000000D40000-0x0000000000EC0000-memory.dmp

Filesize
1.5MB

Download
memory/976-73-0x0000000000300000-0x000000000037B000-memory.dmp

Filesize
492KB

Download
memory/976-71-0x00000000001B0000-0x0000000000228000-memory.dmp

Filesize
480KB

Download
memory/1220-81-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1292-66-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1292-65-0x00000000740D1000-0x00000000740D3000-memory.dmp

Filesize
8KB

Download
memory/1292-62-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/1732-54-0x000007FEFB6E1000-0x000007FEFB6E3000-memory.dmp

Filesize
8KB

Download
memory/1952-61-0x0000000000180000-0x0000000000200000-memory.dmp

Filesize
512KB

Download
memory/1952-60-0x0000000002020000-0x00000000021A0000-memory.dmp

Filesize
1.5MB

Download
memory/1952-59-0x0000000077040000-0x00000000771C0000-memory.dmp

Filesize
1.5MB

Download
memory/1952-58-0x0000000001E50000-0x0000000001ECB000-memory.dmp

Filesize
492KB

Download
memory/1952-55-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads