qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
138s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll
Size

469KB
MD5

f0bd4b7b006bf160b6fe97a0d6670738
SHA1

3ecf978f460879155310d9564ff30d0ff56815de
SHA256

021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf
SHA512

2bc7751e6a0af6bc5c706431dc207216ffb12a69367f2590a53d860e3efa30aa417f5c8db4b39712a50e0ce36d48d0013ffa89545a21ba10b0cf94e47d6f6de2

Score

10^/10

qakbot obama147 1639647898 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama147

Campaign

1639647898

136.143.11.232:443

120.150.218.241:995

218.101.110.3:995

93.48.58.123:2222

190.73.3.148:2222

186.64.87.213:443

65.100.174.110:443

24.95.61.62:443

41.228.22.180:443

86.97.9.219:443

103.142.10.177:443

140.82.49.12:443

24.152.219.253:995

117.248.109.38:21

136.232.34.70:443

93.48.80.198:995

173.21.10.71:2222

78.180.163.25:995

194.36.28.26:443

45.9.20.200:2211

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4084 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3692 schtasks.exe

pid	process
4084	regsvr32.exe

pid	process
3692	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ypjjisecabab	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ypjjisecabab\5e7ddf29 = ff91a7b2cc2e7ce8a07ddc0a58b0fea610f2b01a187933fd1f2c2c9f9ebf8301ea9319a65a20d338e0cdbabf3bef7c833281b218	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ypjjisecabab\14ab6091 = 8dc701c8b52a2169feacd39f66eda7740a504c0fcb74cc3e852fedff6f17d57880b7c573ff72e235d08f9ee5496f31bcde4c00d52262922924edc416757df810767e1c0a213b2acabb284325b70bf83fe9db7e67b50ce61862f604200a45daed	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ypjjisecabab\2134b0df = 9a0d4f979f004ea82a457e355dd21ef80a59a1bdb00e52798b0003b5f5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ypjjisecabab\6be20f67 = 448770991967e72f0f271481c66e77389afbc295f377f4a0e6f4b22332d7aebdc8b560daff381b65a93a2a42345ba7384fccec547fd6cda7e39a6b0d30a58903d64bd7f29adb0d71c5331724ef769b24c521c235cc11e448f877f58f3abc51e67a9cb5126bc9e24768fefbac5a7c1d88f478e3775bfa279fe9cac1b7d3eb9e30a62495d21806412ea69cade597396861626fdf6d89fcb2f8e82c87fd3c218b6d12515ab490f945	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ypjjisecabab\69a32f1b = fe9a4704bb8707e470f432dc44d9a620b9ec7fad8f8e8798aaa1a20c0ce4a24cedcd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ypjjisecabab\d11f487e = fc77dc22171f1cfa93da2b8fff60392c009de1d8bfa770fe15	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ypjjisecabab\ac1707f4 = baf9011264614f7d2b2c2aec929c3788b50997754e2446e14ec95c0bdbf4f0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ypjjisecabab\d35e6802 = 008e64be389c8717342c78e95d2fd1202b012af512b05d43bb3fcc8899eb9de429e03c4fe0935f870d5bf8ca82907bcd97eeadd1a58cb0e535b1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ypjjisecabab\5e7ddf29 = ff91b0b2cc2e49b59f62c27991301029516b5405db01cb15fb718be43cb2be9f4e1310438eca2e46b27fe8c83097af4747e814af1af7391ecd6c820d0fdbdeea5b5c8c9ce4b7dd14ad	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
5092	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe
4084	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

5092 regsvr32.exe
4084 regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 5096 wrote to memory of 5092	5096	regsvr32.exe	regsvr32.exe
PID 5096 wrote to memory of 5092	5096	regsvr32.exe	regsvr32.exe
PID 5096 wrote to memory of 5092	5096	regsvr32.exe	regsvr32.exe
PID 5092 wrote to memory of 2224	5092	regsvr32.exe	explorer.exe
PID 5092 wrote to memory of 2224	5092	regsvr32.exe	explorer.exe
PID 5092 wrote to memory of 2224	5092	regsvr32.exe	explorer.exe
PID 5092 wrote to memory of 2224	5092	regsvr32.exe	explorer.exe
PID 5092 wrote to memory of 2224	5092	regsvr32.exe	explorer.exe
PID 2224 wrote to memory of 3692	2224	explorer.exe	schtasks.exe
PID 2224 wrote to memory of 3692	2224	explorer.exe	schtasks.exe
PID 2224 wrote to memory of 3692	2224	explorer.exe	schtasks.exe
PID 3256 wrote to memory of 4084	3256	regsvr32.exe	regsvr32.exe
PID 3256 wrote to memory of 4084	3256	regsvr32.exe	regsvr32.exe
PID 3256 wrote to memory of 4084	3256	regsvr32.exe	regsvr32.exe
PID 4084 wrote to memory of 1064	4084	regsvr32.exe	explorer.exe
PID 4084 wrote to memory of 1064	4084	regsvr32.exe	explorer.exe
PID 4084 wrote to memory of 1064	4084	regsvr32.exe	explorer.exe
PID 4084 wrote to memory of 1064	4084	regsvr32.exe	explorer.exe
PID 4084 wrote to memory of 1064	4084	regsvr32.exe	explorer.exe
PID 1064 wrote to memory of 3104	1064	explorer.exe	reg.exe
PID 1064 wrote to memory of 3104	1064	explorer.exe	reg.exe
PID 1064 wrote to memory of 4340	1064	explorer.exe	reg.exe
PID 1064 wrote to memory of 4340	1064	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5096

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5092

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rgmxqyxwl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll\"" /SC ONCE /Z /ST 12:24 /ET 12:36
4⤵
- Creates scheduled task(s)
PID:3692

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3256

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4084

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Etjhjx" /d "0"
4⤵
PID:3104

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Wxuoi" /d "0"
4⤵
PID:4340

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll
MD5
f0bd4b7b006bf160b6fe97a0d6670738

SHA1
3ecf978f460879155310d9564ff30d0ff56815de

SHA256
021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf

SHA512
2bc7751e6a0af6bc5c706431dc207216ffb12a69367f2590a53d860e3efa30aa417f5c8db4b39712a50e0ce36d48d0013ffa89545a21ba10b0cf94e47d6f6de2

Download Submit
C:\Users\Admin\AppData\Local\Temp\021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll
MD5
f0bd4b7b006bf160b6fe97a0d6670738

SHA1
3ecf978f460879155310d9564ff30d0ff56815de

SHA256
021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf

SHA512
2bc7751e6a0af6bc5c706431dc207216ffb12a69367f2590a53d860e3efa30aa417f5c8db4b39712a50e0ce36d48d0013ffa89545a21ba10b0cf94e47d6f6de2

Download Submit
memory/1064-145-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Filesize
132KB

Download
memory/2224-138-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Filesize
132KB

Download
memory/4084-141-0x0000000001990000-0x0000000001A0B000-memory.dmp

Filesize
492KB

Download
memory/4084-142-0x0000000077C10000-0x0000000077DB3000-memory.dmp

Filesize
1.6MB

Download
memory/4084-143-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4084-144-0x0000000001A10000-0x0000000001BB3000-memory.dmp

Filesize
1.6MB

Download
memory/5092-134-0x00000000015D0000-0x000000000164B000-memory.dmp

Filesize
492KB

Download
memory/5092-135-0x0000000077C10000-0x0000000077DB3000-memory.dmp

Filesize
1.6MB

Download
memory/5092-136-0x0000000002FF0000-0x0000000003193000-memory.dmp

Filesize
1.6MB

Download
memory/5092-137-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download