qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
4294217s
max time network
137s
platform
windows7_x64
resource
win7-20220310-en
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b.dll
Size

378KB
MD5

7a35246c94d5dd27aff56a7862b1d33e
SHA1

24b38e564c4027dbf26ba3bf766335c5be029faf
SHA256

98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b
SHA512

011e4860daa0f1bc977e6fe1c006c29b93386af5f313170661cd4f5d697b82da906f689050fa37696ee31f8fbfa1bd95339c7f8358bc14b0c63c62f35a46d985

Score

10^/10

qakbot obama104 1632729661 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

obama104

Campaign

1632729661

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1312 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

428 schtasks.exe

pid	process
1312	regsvr32.exe

pid	process
428	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vlpjscuoaqzf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vlpjscuoaqzf\71924ed4 = ccedc8571e7ccebd63ffedd7a01ee17cb0d538f6e101e1b918ccb6a2c60f02fae4602a32b254e02162fc99d5699ef91617b9f665	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vlpjscuoaqzf\440d9e9a = a03d7290425893e4bd1426b3427bfcb8ee5bd65d6a16dc0a4e2317cec2737a52d0864df9ec4f415825227ffb9e80910d5bc7d885c00416f62f6b91872a1dbec683fda08d19243b2c3ea106c42b3f0374545216641bf09c0cd07fa26abd30e2ea338e16ad44877f6798bf33be1ed7baf1c9e45a18d24cf3cd053425fe4fb30b2fddc2b13493731891bffc63e9ae36c772dfa9ba969f90faa544f137123929e1eea80b67912821e5950eebab43770585d811b8ac3882577d8f0392d2f8033ba4ec9474	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vlpjscuoaqzf\464cbee6 = 1750a4f8bf39dd07743d5da812dc20aa83a18e0b3e4c86683899d66c087ba81423	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vlpjscuoaqzf\fef0d983 = cae85222f9120b988c8f65c217f2cceaece453bcfe25a9b5dad5ae8d04c3bc75	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vlpjscuoaqzf\3b44f16c = 5505429467f8a82659efd31f45dd3a97e0751466575e22c03fcef9c3fa597838c9a51d509689ca4a8117bad4c97059e937766d5fa372c232fd30baf4aff619808fe8fadd9837fa2338ceec4fcdea9018abfe1a266a5b328af1dc5e1e57f8998b4a7bb3ec89ef	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vlpjscuoaqzf\71924ed4 = cceddf571e7cfb52e9389e1844ebdabc0946ffd4ae92f4647b07be3435bc4ac148bdb4529837aaf836ea734cc512e91b4f8c6cef393ea5a0e3d9aaadf07b7c1b463586291280af82b8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vlpjscuoaqzf\83f89609 = a6e84a5c6ca0334ace35fd921cccf245aac0c769e09712a2f3b8f48ddc1f60d3e3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vlpjscuoaqzf\fcb1f9ff = c94f09b10077f1b3dd26404e6cfa2d57459bf9e395c06d4cd51c93008cfc5fa6b9cafb3abd1c9269abcfe9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vlpjscuoaqzf\edb2122 = 1b8a3d00d1b51f658baaea08e0791ab9402455862612faae9fd4d23c71406c49dfa3b553f9fcff2265dd2f4e428de63502383407c65155a650cf3d6d4ee2ca9666b0e673754f657c87fd0f27d8d8d180bc5e69b4f2197a60b0f5fbe73db716	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

960 rundll32.exe
1312 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

960 rundll32.exe
1312 regsvr32.exe

pid	process
960	rundll32.exe
1312	regsvr32.exe

pid	process
960	rundll32.exe
1312	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1548 wrote to memory of 960	1548	rundll32.exe	rundll32.exe
PID 1548 wrote to memory of 960	1548	rundll32.exe	rundll32.exe
PID 1548 wrote to memory of 960	1548	rundll32.exe	rundll32.exe
PID 1548 wrote to memory of 960	1548	rundll32.exe	rundll32.exe
PID 1548 wrote to memory of 960	1548	rundll32.exe	rundll32.exe
PID 1548 wrote to memory of 960	1548	rundll32.exe	rundll32.exe
PID 1548 wrote to memory of 960	1548	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 1884	960	rundll32.exe	explorer.exe
PID 960 wrote to memory of 1884	960	rundll32.exe	explorer.exe
PID 960 wrote to memory of 1884	960	rundll32.exe	explorer.exe
PID 960 wrote to memory of 1884	960	rundll32.exe	explorer.exe
PID 960 wrote to memory of 1884	960	rundll32.exe	explorer.exe
PID 960 wrote to memory of 1884	960	rundll32.exe	explorer.exe
PID 1884 wrote to memory of 428	1884	explorer.exe	schtasks.exe
PID 1884 wrote to memory of 428	1884	explorer.exe	schtasks.exe
PID 1884 wrote to memory of 428	1884	explorer.exe	schtasks.exe
PID 1884 wrote to memory of 428	1884	explorer.exe	schtasks.exe
PID 972 wrote to memory of 1344	972	taskeng.exe	regsvr32.exe
PID 972 wrote to memory of 1344	972	taskeng.exe	regsvr32.exe
PID 972 wrote to memory of 1344	972	taskeng.exe	regsvr32.exe
PID 972 wrote to memory of 1344	972	taskeng.exe	regsvr32.exe
PID 972 wrote to memory of 1344	972	taskeng.exe	regsvr32.exe
PID 1344 wrote to memory of 1312	1344	regsvr32.exe	regsvr32.exe
PID 1344 wrote to memory of 1312	1344	regsvr32.exe	regsvr32.exe
PID 1344 wrote to memory of 1312	1344	regsvr32.exe	regsvr32.exe
PID 1344 wrote to memory of 1312	1344	regsvr32.exe	regsvr32.exe
PID 1344 wrote to memory of 1312	1344	regsvr32.exe	regsvr32.exe
PID 1344 wrote to memory of 1312	1344	regsvr32.exe	regsvr32.exe
PID 1344 wrote to memory of 1312	1344	regsvr32.exe	regsvr32.exe
PID 1312 wrote to memory of 1324	1312	regsvr32.exe	explorer.exe
PID 1312 wrote to memory of 1324	1312	regsvr32.exe	explorer.exe
PID 1312 wrote to memory of 1324	1312	regsvr32.exe	explorer.exe
PID 1312 wrote to memory of 1324	1312	regsvr32.exe	explorer.exe
PID 1312 wrote to memory of 1324	1312	regsvr32.exe	explorer.exe
PID 1312 wrote to memory of 1324	1312	regsvr32.exe	explorer.exe
PID 1324 wrote to memory of 928	1324	explorer.exe	reg.exe
PID 1324 wrote to memory of 928	1324	explorer.exe	reg.exe
PID 1324 wrote to memory of 928	1324	explorer.exe	reg.exe
PID 1324 wrote to memory of 928	1324	explorer.exe	reg.exe
PID 1324 wrote to memory of 1360	1324	explorer.exe	reg.exe
PID 1324 wrote to memory of 1360	1324	explorer.exe	reg.exe
PID 1324 wrote to memory of 1360	1324	explorer.exe	reg.exe
PID 1324 wrote to memory of 1360	1324	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn gsnjhuen /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b.dll\"" /SC ONCE /Z /ST 12:24 /ET 12:36
4⤵
- Creates scheduled task(s)
PID:428

C:\Windows\system32\taskeng.exe
taskeng.exe {EB267A51-502A-4B60-BFAF-257367789879} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:972

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Gefteuyiuk" /d "0"
5⤵
PID:928

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Pedyedut" /d "0"
5⤵
PID:1360

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b.dll
MD5
7a35246c94d5dd27aff56a7862b1d33e

SHA1
24b38e564c4027dbf26ba3bf766335c5be029faf

SHA256
98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b

SHA512
011e4860daa0f1bc977e6fe1c006c29b93386af5f313170661cd4f5d697b82da906f689050fa37696ee31f8fbfa1bd95339c7f8358bc14b0c63c62f35a46d985

Download Submit
\Users\Admin\AppData\Local\Temp\98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b.dll
MD5
7a35246c94d5dd27aff56a7862b1d33e

SHA1
24b38e564c4027dbf26ba3bf766335c5be029faf

SHA256
98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b

SHA512
011e4860daa0f1bc977e6fe1c006c29b93386af5f313170661cd4f5d697b82da906f689050fa37696ee31f8fbfa1bd95339c7f8358bc14b0c63c62f35a46d985

Download Submit
memory/960-54-0x0000000075EA1000-0x0000000075EA3000-memory.dmp

Filesize
8KB

Download
memory/960-55-0x00000000006C0000-0x0000000000702000-memory.dmp

Filesize
264KB

Download
memory/960-56-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/1312-70-0x0000000000170000-0x00000000001B2000-memory.dmp

Filesize
264KB

Download
memory/1312-71-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/1324-72-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1344-62-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Filesize
8KB

Download
memory/1884-57-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/1884-60-0x0000000074CC1000-0x0000000074CC3000-memory.dmp

Filesize
8KB

Download
memory/1884-61-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads