qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
4294201s
max time network
128s
platform
windows7_x64
resource
win7-20220310-en
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d.dll
Size

378KB
MD5

908f17686edf6f7663a40c31e7971225
SHA1

4f2c8a970f0a5ab4c7c27b1b23825ffebd344b1c
SHA256

9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d
SHA512

a154e9b8fc629a18ea08c1019442d383f348ded69c5ba05a6153dce6684ba31ce20cbda880519e615a8102a1ea0049d5e324d2f95ec78531c94f10a3854c46cc

Score

10^/10

qakbot obama104 1632729661 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

obama104

Campaign

1632729661

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1708 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1144 schtasks.exe

pid	process
1708	regsvr32.exe

pid	process
1144	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esrexnzja\e091cabe = 93644ac18a34e6cec171fef65054f985450cbe115c79e77045f645c94c210ffd89dcc91b28f901d53d4968973cba03f59e534c86975ec468fc79f600d419a03bb54fe6db0fd849c8c64e0bab8c119a0c8c6d58475877d2dbd6146f33b96aa1585331506982f011fc30d62b79f8bdd5acfeab5e7f923de2	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Esrexnzja	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esrexnzja\e091cabe = 93645dc18a34d30e48fd1ca43818785b888b6648fbf8e7592b1dc69ed263ac7429107fad42a816241c9f30039dfff6bbde53425a7831fd2ba2f35d94cc75deb9ef551c7ff5d556200371123c8a6f94c030eeb3649489d27bb48ad0fdeb1cfabd5b0d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esrexnzja\d50e1af0 = c843fa1a61a366d6fb840ea35783daaf20a099dc807b0e3e00025f694e0efb246f70e39c845a81ffe7bb6c542a930ccd4c5c0302ea681b63b04fcd8083a0d1308c7efb59458d0717c57dd81acd572ecfaa8175c7aeedf7fec050b82f788c39dbd524	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esrexnzja\aa477506 = e6d124ba7999e0e2cfaf12dd2cf608069e80df856b968dd81d08b345cfe640b9eb016d5514ff4074fccbdba57af75be4b5973d7a16889d52ae175e77ba4c37ef14a635fc1cf88b81a39f439949481fedbd8200e3f95226c5fc6b8f210817bf468fcb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esrexnzja\6db27d95 = fa7fe707e25b31f1057262adc7fa98d5ee8fb329b09ec2f07d9f80e818506b36b3b69c9c3ad6e5e50f0784b77a72bda6b195e9b0c37e4b4a311ab40b693250ba59b972f15a985ce1a25ad0bbb063cde9d58a76b66dc59cc2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esrexnzja\9fd8a548 = 5813de2cdf1bc58ff7293ad394506686fca608bb01d5b057947a1d43682f16b02a35bf88f6b954a20597dcf748f19cc7cef191f3c458c0e575d229b58e8f762df92022301bb8c23cb8369ddf27fead98718bbd20d9c8af1b65a2603b99c9c06d8c3318cf8145b2549b1f6e69d8a77d6cbfe6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esrexnzja\d74f3a8c = a442c1e1a13377e76c2c4138b30c2fef5cee98c69278ad48935e63592df2a5547ad1282f3444ba053094b1d79bf2de3160ee97d7b9749e920781e279cb651d1cd9ac	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esrexnzja\6ff35de9 = 068c6c60a996facd48d2a156f368d477cbf574e1dae11b5fda9521e99cceff1bf438236c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Esrexnzja\12fb1263 = 5e50c830700c52e17877f857a54489fcde594e4f054d29d2602750e5c066a979e231e76a2b843b197f1dd95f65c3989b36f4e712e19f556bb645a7e1c09785ef3974a2f523732d322ba12608c49fdee0ceef9bc8b21b0ae8318c74889b56d36846a6946279	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1344 rundll32.exe
1708 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1344 rundll32.exe
1708 regsvr32.exe

pid	process
1344	rundll32.exe
1708	regsvr32.exe

pid	process
1344	rundll32.exe
1708	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1092 wrote to memory of 1344	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1344	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1344	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1344	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1344	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1344	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 1344	1092	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1108	1344	rundll32.exe	explorer.exe
PID 1344 wrote to memory of 1108	1344	rundll32.exe	explorer.exe
PID 1344 wrote to memory of 1108	1344	rundll32.exe	explorer.exe
PID 1344 wrote to memory of 1108	1344	rundll32.exe	explorer.exe
PID 1344 wrote to memory of 1108	1344	rundll32.exe	explorer.exe
PID 1344 wrote to memory of 1108	1344	rundll32.exe	explorer.exe
PID 1108 wrote to memory of 1144	1108	explorer.exe	schtasks.exe
PID 1108 wrote to memory of 1144	1108	explorer.exe	schtasks.exe
PID 1108 wrote to memory of 1144	1108	explorer.exe	schtasks.exe
PID 1108 wrote to memory of 1144	1108	explorer.exe	schtasks.exe
PID 480 wrote to memory of 1212	480	taskeng.exe	regsvr32.exe
PID 480 wrote to memory of 1212	480	taskeng.exe	regsvr32.exe
PID 480 wrote to memory of 1212	480	taskeng.exe	regsvr32.exe
PID 480 wrote to memory of 1212	480	taskeng.exe	regsvr32.exe
PID 480 wrote to memory of 1212	480	taskeng.exe	regsvr32.exe
PID 1212 wrote to memory of 1708	1212	regsvr32.exe	regsvr32.exe
PID 1212 wrote to memory of 1708	1212	regsvr32.exe	regsvr32.exe
PID 1212 wrote to memory of 1708	1212	regsvr32.exe	regsvr32.exe
PID 1212 wrote to memory of 1708	1212	regsvr32.exe	regsvr32.exe
PID 1212 wrote to memory of 1708	1212	regsvr32.exe	regsvr32.exe
PID 1212 wrote to memory of 1708	1212	regsvr32.exe	regsvr32.exe
PID 1212 wrote to memory of 1708	1212	regsvr32.exe	regsvr32.exe
PID 1708 wrote to memory of 864	1708	regsvr32.exe	explorer.exe
PID 1708 wrote to memory of 864	1708	regsvr32.exe	explorer.exe
PID 1708 wrote to memory of 864	1708	regsvr32.exe	explorer.exe
PID 1708 wrote to memory of 864	1708	regsvr32.exe	explorer.exe
PID 1708 wrote to memory of 864	1708	regsvr32.exe	explorer.exe
PID 1708 wrote to memory of 864	1708	regsvr32.exe	explorer.exe
PID 864 wrote to memory of 1556	864	explorer.exe	reg.exe
PID 864 wrote to memory of 1556	864	explorer.exe	reg.exe
PID 864 wrote to memory of 1556	864	explorer.exe	reg.exe
PID 864 wrote to memory of 1556	864	explorer.exe	reg.exe
PID 864 wrote to memory of 772	864	explorer.exe	reg.exe
PID 864 wrote to memory of 772	864	explorer.exe	reg.exe
PID 864 wrote to memory of 772	864	explorer.exe	reg.exe
PID 864 wrote to memory of 772	864	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cthmmho /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d.dll\"" /SC ONCE /Z /ST 12:25 /ET 12:37
4⤵
- Creates scheduled task(s)
PID:1144

C:\Windows\system32\taskeng.exe
taskeng.exe {41AE35AD-DBFE-4E17-9DCA-118AA664B02E} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:480

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Wbmeup" /d "0"
5⤵
PID:1556

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Usahbmmuyy" /d "0"
5⤵
PID:772

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d.dll
MD5
908f17686edf6f7663a40c31e7971225

SHA1
4f2c8a970f0a5ab4c7c27b1b23825ffebd344b1c

SHA256
9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d

SHA512
a154e9b8fc629a18ea08c1019442d383f348ded69c5ba05a6153dce6684ba31ce20cbda880519e615a8102a1ea0049d5e324d2f95ec78531c94f10a3854c46cc

Download Submit
\Users\Admin\AppData\Local\Temp\9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d.dll
MD5
908f17686edf6f7663a40c31e7971225

SHA1
4f2c8a970f0a5ab4c7c27b1b23825ffebd344b1c

SHA256
9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d

SHA512
a154e9b8fc629a18ea08c1019442d383f348ded69c5ba05a6153dce6684ba31ce20cbda880519e615a8102a1ea0049d5e324d2f95ec78531c94f10a3854c46cc

Download Submit
memory/864-72-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1108-57-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/1108-60-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1108-61-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1212-62-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

Filesize
8KB

Download
memory/1344-54-0x0000000075AA1000-0x0000000075AA3000-memory.dmp

Filesize
8KB

Download
memory/1344-55-0x00000000001C0000-0x0000000000202000-memory.dmp

Filesize
264KB

Download
memory/1344-56-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/1708-66-0x0000000000270000-0x00000000002B2000-memory.dmp

Filesize
264KB

Download
memory/1708-67-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download