qakbot | 08713b548ad4cd818ac03227d1b5fd453e7af13313feeac7e4e564ff125e3efe

General

Target

Cancellation-1070520191$-May5.xlsb
Size

65KB
MD5

34fee3c22bb8083223fd247fcdd37105
SHA1

a7d976dd7e40e5d96195cc0d596e6853f1c5fca9
SHA256

cf466f71763ed24dfdb8504a79c0866cf9f13ff57a3aeee2f726bc9242b50525
SHA512

defa15e90117fbb2d86a53ba645630d62cf6f387360eddae51f19ec89c1038d71a1b2c574446e2c6a21f50009d7dd81633dc88d0a000134b3bf3952a3430edfa

Score

10^/10

qakbot obama182 1651756499 banker stealer trojan

Malware Config

Extracted

Language

xlm4.0

Source

Extracted

Family

qakbot

Version

403.683

Botnet

obama182

Campaign

1651756499

C2

103.107.113.120:443

80.11.74.81:2222

177.102.2.175:32101

24.178.196.158:2222

91.177.173.10:995

181.208.248.227:443

176.67.56.94:443

202.134.152.2:2222

148.0.57.85:443

179.179.162.9:993

40.134.246.185:995

37.186.54.254:995

196.203.37.215:80

120.150.218.241:995

208.107.221.224:443

113.53.151.59:443

70.46.220.114:443

69.14.172.24:443

108.60.213.141:443

24.55.67.176:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exeregsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	556	1056	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1104	1056	regsvr32.exe	EXCEL.EXE

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1104 regsvr32.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

pid	process
1104	regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1056 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

1104 regsvr32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1056 EXCEL.EXE
1056 EXCEL.EXE
1056 EXCEL.EXE

pid	process
1056	EXCEL.EXE

pid	process
1104	regsvr32.exe

pid	process
1056	EXCEL.EXE
1056	EXCEL.EXE
1056	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

EXCEL.EXE

description	pid	process	target process
PID 1056 wrote to memory of 556	1056	EXCEL.EXE	regsvr32.exe
PID 1056 wrote to memory of 556	1056	EXCEL.EXE	regsvr32.exe
PID 1056 wrote to memory of 556	1056	EXCEL.EXE	regsvr32.exe
PID 1056 wrote to memory of 556	1056	EXCEL.EXE	regsvr32.exe
PID 1056 wrote to memory of 556	1056	EXCEL.EXE	regsvr32.exe
PID 1056 wrote to memory of 556	1056	EXCEL.EXE	regsvr32.exe
PID 1056 wrote to memory of 556	1056	EXCEL.EXE	regsvr32.exe
PID 1056 wrote to memory of 1104	1056	EXCEL.EXE	regsvr32.exe
PID 1056 wrote to memory of 1104	1056	EXCEL.EXE	regsvr32.exe
PID 1056 wrote to memory of 1104	1056	EXCEL.EXE	regsvr32.exe
PID 1056 wrote to memory of 1104	1056	EXCEL.EXE	regsvr32.exe
PID 1056 wrote to memory of 1104	1056	EXCEL.EXE	regsvr32.exe
PID 1056 wrote to memory of 1104	1056	EXCEL.EXE	regsvr32.exe
PID 1056 wrote to memory of 1104	1056	EXCEL.EXE	regsvr32.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Cancellation-1070520191$-May5.xlsb
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s calc
  2⤵
  - Process spawned unexpected child process
  PID:556
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 C:\Merto\Byrost\Veonse.OOOCCCXXX
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Merto\Byrost\Veonse.OOOCCCXXX

Filesize
855KB

MD5
ef2c8ba496011d1793f8a0c9f9fa79c8

SHA1
523f1dbc9d8c9b25b51045255d9ffdee80e7505f

SHA256
a1e7d3471f21962ecdcb6769316094f5afa7f6a878c47ecc9b780f5ebb1e8591

SHA512
6a41657e862f30bf6f874b7e92a0a220b6b378afa37cfba47d52bf49e8d7e5365b6c8bfc4a97776858d57e8178b0168c1a774dc9f491ce1851c1c3589875781e

Download Submit
\Merto\Byrost\Veonse.OOOCCCXXX

Filesize
855KB

MD5
ef2c8ba496011d1793f8a0c9f9fa79c8

SHA1
523f1dbc9d8c9b25b51045255d9ffdee80e7505f

SHA256
a1e7d3471f21962ecdcb6769316094f5afa7f6a878c47ecc9b780f5ebb1e8591

SHA512
6a41657e862f30bf6f874b7e92a0a220b6b378afa37cfba47d52bf49e8d7e5365b6c8bfc4a97776858d57e8178b0168c1a774dc9f491ce1851c1c3589875781e

Download Submit
memory/556-59-0x0000000000000000-mapping.dmp

Download
memory/1056-57-0x000000007237D000-0x0000000072388000-memory.dmp

Filesize
44KB

Download
memory/1056-58-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/1056-54-0x000000002F701000-0x000000002F704000-memory.dmp

Filesize
12KB

Download
memory/1056-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1056-55-0x0000000071391000-0x0000000071393000-memory.dmp

Filesize
8KB

Download
memory/1104-61-0x0000000000000000-mapping.dmp

Download
memory/1104-65-0x00000000009D0000-0x0000000000AAA000-memory.dmp

Filesize
872KB

Download
memory/1104-66-0x0000000000840000-0x0000000000862000-memory.dmp

Filesize
136KB

Download
memory/1104-67-0x0000000000840000-0x0000000000862000-memory.dmp

Filesize
136KB

Download
memory/1104-68-0x0000000000840000-0x0000000000862000-memory.dmp

Filesize
136KB

Download
memory/1104-69-0x00000000006D0000-0x00000000006F2000-memory.dmp

Filesize
136KB

Download
memory/1104-70-0x0000000000840000-0x0000000000862000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads