qakbot | 1803f9390c070076b7c4eb751ab74160cbe5eacaeb2f69f4a0b0ba765bc5c110

General

Target

ApplicationReject-706073812.xlsb
Size

1.1MB
MD5

82eefe190e22d87e535c9dc375fe039e
SHA1

6b2e5804508f58cfcfa76eca249e11f025490d77
SHA256

9b14898f42362545794c7400c889d19cc6df0bc8536414b5a13772185d1d2be3
SHA512

14d0f9ef03435ddca7be4c23b0d83c3d61ab81cb7860a925af3d2c0aa9701cb29c06f1ff71bc0e8b8ef49667504af5d743fd24770106d3c6f4cb2f1dc12522a1

Score

10^/10

qakbot obama180 1650959141 banker stealer trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://103.155.93.53/694416531.dat

xlm40.dropper

http://87.236.146.69/694416531.dat

xlm40.dropper

http://94.140.114.172/694416531.dat

Extracted

Family

qakbot

Version

403.573

Botnet

obama180

Campaign

1650959141

C2

2.50.4.57:443

85.246.82.244:443

121.7.223.59:2222

197.161.137.67:993

38.70.253.226:2222

47.23.89.62:993

172.114.160.81:443

75.99.168.194:443

82.152.39.39:443

108.60.213.141:443

148.64.96.100:443

167.86.191.84:443

187.207.47.198:61202

103.107.113.120:443

203.122.46.130:443

106.51.48.170:50001

47.23.89.62:995

140.82.49.12:443

102.65.38.74:443

103.246.242.202:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

Regsvr32.exeRegsvr32.exeRegsvr32.exeRegsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	964	1960	Regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	984	1960	Regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1852	1960	Regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	240	1960	Regsvr32.exe	EXCEL.EXE

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

Regsvr32.exe

pid process

240 Regsvr32.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

pid	process
240	Regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1960 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

Regsvr32.exeexplorer.exe

pid process

240 Regsvr32.exe
1052 explorer.exe
1052 explorer.exe
1052 explorer.exe
1052 explorer.exe
1052 explorer.exe
1052 explorer.exe
1052 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Regsvr32.exe

pid process

240 Regsvr32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

EXCEL.EXE

pid process

1960 EXCEL.EXE
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

EXCEL.EXE

pid process

1960 EXCEL.EXE
1960 EXCEL.EXE
1960 EXCEL.EXE
1960 EXCEL.EXE
1960 EXCEL.EXE

pid	process
1960	EXCEL.EXE

pid	process
240	Regsvr32.exe
1052	explorer.exe
1052	explorer.exe
1052	explorer.exe
1052	explorer.exe
1052	explorer.exe
1052	explorer.exe
1052	explorer.exe

pid	process
240	Regsvr32.exe

pid	process
1960	EXCEL.EXE

pid	process
1960	EXCEL.EXE
1960	EXCEL.EXE
1960	EXCEL.EXE
1960	EXCEL.EXE
1960	EXCEL.EXE

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

EXCEL.EXERegsvr32.exe

description	pid	process	target process
PID 1960 wrote to memory of 964	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 964	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 964	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 964	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 964	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 964	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 964	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 984	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 984	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 984	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 984	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 984	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 984	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 984	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 1852	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 1852	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 1852	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 1852	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 1852	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 1852	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 1852	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 240	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 240	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 240	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 240	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 240	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 240	1960	EXCEL.EXE	Regsvr32.exe
PID 1960 wrote to memory of 240	1960	EXCEL.EXE	Regsvr32.exe
PID 240 wrote to memory of 1052	240	Regsvr32.exe	explorer.exe
PID 240 wrote to memory of 1052	240	Regsvr32.exe	explorer.exe
PID 240 wrote to memory of 1052	240	Regsvr32.exe	explorer.exe
PID 240 wrote to memory of 1052	240	Regsvr32.exe	explorer.exe
PID 240 wrote to memory of 1052	240	Regsvr32.exe	explorer.exe
PID 240 wrote to memory of 1052	240	Regsvr32.exe	explorer.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\ApplicationReject-706073812.xlsb
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\Regsvr32.exe
Regsvr32 /s calc
2⤵
- Process spawned unexpected child process
PID:964

C:\Windows\SysWOW64\Regsvr32.exe
Regsvr32 C:\Rujiky\Ubada\Vertu.ooccxx
2⤵
- Process spawned unexpected child process
PID:984

C:\Windows\SysWOW64\Regsvr32.exe
Regsvr32 C:\Rujiky\Ubada\Vertua.ooccxx
2⤵
- Process spawned unexpected child process
PID:1852

C:\Windows\SysWOW64\Regsvr32.exe
Regsvr32 C:\Rujiky\Ubada\Vertub.ooccxx
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:240

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1052

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Rujiky\Ubada\Vertub.ooccxx
Filesize
962KB

MD5
c8ad273f1503f8dc51dcbef7df3fd9ff

SHA1
b4a79e22dcf034cb5ab796a56201e6443afe4729

SHA256
167544249e18e1e05bdf6a96cfd2bc3156a295cbbcdca53cd80d8139d3b36a5a

SHA512
7934052f13509823a8d1eb0e47d8a904cb15ee3d8d8dd1f8e696226369c0f08c96045869015d41fe1f3568ab3a7508f84ab613bbb136c5f490e7da5fa100cdc2

Download Submit
\Rujiky\Ubada\Vertub.ooccxx
Filesize
962KB

MD5
c8ad273f1503f8dc51dcbef7df3fd9ff

SHA1
b4a79e22dcf034cb5ab796a56201e6443afe4729

SHA256
167544249e18e1e05bdf6a96cfd2bc3156a295cbbcdca53cd80d8139d3b36a5a

SHA512
7934052f13509823a8d1eb0e47d8a904cb15ee3d8d8dd1f8e696226369c0f08c96045869015d41fe1f3568ab3a7508f84ab613bbb136c5f490e7da5fa100cdc2

Download Submit
memory/240-69-0x0000000010000000-0x000000001008F000-memory.dmp

Filesize
572KB

Download
memory/240-65-0x0000000000000000-mapping.dmp

Download
memory/964-59-0x0000000000000000-mapping.dmp

Download
memory/984-61-0x0000000000000000-mapping.dmp

Download
memory/1052-75-0x0000000000000000-mapping.dmp

Download
memory/1052-77-0x000000006BFD1000-0x000000006BFD3000-memory.dmp

Filesize
8KB

Download
memory/1052-78-0x0000000000080000-0x000000000010F000-memory.dmp

Filesize
572KB

Download
memory/1852-63-0x0000000000000000-mapping.dmp

Download
memory/1960-54-0x000000002F7F1000-0x000000002F7F4000-memory.dmp

Filesize
12KB

Download
memory/1960-58-0x0000000075DE1000-0x0000000075DE3000-memory.dmp

Filesize
8KB

Download
memory/1960-57-0x00000000720BD000-0x00000000720C8000-memory.dmp

Filesize
44KB

Download
memory/1960-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1960-55-0x00000000710D1000-0x00000000710D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads