qakbot | 26229a2003664a3afe9867cfaa7dd10c149bc91e49059630f8e230b2e0b5bc7a

General

Target

ApplicationReject-1221452547.xlsb
Size

1.1MB
MD5

eb6354a5ba2b6898673595c5f66782e9
SHA1

266ed4f8703e4704e8aa2997cce01ce037f07051
SHA256

ba68f78275487c646826664f394e8ca0ff58e8df4eb900939d0acbeb8001d898
SHA512

07837e7c4bc651e6fb5168b349943bb5b47c91587e1d6ff802d93d05f05a423686a58ddf21372290a4fa6d6ff733c6457cc387d8b9801292c353afd5ac5ea7a7

Score

10^/10

qakbot obama180 1650959141 banker stealer trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://103.155.93.53/817967157.dat

xlm40.dropper

http://87.236.146.69/817967157.dat

xlm40.dropper

http://94.140.114.172/817967157.dat

Extracted

Family

qakbot

Version

403.573

Botnet

obama180

Campaign

1650959141

C2

2.50.4.57:443

85.246.82.244:443

121.7.223.59:2222

197.161.137.67:993

38.70.253.226:2222

47.23.89.62:993

172.114.160.81:443

75.99.168.194:443

82.152.39.39:443

108.60.213.141:443

148.64.96.100:443

167.86.191.84:443

187.207.47.198:61202

103.107.113.120:443

203.122.46.130:443

106.51.48.170:50001

47.23.89.62:995

140.82.49.12:443

102.65.38.74:443

103.246.242.202:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

Regsvr32.exeRegsvr32.exeRegsvr32.exeRegsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1944	1948	Regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1756	1948	Regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	824	1948	Regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	892	1948	Regsvr32.exe	EXCEL.EXE

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

Regsvr32.exe

pid process

892 Regsvr32.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

pid	process
892	Regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1948 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Regsvr32.exeexplorer.exe

pid process

892 Regsvr32.exe
1348 explorer.exe
1348 explorer.exe
1348 explorer.exe
1348 explorer.exe
1348 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Regsvr32.exe

pid process

892 Regsvr32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

EXCEL.EXE

pid process

1948 EXCEL.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

EXCEL.EXE

pid process

1948 EXCEL.EXE
1948 EXCEL.EXE
1948 EXCEL.EXE
1948 EXCEL.EXE
1948 EXCEL.EXE
1948 EXCEL.EXE

pid	process
1948	EXCEL.EXE

pid	process
892	Regsvr32.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe

pid	process
892	Regsvr32.exe

pid	process
1948	EXCEL.EXE

pid	process
1948	EXCEL.EXE
1948	EXCEL.EXE
1948	EXCEL.EXE
1948	EXCEL.EXE
1948	EXCEL.EXE
1948	EXCEL.EXE

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

EXCEL.EXERegsvr32.exe

description	pid	process	target process
PID 1948 wrote to memory of 1944	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 1944	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 1944	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 1944	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 1944	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 1944	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 1944	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 1756	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 1756	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 1756	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 1756	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 1756	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 1756	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 1756	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 824	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 824	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 824	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 824	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 824	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 824	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 824	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 892	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 892	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 892	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 892	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 892	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 892	1948	EXCEL.EXE	Regsvr32.exe
PID 1948 wrote to memory of 892	1948	EXCEL.EXE	Regsvr32.exe
PID 892 wrote to memory of 1348	892	Regsvr32.exe	explorer.exe
PID 892 wrote to memory of 1348	892	Regsvr32.exe	explorer.exe
PID 892 wrote to memory of 1348	892	Regsvr32.exe	explorer.exe
PID 892 wrote to memory of 1348	892	Regsvr32.exe	explorer.exe
PID 892 wrote to memory of 1348	892	Regsvr32.exe	explorer.exe
PID 892 wrote to memory of 1348	892	Regsvr32.exe	explorer.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\ApplicationReject-1221452547.xlsb
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32 /s calc
  2⤵
  - Process spawned unexpected child process
  PID:1944
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32 C:\Rujiky\Ubada\Vertu.ooccxx
  2⤵
  - Process spawned unexpected child process
  PID:1756
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32 C:\Rujiky\Ubada\Vertua.ooccxx
  2⤵
  - Process spawned unexpected child process
  PID:824
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32 C:\Rujiky\Ubada\Vertub.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Rujiky\Ubada\Vertub.ooccxx

Filesize
962KB

MD5
3e71e22d4c1d9825b1bcfa06cf8f1ab7

SHA1
499aad92be6df330a5efcd66a9ec9f60eea7176a

SHA256
cf82136970ff9e1d0bce5c3b91aa4eb83f309c2b9372dd59caa18accb0ebae8b

SHA512
602c1925d25eb4a80277e01e5e1558c229d6a2c0ab6452befdbb8dd559093d05485c26cfb79480edb56273514c1d225fb2c79fc5ffd3de7ac15a1fb53e6571a7

Download Submit
\Rujiky\Ubada\Vertub.ooccxx

Filesize
962KB

MD5
3e71e22d4c1d9825b1bcfa06cf8f1ab7

SHA1
499aad92be6df330a5efcd66a9ec9f60eea7176a

SHA256
cf82136970ff9e1d0bce5c3b91aa4eb83f309c2b9372dd59caa18accb0ebae8b

SHA512
602c1925d25eb4a80277e01e5e1558c229d6a2c0ab6452befdbb8dd559093d05485c26cfb79480edb56273514c1d225fb2c79fc5ffd3de7ac15a1fb53e6571a7

Download Submit
memory/824-63-0x0000000000000000-mapping.dmp

Download
memory/892-65-0x0000000000000000-mapping.dmp

Download
memory/892-69-0x0000000010000000-0x000000001008F000-memory.dmp

Filesize
572KB

Download
memory/1348-78-0x0000000000190000-0x000000000021F000-memory.dmp

Filesize
572KB

Download
memory/1348-77-0x000000006C4D1000-0x000000006C4D3000-memory.dmp

Filesize
8KB

Download
memory/1348-75-0x0000000000000000-mapping.dmp

Download
memory/1756-61-0x0000000000000000-mapping.dmp

Download
memory/1944-59-0x0000000000000000-mapping.dmp

Download
memory/1948-54-0x000000002F0D1000-0x000000002F0D4000-memory.dmp

Filesize
12KB

Download
memory/1948-58-0x00000000727AD000-0x00000000727B8000-memory.dmp

Filesize
44KB

Download
memory/1948-57-0x0000000076721000-0x0000000076723000-memory.dmp

Filesize
8KB

Download
memory/1948-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1948-55-0x00000000717C1000-0x00000000717C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads