qakbot | 10a78acc563dfa32f45c5b0f0ad1eae80ab7e003269c65f0c214f3048fd04ca5

General

Target

ApplicationReject-345465966.xlsb
Size

1.1MB
MD5

f5bee5418f9f284303e9e811b095310b
SHA1

f6ec42fed7646cd06076079e8763cc834605c9ab
SHA256

3b3447f2dc038fd05da4650f5aae658ad62261d3c5e71134e0ce9d1ce7901e02
SHA512

c3b2befff00f83ddc9d22e8f3923e6b43cd561543d254314752bb9468e4289b62763db14208cc86a7e17207927200383e5dc87815606ce60c1560bd673cb2f9f

Score

10^/10

qakbot obama180 1650959141 banker stealer trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://103.155.93.53/90602300.dat

xlm40.dropper

http://87.236.146.69/90602300.dat

xlm40.dropper

http://94.140.114.172/90602300.dat

Extracted

Family

qakbot

Version

403.573

Botnet

obama180

Campaign

1650959141

C2

2.50.4.57:443

85.246.82.244:443

121.7.223.59:2222

197.161.137.67:993

38.70.253.226:2222

47.23.89.62:993

172.114.160.81:443

75.99.168.194:443

82.152.39.39:443

108.60.213.141:443

148.64.96.100:443

167.86.191.84:443

187.207.47.198:61202

103.107.113.120:443

203.122.46.130:443

106.51.48.170:50001

47.23.89.62:995

140.82.49.12:443

102.65.38.74:443

103.246.242.202:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

Regsvr32.exeRegsvr32.exeRegsvr32.exeRegsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1176	1964	Regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	700	1964	Regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1380	1964	Regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1808	1964	Regsvr32.exe	EXCEL.EXE

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

Regsvr32.exe

pid process

1808 Regsvr32.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

pid	process
1808	Regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1964 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Regsvr32.exeexplorer.exe

pid process

1808 Regsvr32.exe
1948 explorer.exe
1948 explorer.exe
1948 explorer.exe
1948 explorer.exe
1948 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Regsvr32.exe

pid process

1808 Regsvr32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

EXCEL.EXE

pid process

1964 EXCEL.EXE
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

EXCEL.EXE

pid process

1964 EXCEL.EXE
1964 EXCEL.EXE
1964 EXCEL.EXE
1964 EXCEL.EXE
1964 EXCEL.EXE

pid	process
1964	EXCEL.EXE

pid	process
1808	Regsvr32.exe
1948	explorer.exe
1948	explorer.exe
1948	explorer.exe
1948	explorer.exe
1948	explorer.exe

pid	process
1808	Regsvr32.exe

pid	process
1964	EXCEL.EXE

pid	process
1964	EXCEL.EXE
1964	EXCEL.EXE
1964	EXCEL.EXE
1964	EXCEL.EXE
1964	EXCEL.EXE

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

EXCEL.EXERegsvr32.exe

description	pid	process	target process
PID 1964 wrote to memory of 1176	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1176	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1176	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1176	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1176	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1176	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1176	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 700	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 700	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 700	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 700	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 700	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 700	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 700	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1380	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1380	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1380	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1380	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1380	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1380	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1380	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1808	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1808	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1808	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1808	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1808	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1808	1964	EXCEL.EXE	Regsvr32.exe
PID 1964 wrote to memory of 1808	1964	EXCEL.EXE	Regsvr32.exe
PID 1808 wrote to memory of 1948	1808	Regsvr32.exe	explorer.exe
PID 1808 wrote to memory of 1948	1808	Regsvr32.exe	explorer.exe
PID 1808 wrote to memory of 1948	1808	Regsvr32.exe	explorer.exe
PID 1808 wrote to memory of 1948	1808	Regsvr32.exe	explorer.exe
PID 1808 wrote to memory of 1948	1808	Regsvr32.exe	explorer.exe
PID 1808 wrote to memory of 1948	1808	Regsvr32.exe	explorer.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\ApplicationReject-345465966.xlsb
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\Regsvr32.exe
Regsvr32 /s calc
2⤵
- Process spawned unexpected child process
PID:1176

C:\Windows\SysWOW64\Regsvr32.exe
Regsvr32 C:\Rujiky\Ubada\Vertu.ooccxx
2⤵
- Process spawned unexpected child process
PID:700

C:\Windows\SysWOW64\Regsvr32.exe
Regsvr32 C:\Rujiky\Ubada\Vertua.ooccxx
2⤵
- Process spawned unexpected child process
PID:1380

C:\Windows\SysWOW64\Regsvr32.exe
Regsvr32 C:\Rujiky\Ubada\Vertub.ooccxx
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Rujiky\Ubada\Vertub.ooccxx
Filesize
962KB

MD5
41a056753d017c22d32082748c5dbec1

SHA1
8eda002cae819993519f1e3108ef6fcae5a35d5d

SHA256
fc41ed47aad9fd3df3eb58425c964c6826a3071ac8384ef25b34f88a1b0a7fdc

SHA512
660ea2e466286627b7c501d05845584b205dcbd24b6d03848c60dcf56a5ad03ef90abe91049c45153a7ee03c8648ff960c9f155f89bc809b83304f8b75cf0041

Download Submit
\Rujiky\Ubada\Vertub.ooccxx
Filesize
962KB

MD5
41a056753d017c22d32082748c5dbec1

SHA1
8eda002cae819993519f1e3108ef6fcae5a35d5d

SHA256
fc41ed47aad9fd3df3eb58425c964c6826a3071ac8384ef25b34f88a1b0a7fdc

SHA512
660ea2e466286627b7c501d05845584b205dcbd24b6d03848c60dcf56a5ad03ef90abe91049c45153a7ee03c8648ff960c9f155f89bc809b83304f8b75cf0041

Download Submit
memory/700-61-0x0000000000000000-mapping.dmp

Download
memory/1176-59-0x0000000000000000-mapping.dmp

Download
memory/1380-63-0x0000000000000000-mapping.dmp

Download
memory/1808-65-0x0000000000000000-mapping.dmp

Download
memory/1808-69-0x0000000010000000-0x000000001008F000-memory.dmp

Filesize
572KB

Download
memory/1948-75-0x0000000000000000-mapping.dmp

Download
memory/1948-77-0x000000006C111000-0x000000006C113000-memory.dmp

Filesize
8KB

Download
memory/1948-78-0x0000000000350000-0x00000000003DF000-memory.dmp

Filesize
572KB

Download
memory/1964-57-0x000000007222D000-0x0000000072238000-memory.dmp

Filesize
44KB

Download
memory/1964-58-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/1964-54-0x000000002F9A1000-0x000000002F9A4000-memory.dmp

Filesize
12KB

Download
memory/1964-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1964-55-0x0000000071241000-0x0000000071243000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads