qakbot | 5597159f5b250a487e4f0eb7242dc938f6e335839131601d8ec22d34756489aa

General

Target

Cancellation-1228813013$-May5.xlsb
Size

65KB
MD5

4ed18e5cf0345e1fec51922960217b52
SHA1

1dd2279ce4c569ff462884c1a283c6c9d5505dc7
SHA256

8aa260005950bb9d062fa127e0f7fa615b02fafb15000cac4ff52e4aa97f1d16
SHA512

df53c2ce7788cbce925014ce03c6efbb6e4354c73b9fe14615e5a3798203d18dc0f67117602472c2743e043f51993e4327334ac90fd0de185708a0c9bf3a89f3

Score

10^/10

qakbot obama182 1651756499 banker stealer trojan

Malware Config

Extracted

Language

xlm4.0

Source

Extracted

Family

qakbot

Version

403.683

Botnet

obama182

Campaign

1651756499

C2

103.107.113.120:443

80.11.74.81:2222

177.102.2.175:32101

24.178.196.158:2222

91.177.173.10:995

181.208.248.227:443

176.67.56.94:443

202.134.152.2:2222

148.0.57.85:443

179.179.162.9:993

40.134.246.185:995

37.186.54.254:995

196.203.37.215:80

120.150.218.241:995

208.107.221.224:443

113.53.151.59:443

70.46.220.114:443

69.14.172.24:443

108.60.213.141:443

24.55.67.176:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1648	1992	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	892	1992	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1224	1992	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	364	1992	regsvr32.exe	EXCEL.EXE

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

892 regsvr32.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

pid	process
892	regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1992 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

892 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

892 regsvr32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

EXCEL.EXE

pid process

1992 EXCEL.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1992 EXCEL.EXE
1992 EXCEL.EXE
1992 EXCEL.EXE

pid	process
1992	EXCEL.EXE

pid	process
892	regsvr32.exe

pid	process
892	regsvr32.exe

pid	process
1992	EXCEL.EXE

pid	process
1992	EXCEL.EXE
1992	EXCEL.EXE
1992	EXCEL.EXE

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

EXCEL.EXEregsvr32.exe

description	pid	process	target process
PID 1992 wrote to memory of 1648	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 1648	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 1648	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 1648	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 1648	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 1648	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 1648	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 892	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 892	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 892	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 892	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 892	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 892	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 892	1992	EXCEL.EXE	regsvr32.exe
PID 892 wrote to memory of 1472	892	regsvr32.exe	explorer.exe
PID 892 wrote to memory of 1472	892	regsvr32.exe	explorer.exe
PID 892 wrote to memory of 1472	892	regsvr32.exe	explorer.exe
PID 892 wrote to memory of 1472	892	regsvr32.exe	explorer.exe
PID 892 wrote to memory of 1472	892	regsvr32.exe	explorer.exe
PID 892 wrote to memory of 1472	892	regsvr32.exe	explorer.exe
PID 1992 wrote to memory of 1224	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 1224	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 1224	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 1224	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 1224	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 1224	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 1224	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 364	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 364	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 364	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 364	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 364	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 364	1992	EXCEL.EXE	regsvr32.exe
PID 1992 wrote to memory of 364	1992	EXCEL.EXE	regsvr32.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Cancellation-1228813013$-May5.xlsb
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s calc
2⤵
- Process spawned unexpected child process
PID:1648

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 C:\Merto\Byrost\Veonse.OOOCCCXXX
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:1472

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 C:\Merto\Byrost\Veonsea.OOOCCCXXX
2⤵
- Process spawned unexpected child process
PID:1224

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 C:\Merto\Byrost\Veonseb.OOOCCCXXX
2⤵
- Process spawned unexpected child process
PID:364

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Merto\Byrost\Veonse.OOOCCCXXX
Filesize
855KB

MD5
fb7e028ddd7cb0e6e3fa6ab37ef80398

SHA1
c095a498e90caa1c1e4af7858ec655c8cda2ad8a

SHA256
8bec1402ad03cb9a9b23cf070335ae8cfafca329c020dac16e80e3ec8c5693ae

SHA512
76122803dfe58bfd11951da0a4070b4462e10bbc82ae42602b95ea0ca01323ecf4dc03b54b6e3677ab44d39ec4c6dd1c8a9502993c1665c86a647ec5cd74433b

Download Submit
\Merto\Byrost\Veonse.OOOCCCXXX
Filesize
855KB

MD5
fb7e028ddd7cb0e6e3fa6ab37ef80398

SHA1
c095a498e90caa1c1e4af7858ec655c8cda2ad8a

SHA256
8bec1402ad03cb9a9b23cf070335ae8cfafca329c020dac16e80e3ec8c5693ae

SHA512
76122803dfe58bfd11951da0a4070b4462e10bbc82ae42602b95ea0ca01323ecf4dc03b54b6e3677ab44d39ec4c6dd1c8a9502993c1665c86a647ec5cd74433b

Download Submit
memory/364-75-0x0000000000000000-mapping.dmp

Download
memory/892-68-0x0000000000520000-0x0000000000542000-memory.dmp

Filesize
136KB

Download
memory/892-69-0x00000000002D0000-0x00000000002F2000-memory.dmp

Filesize
136KB

Download
memory/892-67-0x0000000000520000-0x0000000000542000-memory.dmp

Filesize
136KB

Download
memory/892-61-0x0000000000000000-mapping.dmp

Download
memory/892-66-0x0000000000520000-0x0000000000542000-memory.dmp

Filesize
136KB

Download
memory/892-65-0x0000000000A30000-0x0000000000B0A000-memory.dmp

Filesize
872KB

Download
memory/1224-73-0x0000000000000000-mapping.dmp

Download
memory/1472-70-0x0000000000000000-mapping.dmp

Download
memory/1472-72-0x000000006C001000-0x000000006C003000-memory.dmp

Filesize
8KB

Download
memory/1648-59-0x0000000000000000-mapping.dmp

Download
memory/1992-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1992-57-0x000000007204D000-0x0000000072058000-memory.dmp

Filesize
44KB

Download
memory/1992-54-0x000000002FA71000-0x000000002FA74000-memory.dmp

Filesize
12KB

Download
memory/1992-58-0x00000000751C1000-0x00000000751C3000-memory.dmp

Filesize
8KB

Download
memory/1992-55-0x0000000071061000-0x0000000071063000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads