qakbot | ef24e2502b962414d862dcb115122c70a786a52f933467a546eb85999027d92c

General

Target

ef24e2502b962414d862dcb115122c70a786a52f933467a546eb85999027d92c.iso
Size

2.6MB
MD5

ffe5b129fabddd3302aef956414b7f35
SHA1

26ffdf171e98a9ef1c54574d6227596a1af9c3f9
SHA256

ef24e2502b962414d862dcb115122c70a786a52f933467a546eb85999027d92c
SHA512

3e9cb4e120a45aa42f738046a219d20ec5f6363c47183fa08c1a26871e054f5b0ec78d2b6f07aac66300d7dac3e1d4f9f8c90ab6d4cf0879f85af3e06712a699

Score

10^/10

qakbot obama201 1657815129 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama201

Campaign

1657815129

C2

70.46.220.114:443

179.111.8.52:32101

208.107.221.224:443

176.45.218.138:995

24.158.23.166:995

24.54.48.11:443

89.101.97.139:443

24.55.67.176:443

24.139.72.117:443

120.150.218.241:995

174.69.215.101:443

38.70.253.226:2222

41.228.22.180:443

217.165.157.202:995

172.115.177.204:2222

173.21.10.71:2222

69.14.172.24:443

47.23.89.60:993

104.34.212.7:32103

66.230.104.103:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 1 IoCs

Processes:

calc.exe

pid process

3068 calc.exe
Loads dropped DLL 3 IoCs

Processes:

calc.exeregsvr32.exe

pid process

3068 calc.exe
1116 regsvr32.exe
1116 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4208 schtasks.exe

pid	process
3068	calc.exe

pid	process
3068	calc.exe
1116	regsvr32.exe
1116	regsvr32.exe

pid	process
4208	schtasks.exe

Modifies registry class 2 IoCs

Processes:

cmd.execalc.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	calc.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

7zFM.exeregsvr32.exeexplorer.exe

pid	process
204	7zFM.exe
204	7zFM.exe
204	7zFM.exe
204	7zFM.exe
1116	regsvr32.exe
1116	regsvr32.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

204 7zFM.exe
Suspicious behavior: LoadsDriver 3 IoCs

Processes:

cmd.exe

pid process

1884 cmd.exe
3168
3168
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1116 regsvr32.exe

pid	process
1884	cmd.exe
3168
3168

pid	process
1116	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7zFM.exe

description	pid	process
Token: SeRestorePrivilege	204	7zFM.exe
Token: 35	204	7zFM.exe
Token: SeSecurityPrivilege	204	7zFM.exe
Token: SeSecurityPrivilege	204	7zFM.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

7zFM.exe

pid process

204 7zFM.exe
204 7zFM.exe
204 7zFM.exe
204 7zFM.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

1380 OpenWith.exe

pid	process
1380	OpenWith.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

7zFM.execmd.execmd.execalc.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 204 wrote to memory of 1460	204	7zFM.exe	cmd.exe
PID 204 wrote to memory of 1460	204	7zFM.exe	cmd.exe
PID 1460 wrote to memory of 4084	1460	cmd.exe	calc.exe
PID 1460 wrote to memory of 4084	1460	cmd.exe	calc.exe
PID 3404 wrote to memory of 3068	3404	cmd.exe	calc.exe
PID 3404 wrote to memory of 3068	3404	cmd.exe	calc.exe
PID 3404 wrote to memory of 3068	3404	cmd.exe	calc.exe
PID 3068 wrote to memory of 1116	3068	calc.exe	regsvr32.exe
PID 3068 wrote to memory of 1116	3068	calc.exe	regsvr32.exe
PID 3068 wrote to memory of 1116	3068	calc.exe	regsvr32.exe
PID 1116 wrote to memory of 1464	1116	regsvr32.exe	explorer.exe
PID 1116 wrote to memory of 1464	1116	regsvr32.exe	explorer.exe
PID 1116 wrote to memory of 1464	1116	regsvr32.exe	explorer.exe
PID 1116 wrote to memory of 1464	1116	regsvr32.exe	explorer.exe
PID 1116 wrote to memory of 1464	1116	regsvr32.exe	explorer.exe
PID 1464 wrote to memory of 4208	1464	explorer.exe	schtasks.exe
PID 1464 wrote to memory of 4208	1464	explorer.exe	schtasks.exe
PID 1464 wrote to memory of 4208	1464	explorer.exe	schtasks.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ef24e2502b962414d862dcb115122c70a786a52f933467a546eb85999027d92c.iso
1⤵
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:1884

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1332

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\ef24e2502b962414d862dcb115122c70a786a52f933467a546eb85999027d92c.iso"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:204

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /q /c calc.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\system32\calc.exe
calc.exe
3⤵
- Modifies registry class
PID:4084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /q /c calc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3404

C:\Users\Admin\Desktop\calc.exe
calc.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\SysWOW64\regsvr32.exe 7533.dll
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 02:13 /tn ayuhckhuo /ET 02:24 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEQAZQBzAGsAdABvAHAAXAA3ADUAMwAzAC4AZABsAGwAIgA=" /SC ONCE
5⤵
- Creates scheduled task(s)
PID:4208

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\7533.dll
Filesize
663KB

MD5
301747865a880d14f58aa3bb0748c6e8

SHA1
3453a3a7f5d1d5d4df7554931dfebafcd1182191

SHA256
7b224bd513e9d6cc35ee46f1ee4322f91b93667e4048caa264bd15c6ba2799df

SHA512
922fc506a3fecfcd6f88a1cb00059f2882a2696aa059f56b884ba1d6d6df5a4893525b73e5cd2c0b8b24dff8ad886279a174f687b40e00bbb52a9467379037f2

Download Submit
C:\Users\Admin\Desktop\7533.dll
Filesize
663KB

MD5
301747865a880d14f58aa3bb0748c6e8

SHA1
3453a3a7f5d1d5d4df7554931dfebafcd1182191

SHA256
7b224bd513e9d6cc35ee46f1ee4322f91b93667e4048caa264bd15c6ba2799df

SHA512
922fc506a3fecfcd6f88a1cb00059f2882a2696aa059f56b884ba1d6d6df5a4893525b73e5cd2c0b8b24dff8ad886279a174f687b40e00bbb52a9467379037f2

Download Submit
C:\Users\Admin\Desktop\7533.dll
Filesize
663KB

MD5
301747865a880d14f58aa3bb0748c6e8

SHA1
3453a3a7f5d1d5d4df7554931dfebafcd1182191

SHA256
7b224bd513e9d6cc35ee46f1ee4322f91b93667e4048caa264bd15c6ba2799df

SHA512
922fc506a3fecfcd6f88a1cb00059f2882a2696aa059f56b884ba1d6d6df5a4893525b73e5cd2c0b8b24dff8ad886279a174f687b40e00bbb52a9467379037f2

Download Submit
C:\Users\Admin\Desktop\WindowsCodecs.dll
Filesize
4KB

MD5
21930abbbb06588edf0240cc60302143

SHA1
48bf9b838ecb90b8389a0c50b301acc32b44b53e

SHA256
8760c4b4cc8fdcd144651d5ba02195d238950d3b70abd7d7e1e2d42b6bda9751

SHA512
36b092e22b953a4c984530ee1f3d01aae88084ed8146918316438ee37daefe76ed3cb6dfa39c7a020871a92fc2df0a22b5f4146cdd6437339fe3cff4792db4f6

Download Submit
C:\Users\Admin\Desktop\WindowsCodecs.dll
Filesize
4KB

MD5
21930abbbb06588edf0240cc60302143

SHA1
48bf9b838ecb90b8389a0c50b301acc32b44b53e

SHA256
8760c4b4cc8fdcd144651d5ba02195d238950d3b70abd7d7e1e2d42b6bda9751

SHA512
36b092e22b953a4c984530ee1f3d01aae88084ed8146918316438ee37daefe76ed3cb6dfa39c7a020871a92fc2df0a22b5f4146cdd6437339fe3cff4792db4f6

Download Submit
C:\Users\Admin\Desktop\calc.exe
Filesize
758KB

MD5
60b7c0fead45f2066e5b805a91f4f0fc

SHA1
9018a7d6cdbe859a430e8794e73381f77c840be0

SHA256
80c10ee5f21f92f89cbc293a59d2fd4c01c7958aacad15642558db700943fa22

SHA512
68b9f9c00fc64df946684ce81a72a2624f0fc07e07c0c8b3db2fae8c9c0415bd1b4a03ad7ffa96985af0cc5e0410f6c5e29a30200efff21ab4b01369a3c59b58

Download Submit
C:\Users\Admin\Desktop\calc.exe
Filesize
758KB

MD5
60b7c0fead45f2066e5b805a91f4f0fc

SHA1
9018a7d6cdbe859a430e8794e73381f77c840be0

SHA256
80c10ee5f21f92f89cbc293a59d2fd4c01c7958aacad15642558db700943fa22

SHA512
68b9f9c00fc64df946684ce81a72a2624f0fc07e07c0c8b3db2fae8c9c0415bd1b4a03ad7ffa96985af0cc5e0410f6c5e29a30200efff21ab4b01369a3c59b58

Download Submit
memory/1116-141-0x00000000020E0000-0x000000000218C000-memory.dmp

Filesize
688KB

Download
memory/1116-137-0x0000000000000000-mapping.dmp

Download
memory/1116-142-0x0000000002B60000-0x0000000002B82000-memory.dmp

Filesize
136KB

Download
memory/1116-143-0x0000000002B10000-0x0000000002B39000-memory.dmp

Filesize
164KB

Download
memory/1116-144-0x0000000002B60000-0x0000000002B82000-memory.dmp

Filesize
136KB

Download
memory/1116-146-0x0000000002B60000-0x0000000002B82000-memory.dmp

Filesize
136KB

Download
memory/1460-130-0x0000000000000000-mapping.dmp

Download
memory/1464-145-0x0000000000000000-mapping.dmp

Download
memory/1464-148-0x0000000000BF0000-0x0000000000C12000-memory.dmp

Filesize
136KB

Download
memory/1464-149-0x0000000000BF0000-0x0000000000C12000-memory.dmp

Filesize
136KB

Download
memory/3068-132-0x0000000000000000-mapping.dmp

Download
memory/4084-131-0x0000000000000000-mapping.dmp

Download
memory/4208-147-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads