qakbot | 30bef9a5f75a235e9823beb54267c1bb7faacc9e067bcb4bea367df702ce997e

General

Target

01970422_890527.lnk
Size

1KB
MD5

76390978f26d3c6d7f799257542796ce
SHA1

4d3efb8f9db9519160fe13f79ef5be1c041eed0e
SHA256

03160be7cb698e1684f47071cb441ff181ff299cb38429636d11542ba8d306ae
SHA512

8c6243c7a93974dbf1a6878fbb2ad89861a4b960fb5262ba6c0e6274f78fcf93c90e80d1f007b9a6e3deafd53969fffb8f2e66adfd0e10c19fe7f65e4c597779

Score

10^/10

qakbot obama186 1654596660 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.694

Botnet

obama186

Campaign

1654596660

C2

67.165.206.193:993

63.143.92.99:995

74.14.5.179:2222

182.191.92.203:995

197.89.8.51:443

89.101.97.139:443

86.97.9.190:443

124.40.244.115:2222

80.11.74.81:2222

41.215.153.104:995

179.100.20.32:32101

31.35.28.29:443

202.134.152.2:2222

109.12.111.14:443

93.48.80.198:995

120.150.218.241:995

41.38.167.179:995

177.94.57.126:32101

173.174.216.62:443

1.161.101.20:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Qhjoyvjzmjst = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Jpqfhem = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation cmd.exe
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

5044 regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation	cmd.exe

pid	process
5044	regsvr32.exe

Drops file in System32 directory 4 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1456 schtasks.exe

pid	process
1456	schtasks.exe

Modifies data under HKEY_USERS 20 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Siufhyvneuea\6fc9d541 = 7a14e467ae89a62ab6a66f080b9aa8fdc5917d37b444ed9443b190839a5fdb0f0ee05f258fbc051055fe617275202e9a9e70c5e2368659be3dda08dc315c2712fe4147c86ae364c1c9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Siufhyvneuea\5a56050f = 0ea0be072b2a3911de6c3204f33dae21ee77dea1bfcf5a122644df43faa94648a32e6d0ee0a9dfd593c6f21129d1658a6dededc52c72a81b1fde915f08f7f10e2e6bfbccd00dbf271c7e7f1c1e6df5b5238357a935f5d7dd3af65a23be4de6ce46a9ccad061f72aa17288b46062b0c48186cdc7bfc3030b9185270c4098070937088ef79dcea8753f4af758b37fdeb8beda461c39bb1ec8a57e5e53e9b6f91c1f0a17084f5afd0bbc8e41ce14fcbe7e2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Siufhyvneuea\58172573 = 5244cb38c77cf762a95ac1ea64101cac1f5708154cb2b29c32a81302da5101ae1f8782255fe3ebc0eb97e0bb16a80b068b04f99ef72457ac638e6034a4a36e2704e958e00f084de7d7445cb8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Siufhyvneuea\e2ea626a = 7d923bb9e86141d6176aa51ccebaf3c7e9fe33c27f43658853ba3fc164bc3a0c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Siufhyvneuea\251f6af9 = 9d564c6e2b50bcd3873396976cc7c15291009eedd608777e353296321d771133d3035f0256a9d510ea12204445d6821ac1b638cfddd09874e3fa57042b00d506f3e304c2d65e80649fd09a092068e6c8ce7b93fcf5b4ad3305ee8136b70ded336d6cbc00c04bf03fe09469	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Siufhyvneuea\6fc9d541 = 7a14f367ae89939ce363cad7f81970fdaa566ef5ce01c9a3fd069aad67d3606d88fc59472d4e68706f2a92b63ba0eeac141c3f5ad56aebd038c468197797d0303b15b083a24e0212d3bb43067dca889cefb74d93604b3cd0958f927bfef4	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Siufhyvneuea\6fc9d541 = 7a14fa67ae89939ce363cb9dfd127affa35661f3820ac1a0f40d929bdc87a6cb190dd89d1c97faab0ec32f19d7173d691f989d623549b1e98379be6a77ae6b6256d525623cafd09ea07cc26eea42a146a3495c33a28dadac5f1c980456bfea19081084df6b6fb9	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Siufhyvneuea	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Siufhyvneuea\9da30d9c = 8b5cab8dae8c1c5455908ef9cb2d25d7d6cc060f3c7bb99ed2444ff4b6ad5874a67e67236acdd09fb419172e353426a869fad812e50306b76f1e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Siufhyvneuea\1080bab7 = 8599c05fa226c45ed8b5f4fb39d5935388d542efebde90595cbe45	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Siufhyvneuea\6fc9d541 = 7a14f367ae89939ce363cad7f81970fdaa566ef5ce01c9a0f50692ad67d3606d88fc59472d4e68706f2a92b63ba0eeac141c3f5ad56aebd038c468197797d0303b15b083a24e0212d3bb43067dca889cefb74d93604b3cd0958f927bfef4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Siufhyvneuea\e0ab4216 = 1cecece3f60e17ffaa5b8051b48528e9202d7e9d291a1438823fad	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeexplorer.exe

pid	process
4960	rundll32.exe
4960	rundll32.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

4960 rundll32.exe
5044 regsvr32.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

cmd.exerundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 4292 wrote to memory of 4896	4292	cmd.exe	rundll32.exe
PID 4292 wrote to memory of 4896	4292	cmd.exe	rundll32.exe
PID 4896 wrote to memory of 4960	4896	rundll32.exe	rundll32.exe
PID 4896 wrote to memory of 4960	4896	rundll32.exe	rundll32.exe
PID 4896 wrote to memory of 4960	4896	rundll32.exe	rundll32.exe
PID 4960 wrote to memory of 4836	4960	rundll32.exe	explorer.exe
PID 4960 wrote to memory of 4836	4960	rundll32.exe	explorer.exe
PID 4960 wrote to memory of 4836	4960	rundll32.exe	explorer.exe
PID 4960 wrote to memory of 4836	4960	rundll32.exe	explorer.exe
PID 4960 wrote to memory of 4836	4960	rundll32.exe	explorer.exe
PID 4836 wrote to memory of 1456	4836	explorer.exe	schtasks.exe
PID 4836 wrote to memory of 1456	4836	explorer.exe	schtasks.exe
PID 4836 wrote to memory of 1456	4836	explorer.exe	schtasks.exe
PID 3316 wrote to memory of 5044	3316	regsvr32.exe	regsvr32.exe
PID 3316 wrote to memory of 5044	3316	regsvr32.exe	regsvr32.exe
PID 3316 wrote to memory of 5044	3316	regsvr32.exe	regsvr32.exe
PID 5044 wrote to memory of 3880	5044	regsvr32.exe	explorer.exe
PID 5044 wrote to memory of 3880	5044	regsvr32.exe	explorer.exe
PID 5044 wrote to memory of 3880	5044	regsvr32.exe	explorer.exe
PID 5044 wrote to memory of 3880	5044	regsvr32.exe	explorer.exe
PID 5044 wrote to memory of 3880	5044	regsvr32.exe	explorer.exe
PID 3880 wrote to memory of 424	3880	explorer.exe	reg.exe
PID 3880 wrote to memory of 424	3880	explorer.exe	reg.exe
PID 3880 wrote to memory of 4496	3880	explorer.exe	reg.exe
PID 3880 wrote to memory of 4496	3880	explorer.exe	reg.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\01970422_890527.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4292

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" 019338921.dll,DllInstall
2⤵
- Suspicious use of WriteProcessMemory
PID:4896

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" 019338921.dll,DllInstall
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4960

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ljuhhvnpmp /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\019338921.dll\"" /SC ONCE /Z /ST 14:10 /ET 14:22
5⤵
- Creates scheduled task(s)
PID:1456

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\019338921.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3316

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\019338921.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5044

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3880

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Jpqfhem" /d "0"
4⤵
- Windows security bypass
PID:424

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Qhjoyvjzmjst" /d "0"
4⤵
- Windows security bypass
PID:4496

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\019338921.dll
Filesize
1.4MB

MD5
7bbeafc1ab9f9d1a48a99338ffec561c

SHA1
a4ce6de223addbdc66e747d3abd00b9f190fb5cb

SHA256
fca807ab91e7328195cafebe5761402f4d7066aef4c766c78a37f2c27fcf812c

SHA512
a32b34d9c03b6a1eaa1d409968d6d211a22320cc8b46955f8cda156f4956ea4a3d2e6d0a5fd8578e274e67db36e2696a7e8722647313333d3b7825d3e3a2c263

Download Submit
C:\Users\Admin\AppData\Local\Temp\019338921.dll
Filesize
1.4MB

MD5
7bbeafc1ab9f9d1a48a99338ffec561c

SHA1
a4ce6de223addbdc66e747d3abd00b9f190fb5cb

SHA256
fca807ab91e7328195cafebe5761402f4d7066aef4c766c78a37f2c27fcf812c

SHA512
a32b34d9c03b6a1eaa1d409968d6d211a22320cc8b46955f8cda156f4956ea4a3d2e6d0a5fd8578e274e67db36e2696a7e8722647313333d3b7825d3e3a2c263

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/424-151-0x0000000000000000-mapping.dmp

Download
memory/1456-139-0x0000000000000000-mapping.dmp

Download
memory/3880-154-0x0000000000C00000-0x0000000000C22000-memory.dmp

Filesize
136KB

Download
memory/3880-153-0x0000000000C00000-0x0000000000C22000-memory.dmp

Filesize
136KB

Download
memory/3880-148-0x0000000000000000-mapping.dmp

Download
memory/4496-152-0x0000000000000000-mapping.dmp

Download
memory/4836-137-0x0000000000000000-mapping.dmp

Download
memory/4836-141-0x0000000000550000-0x0000000000572000-memory.dmp

Filesize
136KB

Download
memory/4836-140-0x0000000000550000-0x0000000000572000-memory.dmp

Filesize
136KB

Download
memory/4896-132-0x0000000000000000-mapping.dmp

Download
memory/4960-136-0x0000000002F40000-0x0000000002F62000-memory.dmp

Filesize
136KB

Download
memory/4960-138-0x0000000002F40000-0x0000000002F62000-memory.dmp

Filesize
136KB

Download
memory/4960-135-0x0000000002EF0000-0x0000000002F1D000-memory.dmp

Filesize
180KB

Download
memory/4960-134-0x0000000002F40000-0x0000000002F62000-memory.dmp

Filesize
136KB

Download
memory/4960-133-0x0000000000000000-mapping.dmp

Download
memory/5044-146-0x0000000001B20000-0x0000000001B4D000-memory.dmp

Filesize
180KB

Download
memory/5044-147-0x0000000001B70000-0x0000000001B92000-memory.dmp

Filesize
136KB

Download
memory/5044-145-0x0000000001B70000-0x0000000001B92000-memory.dmp

Filesize
136KB

Download
memory/5044-150-0x0000000001B70000-0x0000000001B92000-memory.dmp

Filesize
136KB

Download
memory/5044-143-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads