qakbot | 5eafda875a7dfb6c1ed60b7d90f7625caf24253a1eaf7d040894f45615a31281

General

Target

Qak_02CF0000.dll
Size

124KB
MD5

1732464a22a6d4d656b12500de0d9494
SHA1

477f2b33ff38b3806a80fb1133eec32d1d264c55
SHA256

8cb602444ed6e9f554ca05c916839957b88a6abc9b6e67958bae6a7740f01bf4
SHA512

861d5e0129e637ba60a7fba759c0052cf4b4f6392307557cd0b46ab5fc49350bf519b17f117a703fca161a2bb6de3dd8a9873cdb63ed20599f461942894d9027
SSDEEP

3072:z6gdJqokMqk/cfhlbMQTrJhVE/2fTBfAhV7g6Z:ugjqor/cfh2Q/J4/2fTBYYK

Score

10^/10

qakbot obama150 1640256791 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama150

Campaign

1640256791

C2

96.21.251.127:2222

70.51.134.181:2222

69.14.172.24:443

186.64.87.213:443

94.62.161.77:995

103.139.242.30:990

114.79.148.170:443

217.164.247.241:2222

178.153.86.181:443

136.232.34.70:443

37.210.226.125:61202

173.21.10.71:2222

31.219.154.176:32101

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

106.51.48.170:50001

114.38.161.124:995

96.37.113.36:993

190.39.205.165:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Hpigo = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Ayeyadapo = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
1180	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1784	schtasks.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oyzieegdadzzgu\72571b11 = eb601c1441e296022d089ad2e5da1a81660e00c0ba6412a97be007bfa8df8ab0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oyzieegdadzzgu\f5f549b = f1535482685f5b87e3ca904bf5389ac7f6dc3bc531b0ae5d992ffbb5863b8187838e6f7bb85dd29f54a904b961b24041745b01db12a013c7dd55e2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oyzieegdadzzgu\b7e333fe = 515dab7f8effcc9181deaa717e82b28e157119fa7e43c12ce826e4d929bfc77d27dfc8acb60d7c6286c2568fc72b6280218cf33941	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oyzieegdadzzgu\fd358c46 = 215391dee2242384171ff7e8ce85a55ec5e7e928ccd01b2ff76a301d46e42007b31ac53ad718024f1845	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oyzieegdadzzgu\caeb7c74 = da5db583dc7688b5d14c522206a4b6e63c0d77e917dbae9c14376e297484b20bfd278d5a9f0d1eff02aba9ba4c710be9fb17	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oyzieegdadzzgu\70163b6d = 3fbd011e23b7debde0bb88dcd5f060d8359f9ef9dab4f9d5e1e286c77f737c7ef00fa00651ae3117af24c92cc3463d51dcb6bdf13efae299d061abeb901dda1dd77e3189de9f70f9f7a23f6363534234134bb18d86d0a17588ffcd751b1219084552b22989d664523c03ac445742832ca9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oyzieegdadzzgu\827ce3b0 = 8c12fc8d8684b12b7777c53bdc77c0c81e36e00e3d3b5740	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oyzieegdadzzgu\fd358c46 = 215386dee22416650f85a59dad3497ee709bfa62383c3608a2282d655232cae71878f3033ba192a9c8d5d44dbe12ee629f15578c902995b419edb3e04272db	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oyzieegdadzzgu\fd358c46 = 215386dee22416650f85a59dad3497ee709bfa62383c3608ac272b655232cae71878f3033ba192a9c8d5d44dbe12ee629f15578c902995b419edb3e04272db	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oyzieegdadzzgu	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oyzieegdadzzgu\c8aa5c08 = 4263b6251079eb3122d7c67c4d2b13ba4e8fa93bf8dcb014835d2f5115346989c82303c3c453e63f68dbea8af3bb85f3365492d6c05220750168cc9a290644c032cc91dfa742436ee0a482879aa4542e90aceb1ad7992c4aa669fbe835570de202095825a9d350a606372fc495e5d8f706c02c	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3416	regsvr32.exe
3416	regsvr32.exe
1180	regsvr32.exe
1180	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3416	regsvr32.exe
1180	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 3416	1076	regsvr32.exe	81
PID 1076 wrote to memory of 3416	1076	regsvr32.exe	81
PID 1076 wrote to memory of 3416	1076	regsvr32.exe	81
PID 3416 wrote to memory of 2096	3416	regsvr32.exe	84
PID 3416 wrote to memory of 2096	3416	regsvr32.exe	84
PID 3416 wrote to memory of 2096	3416	regsvr32.exe	84
PID 3416 wrote to memory of 2096	3416	regsvr32.exe	84
PID 3416 wrote to memory of 2096	3416	regsvr32.exe	84
PID 2096 wrote to memory of 1784	2096	explorer.exe	86
PID 2096 wrote to memory of 1784	2096	explorer.exe	86
PID 2096 wrote to memory of 1784	2096	explorer.exe	86
PID 684 wrote to memory of 1180	684	regsvr32.exe	98
PID 684 wrote to memory of 1180	684	regsvr32.exe	98
PID 684 wrote to memory of 1180	684	regsvr32.exe	98
PID 1180 wrote to memory of 1384	1180	regsvr32.exe	99
PID 1180 wrote to memory of 1384	1180	regsvr32.exe	99
PID 1180 wrote to memory of 1384	1180	regsvr32.exe	99
PID 1180 wrote to memory of 1384	1180	regsvr32.exe	99
PID 1180 wrote to memory of 1384	1180	regsvr32.exe	99
PID 1384 wrote to memory of 2040	1384	explorer.exe	100
PID 1384 wrote to memory of 2040	1384	explorer.exe	100
PID 1384 wrote to memory of 1700	1384	explorer.exe	102
PID 1384 wrote to memory of 1700	1384	explorer.exe	102

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Qak_02CF0000.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Qak_02CF0000.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qttydrpin /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\Qak_02CF0000.dll\"" /SC ONCE /Z /ST 14:13 /ET 14:25
      4⤵
      Creates scheduled task(s)
      PID:1784

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\Qak_02CF0000.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:684
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\Qak_02CF0000.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1384
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Hpigo" /d "0"
      4⤵
      Windows security bypass
      PID:2040
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ayeyadapo" /d "0"
      4⤵
      Windows security bypass
      PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Qak_02CF0000.dll

Filesize
124KB

MD5
1732464a22a6d4d656b12500de0d9494

SHA1
477f2b33ff38b3806a80fb1133eec32d1d264c55

SHA256
8cb602444ed6e9f554ca05c916839957b88a6abc9b6e67958bae6a7740f01bf4

SHA512
861d5e0129e637ba60a7fba759c0052cf4b4f6392307557cd0b46ab5fc49350bf519b17f117a703fca161a2bb6de3dd8a9873cdb63ed20599f461942894d9027

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qak_02CF0000.dll

Filesize
124KB

MD5
1732464a22a6d4d656b12500de0d9494

SHA1
477f2b33ff38b3806a80fb1133eec32d1d264c55

SHA256
8cb602444ed6e9f554ca05c916839957b88a6abc9b6e67958bae6a7740f01bf4

SHA512
861d5e0129e637ba60a7fba759c0052cf4b4f6392307557cd0b46ab5fc49350bf519b17f117a703fca161a2bb6de3dd8a9873cdb63ed20599f461942894d9027

Download Submit
memory/1384-14-0x0000000000190000-0x00000000001B1000-memory.dmp

Filesize
132KB

Download
memory/1384-12-0x0000000000190000-0x00000000001B1000-memory.dmp

Filesize
132KB

Download
memory/1384-15-0x0000000000190000-0x00000000001B1000-memory.dmp

Filesize
132KB

Download
memory/1384-16-0x0000000000190000-0x00000000001B1000-memory.dmp

Filesize
132KB

Download
memory/1384-18-0x0000000000190000-0x00000000001B1000-memory.dmp

Filesize
132KB

Download
memory/1384-22-0x0000000000190000-0x00000000001B1000-memory.dmp

Filesize
132KB

Download
memory/2096-7-0x0000000000410000-0x0000000000431000-memory.dmp

Filesize
132KB

Download
memory/2096-5-0x0000000000410000-0x0000000000431000-memory.dmp

Filesize
132KB

Download
memory/2096-4-0x0000000000410000-0x0000000000431000-memory.dmp

Filesize
132KB

Download
memory/2096-3-0x0000000000410000-0x0000000000431000-memory.dmp

Filesize
132KB

Download
memory/2096-0-0x0000000000410000-0x0000000000431000-memory.dmp

Filesize
132KB

Download
memory/2096-20-0x0000000000410000-0x0000000000431000-memory.dmp

Filesize
132KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads