qakbot | 60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2

Analysis

max time kernel
135s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9be188ae25897326093bac560a28547f.dll
Size

572KB
MD5

9be188ae25897326093bac560a28547f
SHA1

f8c004df37c37864e7f48d7c44a651d96ce19a5a
SHA256

60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2
SHA512

70134745bcbbc7f183a603d6d6f30499cf828d44560fb7b97eee693d9e998ea62d10ab5968fb3b9c76592616f4a913d0074b3cb5b93772b9e094a23ff40bfe9e
SSDEEP

6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eHP:VvAfLfaEkAz50

Score

10^/10

qakbot obama114 1634112211 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Hqvvobkq = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Eduysy = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid	Process
2920	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exe

pid	Process
2820	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oimyisf\d1c16c64 = cda23e2105ad52cfdd3e268e2a9b392ff378677ea9b5a7753db214356c0fae12b2762559d0cc8a878e6e6d183796c0359dab70d14b960b8a2d2415f7dd1f28597da23e254c3f7644d41f1f962d1e54f861a3b8b05884a4d937ca7ca57e594d9bbaf406371a15	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oimyisf\e61f9c56 = 2aadcf7936c388380eb8b3b535f786d08558225289cc402b10aa9f38	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oimyisf\23abb4b9 = f43667d46461917712655e0e9d5a0efce16f4f714b23247db43b96462b6b8b1afe9e73f4f652368b72f341e9f573825eaa2f91834ab5ffc2bc0a9c9b34468687d390f2b2ba849e07290644bf1fae91f221daece8b7751cfebd96bf7d5d2924f7d1d7bce76b5acf721b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oimyisf\9b17d3dc = 938e220dd5807e98b82d2ece1306	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oimyisf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oimyisf\5ea3fb33 = 6494ad7d08956f46df30a60a85ee5ea42132d09edb72c3cc195e343e21354865badac86901430566f7f2dfb05181522ec813290bf5c914d1794496740b3f61e3779a7c87f737e2bccb0d905d337f4dd0ada053dc857653d26c1430683e972627c90091ec89f7e4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oimyisf\5ce2db4f = c0b4cca077c7cc8bf9df8d982b0720335732637ce42b4a5b5d969313deb68932d4f69452dfa09687e2fcd8a045c26cfc23f7eb3c7d7e1e1e270d637018e7fbede3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oimyisf\ae880392 = c58233a03b3fa4b268ecbdf62c5153a8312e2521486ec43900	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oimyisf\d1c16c64 = cda2292105ad6759dce36ea66ed7e0b51570a2720d7b288c3d8f7795b49ae26fabb5195b3e66f6b6ff96c4781554c81b6e7b9b574b9eddb1bcd45f5cb343707c8b2d1d1a2e6c4c27a7294a9bc25ab8758ae9ea9f75ac23e49804ee07d161e7cf3888603bb317d32136840b20b3fd83a0872da76f8acefd3e24076d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oimyisf\e45ebc2a = e832428f4c65276de6e78d5fe44d478a00afe6f1763a5f706adabf463b8a167ad0266e671976bdc850be1e330fbd5f8e5981bfb38d5e5fdcfb16b0f3591a942e6e61df8a08ba1572c85fc7f2bc434b4ca3a098a3e76015cb4bfe7c47aaa43afa45aea00a06069a435bc0e894993fefe83a37eff612f3b9b3a3	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid	Process
2816	rundll32.exe
2920	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid	Process
2816	rundll32.exe
2920	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	Process	procid_target
PID 2752 wrote to memory of 2816	2752	rundll32.exe	28
PID 2752 wrote to memory of 2816	2752	rundll32.exe	28
PID 2752 wrote to memory of 2816	2752	rundll32.exe	28
PID 2752 wrote to memory of 2816	2752	rundll32.exe	28
PID 2752 wrote to memory of 2816	2752	rundll32.exe	28
PID 2752 wrote to memory of 2816	2752	rundll32.exe	28
PID 2752 wrote to memory of 2816	2752	rundll32.exe	28
PID 2816 wrote to memory of 3004	2816	rundll32.exe	29
PID 2816 wrote to memory of 3004	2816	rundll32.exe	29
PID 2816 wrote to memory of 3004	2816	rundll32.exe	29
PID 2816 wrote to memory of 3004	2816	rundll32.exe	29
PID 2816 wrote to memory of 3004	2816	rundll32.exe	29
PID 2816 wrote to memory of 3004	2816	rundll32.exe	29
PID 3004 wrote to memory of 2820	3004	explorer.exe	30
PID 3004 wrote to memory of 2820	3004	explorer.exe	30
PID 3004 wrote to memory of 2820	3004	explorer.exe	30
PID 3004 wrote to memory of 2820	3004	explorer.exe	30
PID 2292 wrote to memory of 2796	2292	taskeng.exe	35
PID 2292 wrote to memory of 2796	2292	taskeng.exe	35
PID 2292 wrote to memory of 2796	2292	taskeng.exe	35
PID 2292 wrote to memory of 2796	2292	taskeng.exe	35
PID 2292 wrote to memory of 2796	2292	taskeng.exe	35
PID 2796 wrote to memory of 2920	2796	regsvr32.exe	36
PID 2796 wrote to memory of 2920	2796	regsvr32.exe	36
PID 2796 wrote to memory of 2920	2796	regsvr32.exe	36
PID 2796 wrote to memory of 2920	2796	regsvr32.exe	36
PID 2796 wrote to memory of 2920	2796	regsvr32.exe	36
PID 2796 wrote to memory of 2920	2796	regsvr32.exe	36
PID 2796 wrote to memory of 2920	2796	regsvr32.exe	36
PID 2920 wrote to memory of 1680	2920	regsvr32.exe	37
PID 2920 wrote to memory of 1680	2920	regsvr32.exe	37
PID 2920 wrote to memory of 1680	2920	regsvr32.exe	37
PID 2920 wrote to memory of 1680	2920	regsvr32.exe	37
PID 2920 wrote to memory of 1680	2920	regsvr32.exe	37
PID 2920 wrote to memory of 1680	2920	regsvr32.exe	37
PID 1680 wrote to memory of 1264	1680	explorer.exe	38
PID 1680 wrote to memory of 1264	1680	explorer.exe	38
PID 1680 wrote to memory of 1264	1680	explorer.exe	38
PID 1680 wrote to memory of 1264	1680	explorer.exe	38
PID 1680 wrote to memory of 2760	1680	explorer.exe	41
PID 1680 wrote to memory of 2760	1680	explorer.exe	41
PID 1680 wrote to memory of 2760	1680	explorer.exe	41
PID 1680 wrote to memory of 2760	1680	explorer.exe	41

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kldkbgsr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll\"" /SC ONCE /Z /ST 13:11 /ET 13:23
      4⤵
      Creates scheduled task(s)
      PID:2820

C:\Windows\system32\taskeng.exe
taskeng.exe {5898F3B3-40E8-49CE-80D6-2506DBE34A00} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1680
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Hqvvobkq" /d "0"
        5⤵
        Windows security bypass
        
        PID:1264
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Eduysy" /d "0"
        5⤵
        Windows security bypass
        
        PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll

Filesize
572KB

MD5
9be188ae25897326093bac560a28547f

SHA1
f8c004df37c37864e7f48d7c44a651d96ce19a5a

SHA256
60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2

SHA512
70134745bcbbc7f183a603d6d6f30499cf828d44560fb7b97eee693d9e998ea62d10ab5968fb3b9c76592616f4a913d0074b3cb5b93772b9e094a23ff40bfe9e

Download Submit
memory/1680-28-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1680-24-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1680-26-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1680-30-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1680-27-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2816-3-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2816-7-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2816-0-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2816-2-0x00000000002D0000-0x0000000000305000-memory.dmp

Filesize
212KB

Download
memory/2816-1-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2920-23-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2920-19-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2920-20-0x0000000000330000-0x0000000000365000-memory.dmp

Filesize
212KB

Download
memory/2920-21-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/3004-6-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/3004-14-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/3004-12-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/3004-11-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/3004-10-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/3004-4-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download