qakbot | 60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2

General

Target

9be188ae25897326093bac560a28547f.dll
Size

572KB
MD5

9be188ae25897326093bac560a28547f
SHA1

f8c004df37c37864e7f48d7c44a651d96ce19a5a
SHA256

60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2
SHA512

70134745bcbbc7f183a603d6d6f30499cf828d44560fb7b97eee693d9e998ea62d10ab5968fb3b9c76592616f4a913d0074b3cb5b93772b9e094a23ff40bfe9e
SSDEEP

6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eHP:VvAfLfaEkAz50

Score

10^/10

qakbot obama114 1634112211 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

C2

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Huraohirlu = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Fqriyh = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid	Process
1780	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exe

pid	Process
4648	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uuixiwlllpcx\6c8f2bc7 = 7c1907e619069f4574d1777ef3c2ca426ed0a4577e283c18d10d1b2e9ceb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uuixiwlllpcx\13c64431 = 4e6e623961a418b3bfefc25216e37fc9334892d843fec8bb94f00191cc31287b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uuixiwlllpcx\2659947f = 2b3e1ffe30f8c5f17895a8120e0f37cd45a750d1f9138d66f629efb712e3184f318694abe039c9bd0123431762d5cc708a6c5bade46e2029f967e739dcd5a1e8830f2b29c141cb736b52c350253606c50fa40d2e14e95e091e0159f4a3c575f0c4e1f13c017313af3728218006219d1f4e295de479d4f18f611f5a0ed0c96cc0547e9987aed4764bbdb8310915329fa48d5ab37bb40a836b329ddd809af96d61ebca0c7b7b5ac1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uuixiwlllpcx\2418b403 = 59828816768b06e656a5d809992a9ec8380287410fcd5468c2219ba63973b3f27d97e31d408db58d72f26e58df4cdbdf651bd531c702e5e7de31b474	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uuixiwlllpcx\9ca4d366 = 7c00d37b6c76fd1487e7bb4513b3368992aae929c25c18f168ee2640221f260b3608487b5bcd27c198a8c5f7a948828741f171992c17f4e47ad816048ae6a572a8f771dc2e2696	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uuixiwlllpcx\e1ac9cec = a26ec742e25eb55fa0dfbd4e957c71659ed0879fdee351bf55451c80a795f3f7ee3e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uuixiwlllpcx\9ee5f31a = 4a1d9f29921aa25b989140c00e1994e11ac07b9fe5615ba966819267a7860b1601	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uuixiwlllpcx	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uuixiwlllpcx\13c64431 = 4e6e753961a42d0e2957de	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uuixiwlllpcx\5910fb89 = def08afff1a2056801edaaca7614cf352abfa1fb1d9506c6894c48083a247bd76425b92dcbc9478654c23f4c87c9be957bcb3c4e4a43bcddd74fb811f2c9b366d5faf9b039d92843d44fd7d238379a2a89b05eb1d6d2dd942652223d304ed366546fbb35a84a9f9ff7a728d9c514	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid	Process
5072	rundll32.exe
5072	rundll32.exe
1780	regsvr32.exe
1780	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid	Process
5072	rundll32.exe
1780	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	Process	procid_target
PID 2252 wrote to memory of 5072	2252	rundll32.exe	82
PID 2252 wrote to memory of 5072	2252	rundll32.exe	82
PID 2252 wrote to memory of 5072	2252	rundll32.exe	82
PID 5072 wrote to memory of 4344	5072	rundll32.exe	92
PID 5072 wrote to memory of 4344	5072	rundll32.exe	92
PID 5072 wrote to memory of 4344	5072	rundll32.exe	92
PID 5072 wrote to memory of 4344	5072	rundll32.exe	92
PID 5072 wrote to memory of 4344	5072	rundll32.exe	92
PID 4344 wrote to memory of 4648	4344	explorer.exe	93
PID 4344 wrote to memory of 4648	4344	explorer.exe	93
PID 4344 wrote to memory of 4648	4344	explorer.exe	93
PID 924 wrote to memory of 1780	924	regsvr32.exe	101
PID 924 wrote to memory of 1780	924	regsvr32.exe	101
PID 924 wrote to memory of 1780	924	regsvr32.exe	101
PID 1780 wrote to memory of 4032	1780	regsvr32.exe	102
PID 1780 wrote to memory of 4032	1780	regsvr32.exe	102
PID 1780 wrote to memory of 4032	1780	regsvr32.exe	102
PID 1780 wrote to memory of 4032	1780	regsvr32.exe	102
PID 1780 wrote to memory of 4032	1780	regsvr32.exe	102
PID 4032 wrote to memory of 2828	4032	explorer.exe	103
PID 4032 wrote to memory of 2828	4032	explorer.exe	103
PID 4032 wrote to memory of 3260	4032	explorer.exe	105
PID 4032 wrote to memory of 3260	4032	explorer.exe	105

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn gdgpnrt /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll\"" /SC ONCE /Z /ST 13:11 /ET 13:23
      4⤵
      Creates scheduled task(s)
      PID:4648

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Huraohirlu" /d "0"
      4⤵
      Windows security bypass
      PID:2828
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Fqriyh" /d "0"
      4⤵
      Windows security bypass
      PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9be188ae25897326093bac560a28547f.dll

Filesize
572KB

MD5
9be188ae25897326093bac560a28547f

SHA1
f8c004df37c37864e7f48d7c44a651d96ce19a5a

SHA256
60dec66650791888553dddee48fdd6a894e977e117947ae3e71367e5d44f1fa2

SHA512
70134745bcbbc7f183a603d6d6f30499cf828d44560fb7b97eee693d9e998ea62d10ab5968fb3b9c76592616f4a913d0074b3cb5b93772b9e094a23ff40bfe9e

Download Submit
memory/1780-15-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1780-19-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1780-17-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1780-16-0x0000000001AD0000-0x0000000001B05000-memory.dmp

Filesize
212KB

Download
memory/4032-25-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Filesize
132KB

Download
memory/4032-23-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Filesize
132KB

Download
memory/4032-22-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Filesize
132KB

Download
memory/4032-21-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Filesize
132KB

Download
memory/4032-18-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Filesize
132KB

Download
memory/4344-11-0x0000000000D30000-0x0000000000D51000-memory.dmp

Filesize
132KB

Download
memory/4344-9-0x0000000000D30000-0x0000000000D51000-memory.dmp

Filesize
132KB

Download
memory/4344-8-0x0000000000D30000-0x0000000000D51000-memory.dmp

Filesize
132KB

Download
memory/4344-7-0x0000000000D30000-0x0000000000D51000-memory.dmp

Filesize
132KB

Download
memory/4344-3-0x0000000000D30000-0x0000000000D51000-memory.dmp

Filesize
132KB

Download
memory/5072-0-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/5072-4-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/5072-2-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/5072-1-0x0000000002810000-0x0000000002845000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads