qakbot | cc210e4d7466f6a2b22dd37bd0a6b790e7fa307b85ab8c19b8b42ad1b2bb31c2

General

Target

e35cb2b971cc43d515eb1bf22cc6e981.dll
Size

573KB
MD5

e35cb2b971cc43d515eb1bf22cc6e981
SHA1

c5c81df36db5fac9b8866252f73791f553ae269b
SHA256

cc210e4d7466f6a2b22dd37bd0a6b790e7fa307b85ab8c19b8b42ad1b2bb31c2
SHA512

85af3ec67eb6d0538dfe6143555be972f7556a1d182193dd31402d395ec50205f8c3c44799189dcb27c0f5fc41385d8ef1889a493284e3669515ff734f1516dd
SSDEEP

12288:c87H3sH2k/e89A9tqKsuud0jl0pT7fEztxG9HBMbVNAfirS:cSs7/HYtqsE3MzO9HoHUs

Score

10^/10

qakbot obama107 1633078880 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama107

Campaign

1633078880

C2

140.82.49.12:443

41.250.143.109:995

216.201.162.158:443

86.8.177.143:443

105.198.236.99:443

124.123.42.115:2222

217.17.56.163:443

37.210.152.224:995

190.198.206.189:2222

75.89.195.186:995

78.191.44.76:995

122.11.220.212:2222

68.186.192.69:443

159.2.51.200:2222

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

120.151.47.189:443

47.22.148.6:443

94.200.181.154:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Hqeaeholsx = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Qpioodr = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1828 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

5028 schtasks.exe

pid	process
1828	regsvr32.exe

pid	process
5028	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hehwpdn\31357b65 = 270ac7505bd4ffaf7ac01b17d51b5262d0f461acc5189f41da6b5d7fce42f1e0ad2a7849dbc546a340a2985f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hehwpdn\be57ec32 = 02a83297fa2f4ffe41b9d262469f5c06685f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hehwpdn\7be3c4dd = 9c1d5717f05b358cf3271ff6c2567ee9214c08c384e5d2b839111c523a430663b3a930e54a0fa3848973c3af754686dea4f1e5d2dca097d9129d244659091b2baa8cbbdfb4f9575bf12fb4bd4a9b1dfc3cc5348f942b5c6395fc8e9eebd4483887efffc563455e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hehwpdn\bc16cc4e = ab70a2267b2267fe857ccf59a90cd5470231ae53fdd19dba2149f5ff1dda9531767c569a8d7604daf04032a4c6947da6adbca7d3664582a2d3ed13f9f32af8a6eeb3eecb6c170319d823f0305a22f849fea1efc1fab1745488fd29	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hehwpdn	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hehwpdn\4aaab2b = 3e740a6e5390992c0726568ab337cc315fc028d13b283cde3fa2e19682653076d6b2da5586787896116f32ca26adc33d5b5e0c7e5b0f996cefa0332193e0a4922465324450a6459c3a56e17546f04c59df05701de79107b3fdbe60772c182fc286a30adcea28a482a6d744718d8fe297e68e410af705797e5ca57b8b05c1754b514fb9f7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hehwpdn\6eb8b57 = ea1ace4f2de7f595e27f22d123f98a0e33b7b13a1ac1961903a79b7df310549102abc230ee0ca0b0d96dc5babce8ecb499bab39834d7212ebc9a2746ce0026aec19b95fb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hehwpdn\c35fa3b8 = 0eb1aac1df0f8ff09e53fdf67d7057554bf7f755784597f9690db2908cf3a6624278407b1f1d50e73bff471bbc94e0bc3be4c64566b83cd71a7f2cb35c5dc0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hehwpdn\4e7c1493 = 9daddcb2b6023f23d7ba1570d3950b1264	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hehwpdn\31357b65 = 270ad0505bd4ca8c2bd998ec4b278cd113b8f37af250be58e4e7bb1f1fac3c1246e7ccee9e7ef1dd3e564fb35b81c0b444dd6844d4ac8a377cd27af26c749e6120	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2992 rundll32.exe
2992 rundll32.exe
1828 regsvr32.exe
1828 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2992 rundll32.exe
1828 regsvr32.exe

pid	process
2992	rundll32.exe
2992	rundll32.exe
1828	regsvr32.exe
1828	regsvr32.exe

pid	process
2992	rundll32.exe
1828	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 4416 wrote to memory of 2992	4416	rundll32.exe	rundll32.exe
PID 4416 wrote to memory of 2992	4416	rundll32.exe	rundll32.exe
PID 4416 wrote to memory of 2992	4416	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 3532	2992	rundll32.exe	explorer.exe
PID 2992 wrote to memory of 3532	2992	rundll32.exe	explorer.exe
PID 2992 wrote to memory of 3532	2992	rundll32.exe	explorer.exe
PID 2992 wrote to memory of 3532	2992	rundll32.exe	explorer.exe
PID 2992 wrote to memory of 3532	2992	rundll32.exe	explorer.exe
PID 3532 wrote to memory of 5028	3532	explorer.exe	schtasks.exe
PID 3532 wrote to memory of 5028	3532	explorer.exe	schtasks.exe
PID 3532 wrote to memory of 5028	3532	explorer.exe	schtasks.exe
PID 4596 wrote to memory of 1828	4596	regsvr32.exe	regsvr32.exe
PID 4596 wrote to memory of 1828	4596	regsvr32.exe	regsvr32.exe
PID 4596 wrote to memory of 1828	4596	regsvr32.exe	regsvr32.exe
PID 1828 wrote to memory of 1920	1828	regsvr32.exe	explorer.exe
PID 1828 wrote to memory of 1920	1828	regsvr32.exe	explorer.exe
PID 1828 wrote to memory of 1920	1828	regsvr32.exe	explorer.exe
PID 1828 wrote to memory of 1920	1828	regsvr32.exe	explorer.exe
PID 1828 wrote to memory of 1920	1828	regsvr32.exe	explorer.exe
PID 1920 wrote to memory of 3004	1920	explorer.exe	reg.exe
PID 1920 wrote to memory of 3004	1920	explorer.exe	reg.exe
PID 1920 wrote to memory of 2944	1920	explorer.exe	reg.exe
PID 1920 wrote to memory of 2944	1920	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e35cb2b971cc43d515eb1bf22cc6e981.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4416

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e35cb2b971cc43d515eb1bf22cc6e981.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3532

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ddltubw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\e35cb2b971cc43d515eb1bf22cc6e981.dll\"" /SC ONCE /Z /ST 10:03 /ET 10:15
4⤵
- Creates scheduled task(s)
PID:5028

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\e35cb2b971cc43d515eb1bf22cc6e981.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4596

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\e35cb2b971cc43d515eb1bf22cc6e981.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Qpioodr" /d "0"
4⤵
- Windows security bypass
PID:3004

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Hqeaeholsx" /d "0"
4⤵
- Windows security bypass
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e35cb2b971cc43d515eb1bf22cc6e981.dll
Filesize
573KB

MD5
e35cb2b971cc43d515eb1bf22cc6e981

SHA1
c5c81df36db5fac9b8866252f73791f553ae269b

SHA256
cc210e4d7466f6a2b22dd37bd0a6b790e7fa307b85ab8c19b8b42ad1b2bb31c2

SHA512
85af3ec67eb6d0538dfe6143555be972f7556a1d182193dd31402d395ec50205f8c3c44799189dcb27c0f5fc41385d8ef1889a493284e3669515ff734f1516dd

Download Submit
memory/1828-22-0x0000000074B00000-0x0000000074BA0000-memory.dmp

Filesize
640KB

Download
memory/1828-19-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Filesize
4KB

Download
memory/1828-18-0x0000000074B00000-0x0000000074BA0000-memory.dmp

Filesize
640KB

Download
memory/1828-16-0x0000000074B00000-0x0000000074BA0000-memory.dmp

Filesize
640KB

Download
memory/1920-26-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Filesize
132KB

Download
memory/1920-25-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Filesize
132KB

Download
memory/1920-24-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Filesize
132KB

Download
memory/1920-21-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Filesize
132KB

Download
memory/2992-5-0x0000000074B90000-0x0000000074C30000-memory.dmp

Filesize
640KB

Download
memory/2992-0-0x0000000074B90000-0x0000000074C30000-memory.dmp

Filesize
640KB

Download
memory/2992-3-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/2992-1-0x0000000074B90000-0x0000000074C30000-memory.dmp

Filesize
640KB

Download
memory/3532-12-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Filesize
132KB

Download
memory/3532-10-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Filesize
132KB

Download
memory/3532-9-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Filesize
132KB

Download
memory/3532-8-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Filesize
132KB

Download
memory/3532-4-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads