qakbot | e66df705fb259e10b0cd6fda69e5f15d0ec4989895963bc927f3da1f1723479d

General

Target

ef1c6bd0302a5d478943061929855893.dll
Size

573KB
MD5

ef1c6bd0302a5d478943061929855893
SHA1

5142d65fd5a9d948585c3ea20440619a117cee44
SHA256

e66df705fb259e10b0cd6fda69e5f15d0ec4989895963bc927f3da1f1723479d
SHA512

20c5d739413fd968b66e95b34bc735b0b66a6517e2c08727be592ae828cd4278c1273b5c2cbe279d87cc7224668430fa0c6ea7ee17ad2b44f53dbc0ba263e50a
SSDEEP

12288:387H3sH2k/e89A9tqKsuud0Hl0pT7fEztxG9HBMbVNA/irS:3Ss7/3YtqoE3MzO9HoHMs

Score

10^/10

qakbot obama107 1633078880 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama107

Campaign

1633078880

C2

140.82.49.12:443

41.250.143.109:995

216.201.162.158:443

86.8.177.143:443

105.198.236.99:443

124.123.42.115:2222

217.17.56.163:443

37.210.152.224:995

190.198.206.189:2222

75.89.195.186:995

78.191.44.76:995

122.11.220.212:2222

68.186.192.69:443

159.2.51.200:2222

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

120.151.47.189:443

47.22.148.6:443

94.200.181.154:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Kjutqbffcckm = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Jusxblzqeea = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1468 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2872 schtasks.exe

pid	process
1468	regsvr32.exe

pid	process
2872	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\56c6b7ed = fa1130354cfc475db135c77b7a7bcc5885f5004c2fc7e1331994537d250f8a2ed584e9802d8a22d0ec1056df	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\a4ac6f30 = 4a17e7856dc69727c5b11380675c25099ec3ac996411bb40677360790f0f21d46c06d8f8dd38f9dbe5837732a961c8fdfcbea355841c410d0dc452f05aeb147370158677c4815bb74776f39c79d75808598363193bdd4eff53ccf1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\dbe500c6 = 111af143a942be0d87e369d03a79e1162cb4ca610c29c1f2159180f49369a3a7a29e4f6f8fff44066e021e0a54255b62159eaf3b589ae3ac7e05d296b0e5d00f693334462b228d3e2c20ba08953201893c9972646e58e1d9b2084893c9b93b617570	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\635967a3 = 52a63b1383e8dda0714f5adaa846e3c7a6fcb911c2e57c05ad4a1ae0bd1880aae67dd8706dc5f8c3e1f9fe1a64a6483cc1e974e370e9643e8596d441bcd790a64597d4ad82a856f2266f3cacfea3d5777cba0e93826eab2c584ece3b264bd958d08c09133a75e0137f317b12942c3c17452125f27bf87c5e50ab35c9313d472aef9620e81facc122796c6bef67078add05ce121a01dde6f6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\611847df = d172ed9798e47a5176a5a1abbee85a8441b0b1a72c593e6e170fa0a071ebf639ab2c5f1c72c3104d7a812bef	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\d9a420ba = bd11846279e63c61abb5ebe327aa02316b128aebceb26784fc5e2cdf2a7ecec38260eb82aaf2199a2796d20de031e061a654919c95ef91ffb725113223481a40d6aebcd79db207	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\1c100855 = 4e40c8c30f16172ee5b388c5aa2d958a56ad	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\298fd81b = d13bf4dd63cacfd1897202a6b11c66df9411b8f6e2e61d36ed093391b51fd790	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\56c6b7ed = fa1127354cfc72ddc0390114b861252ca538f484096d5ea350f75a986b8bcbe35bad55b24a4d96df63b444d5c0b575b4db68f8b559582afc99e206a462090bc801	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2704 rundll32.exe
1468 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2704 rundll32.exe
1468 regsvr32.exe

pid	process
2704	rundll32.exe
1468	regsvr32.exe

pid	process
2704	rundll32.exe
1468	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2840 wrote to memory of 2704	2840	rundll32.exe	rundll32.exe
PID 2840 wrote to memory of 2704	2840	rundll32.exe	rundll32.exe
PID 2840 wrote to memory of 2704	2840	rundll32.exe	rundll32.exe
PID 2840 wrote to memory of 2704	2840	rundll32.exe	rundll32.exe
PID 2840 wrote to memory of 2704	2840	rundll32.exe	rundll32.exe
PID 2840 wrote to memory of 2704	2840	rundll32.exe	rundll32.exe
PID 2840 wrote to memory of 2704	2840	rundll32.exe	rundll32.exe
PID 2704 wrote to memory of 2644	2704	rundll32.exe	explorer.exe
PID 2704 wrote to memory of 2644	2704	rundll32.exe	explorer.exe
PID 2704 wrote to memory of 2644	2704	rundll32.exe	explorer.exe
PID 2704 wrote to memory of 2644	2704	rundll32.exe	explorer.exe
PID 2704 wrote to memory of 2644	2704	rundll32.exe	explorer.exe
PID 2704 wrote to memory of 2644	2704	rundll32.exe	explorer.exe
PID 2644 wrote to memory of 2872	2644	explorer.exe	schtasks.exe
PID 2644 wrote to memory of 2872	2644	explorer.exe	schtasks.exe
PID 2644 wrote to memory of 2872	2644	explorer.exe	schtasks.exe
PID 2644 wrote to memory of 2872	2644	explorer.exe	schtasks.exe
PID 2776 wrote to memory of 1476	2776	taskeng.exe	regsvr32.exe
PID 2776 wrote to memory of 1476	2776	taskeng.exe	regsvr32.exe
PID 2776 wrote to memory of 1476	2776	taskeng.exe	regsvr32.exe
PID 2776 wrote to memory of 1476	2776	taskeng.exe	regsvr32.exe
PID 2776 wrote to memory of 1476	2776	taskeng.exe	regsvr32.exe
PID 1476 wrote to memory of 1468	1476	regsvr32.exe	regsvr32.exe
PID 1476 wrote to memory of 1468	1476	regsvr32.exe	regsvr32.exe
PID 1476 wrote to memory of 1468	1476	regsvr32.exe	regsvr32.exe
PID 1476 wrote to memory of 1468	1476	regsvr32.exe	regsvr32.exe
PID 1476 wrote to memory of 1468	1476	regsvr32.exe	regsvr32.exe
PID 1476 wrote to memory of 1468	1476	regsvr32.exe	regsvr32.exe
PID 1476 wrote to memory of 1468	1476	regsvr32.exe	regsvr32.exe
PID 1468 wrote to memory of 2404	1468	regsvr32.exe	explorer.exe
PID 1468 wrote to memory of 2404	1468	regsvr32.exe	explorer.exe
PID 1468 wrote to memory of 2404	1468	regsvr32.exe	explorer.exe
PID 1468 wrote to memory of 2404	1468	regsvr32.exe	explorer.exe
PID 1468 wrote to memory of 2404	1468	regsvr32.exe	explorer.exe
PID 1468 wrote to memory of 2404	1468	regsvr32.exe	explorer.exe
PID 2404 wrote to memory of 2064	2404	explorer.exe	reg.exe
PID 2404 wrote to memory of 2064	2404	explorer.exe	reg.exe
PID 2404 wrote to memory of 2064	2404	explorer.exe	reg.exe
PID 2404 wrote to memory of 2064	2404	explorer.exe	reg.exe
PID 2404 wrote to memory of 3036	2404	explorer.exe	reg.exe
PID 2404 wrote to memory of 3036	2404	explorer.exe	reg.exe
PID 2404 wrote to memory of 3036	2404	explorer.exe	reg.exe
PID 2404 wrote to memory of 3036	2404	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef1c6bd0302a5d478943061929855893.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef1c6bd0302a5d478943061929855893.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2704

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2644

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xgvvuzsou /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\ef1c6bd0302a5d478943061929855893.dll\"" /SC ONCE /Z /ST 15:02 /ET 15:14
4⤵
- Creates scheduled task(s)
PID:2872

C:\Windows\system32\taskeng.exe
taskeng.exe {FAAF7FA6-4272-4C23-AE85-B9DE28370AC7} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2776

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\ef1c6bd0302a5d478943061929855893.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\ef1c6bd0302a5d478943061929855893.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2404

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Kjutqbffcckm" /d "0"
5⤵
- Windows security bypass
PID:2064

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Jusxblzqeea" /d "0"
5⤵
- Windows security bypass
PID:3036

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ef1c6bd0302a5d478943061929855893.dll
Filesize
573KB

MD5
ef1c6bd0302a5d478943061929855893

SHA1
5142d65fd5a9d948585c3ea20440619a117cee44

SHA256
e66df705fb259e10b0cd6fda69e5f15d0ec4989895963bc927f3da1f1723479d

SHA512
20c5d739413fd968b66e95b34bc735b0b66a6517e2c08727be592ae828cd4278c1273b5c2cbe279d87cc7224668430fa0c6ea7ee17ad2b44f53dbc0ba263e50a

Download Submit
memory/1468-24-0x00000000750A0000-0x0000000075140000-memory.dmp

Filesize
640KB

Download
memory/1468-19-0x00000000750A0000-0x0000000075140000-memory.dmp

Filesize
640KB

Download
memory/1468-18-0x00000000750A0000-0x0000000075140000-memory.dmp

Filesize
640KB

Download
memory/2404-30-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2404-28-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2404-27-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2404-26-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2404-23-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2644-5-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2644-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2644-10-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2644-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2644-9-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2644-4-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2704-6-0x00000000750A0000-0x0000000075140000-memory.dmp

Filesize
640KB

Download
memory/2704-0-0x00000000750A0000-0x0000000075140000-memory.dmp

Filesize
640KB

Download
memory/2704-1-0x00000000750A0000-0x0000000075140000-memory.dmp

Filesize
640KB

Download
memory/2704-2-0x00000000750A0000-0x0000000075140000-memory.dmp

Filesize
640KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads