qakbot | e66df705fb259e10b0cd6fda69e5f15d0ec4989895963bc927f3da1f1723479d

Analysis

max time kernel
185s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-12-2023 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef1c6bd0302a5d478943061929855893.dll
Size

573KB
MD5

ef1c6bd0302a5d478943061929855893
SHA1

5142d65fd5a9d948585c3ea20440619a117cee44
SHA256

e66df705fb259e10b0cd6fda69e5f15d0ec4989895963bc927f3da1f1723479d
SHA512

20c5d739413fd968b66e95b34bc735b0b66a6517e2c08727be592ae828cd4278c1273b5c2cbe279d87cc7224668430fa0c6ea7ee17ad2b44f53dbc0ba263e50a
SSDEEP

12288:387H3sH2k/e89A9tqKsuud0Hl0pT7fEztxG9HBMbVNA/irS:3Ss7/3YtqoE3MzO9HoHMs

Score

10^/10

qakbot obama107 1633078880 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama107

Campaign

1633078880

140.82.49.12:443

41.250.143.109:995

216.201.162.158:443

86.8.177.143:443

105.198.236.99:443

124.123.42.115:2222

217.17.56.163:443

37.210.152.224:995

190.198.206.189:2222

75.89.195.186:995

78.191.44.76:995

122.11.220.212:2222

68.186.192.69:443

159.2.51.200:2222

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

120.151.47.189:443

47.22.148.6:443

94.200.181.154:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Kjutqbffcckm = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Jusxblzqeea = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid	Process
1468	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exe

pid	Process
2872	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\56c6b7ed = fa1130354cfc475db135c77b7a7bcc5885f5004c2fc7e1331994537d250f8a2ed584e9802d8a22d0ec1056df	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\a4ac6f30 = 4a17e7856dc69727c5b11380675c25099ec3ac996411bb40677360790f0f21d46c06d8f8dd38f9dbe5837732a961c8fdfcbea355841c410d0dc452f05aeb147370158677c4815bb74776f39c79d75808598363193bdd4eff53ccf1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\dbe500c6 = 111af143a942be0d87e369d03a79e1162cb4ca610c29c1f2159180f49369a3a7a29e4f6f8fff44066e021e0a54255b62159eaf3b589ae3ac7e05d296b0e5d00f693334462b228d3e2c20ba08953201893c9972646e58e1d9b2084893c9b93b617570	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\635967a3 = 52a63b1383e8dda0714f5adaa846e3c7a6fcb911c2e57c05ad4a1ae0bd1880aae67dd8706dc5f8c3e1f9fe1a64a6483cc1e974e370e9643e8596d441bcd790a64597d4ad82a856f2266f3cacfea3d5777cba0e93826eab2c584ece3b264bd958d08c09133a75e0137f317b12942c3c17452125f27bf87c5e50ab35c9313d472aef9620e81facc122796c6bef67078add05ce121a01dde6f6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\611847df = d172ed9798e47a5176a5a1abbee85a8441b0b1a72c593e6e170fa0a071ebf639ab2c5f1c72c3104d7a812bef	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\d9a420ba = bd11846279e63c61abb5ebe327aa02316b128aebceb26784fc5e2cdf2a7ecec38260eb82aaf2199a2796d20de031e061a654919c95ef91ffb725113223481a40d6aebcd79db207	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\1c100855 = 4e40c8c30f16172ee5b388c5aa2d958a56ad	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\298fd81b = d13bf4dd63cacfd1897202a6b11c66df9411b8f6e2e61d36ed093391b51fd790	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zsveoyszhbvx\56c6b7ed = fa1127354cfc72ddc0390114b861252ca538f484096d5ea350f75a986b8bcbe35bad55b24a4d96df63b444d5c0b575b4db68f8b559582afc99e206a462090bc801	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid	Process
2704	rundll32.exe
1468	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid	Process
2704	rundll32.exe
1468	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	Process	procid_target
PID 2840 wrote to memory of 2704	2840	rundll32.exe	27
PID 2840 wrote to memory of 2704	2840	rundll32.exe	27
PID 2840 wrote to memory of 2704	2840	rundll32.exe	27
PID 2840 wrote to memory of 2704	2840	rundll32.exe	27
PID 2840 wrote to memory of 2704	2840	rundll32.exe	27
PID 2840 wrote to memory of 2704	2840	rundll32.exe	27
PID 2840 wrote to memory of 2704	2840	rundll32.exe	27
PID 2704 wrote to memory of 2644	2704	rundll32.exe	30
PID 2704 wrote to memory of 2644	2704	rundll32.exe	30
PID 2704 wrote to memory of 2644	2704	rundll32.exe	30
PID 2704 wrote to memory of 2644	2704	rundll32.exe	30
PID 2704 wrote to memory of 2644	2704	rundll32.exe	30
PID 2704 wrote to memory of 2644	2704	rundll32.exe	30
PID 2644 wrote to memory of 2872	2644	explorer.exe	31
PID 2644 wrote to memory of 2872	2644	explorer.exe	31
PID 2644 wrote to memory of 2872	2644	explorer.exe	31
PID 2644 wrote to memory of 2872	2644	explorer.exe	31
PID 2776 wrote to memory of 1476	2776	taskeng.exe	34
PID 2776 wrote to memory of 1476	2776	taskeng.exe	34
PID 2776 wrote to memory of 1476	2776	taskeng.exe	34
PID 2776 wrote to memory of 1476	2776	taskeng.exe	34
PID 2776 wrote to memory of 1476	2776	taskeng.exe	34
PID 1476 wrote to memory of 1468	1476	regsvr32.exe	35
PID 1476 wrote to memory of 1468	1476	regsvr32.exe	35
PID 1476 wrote to memory of 1468	1476	regsvr32.exe	35
PID 1476 wrote to memory of 1468	1476	regsvr32.exe	35
PID 1476 wrote to memory of 1468	1476	regsvr32.exe	35
PID 1476 wrote to memory of 1468	1476	regsvr32.exe	35
PID 1476 wrote to memory of 1468	1476	regsvr32.exe	35
PID 1468 wrote to memory of 2404	1468	regsvr32.exe	36
PID 1468 wrote to memory of 2404	1468	regsvr32.exe	36
PID 1468 wrote to memory of 2404	1468	regsvr32.exe	36
PID 1468 wrote to memory of 2404	1468	regsvr32.exe	36
PID 1468 wrote to memory of 2404	1468	regsvr32.exe	36
PID 1468 wrote to memory of 2404	1468	regsvr32.exe	36
PID 2404 wrote to memory of 2064	2404	explorer.exe	37
PID 2404 wrote to memory of 2064	2404	explorer.exe	37
PID 2404 wrote to memory of 2064	2404	explorer.exe	37
PID 2404 wrote to memory of 2064	2404	explorer.exe	37
PID 2404 wrote to memory of 3036	2404	explorer.exe	39
PID 2404 wrote to memory of 3036	2404	explorer.exe	39
PID 2404 wrote to memory of 3036	2404	explorer.exe	39
PID 2404 wrote to memory of 3036	2404	explorer.exe	39

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef1c6bd0302a5d478943061929855893.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef1c6bd0302a5d478943061929855893.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xgvvuzsou /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\ef1c6bd0302a5d478943061929855893.dll\"" /SC ONCE /Z /ST 15:02 /ET 15:14
      4⤵
      Creates scheduled task(s)
      PID:2872

C:\Windows\system32\taskeng.exe
taskeng.exe {FAAF7FA6-4272-4C23-AE85-B9DE28370AC7} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\ef1c6bd0302a5d478943061929855893.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\ef1c6bd0302a5d478943061929855893.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2404
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Kjutqbffcckm" /d "0"
        5⤵
        Windows security bypass
        
        PID:2064
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Jusxblzqeea" /d "0"
        5⤵
        Windows security bypass
        
        PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ef1c6bd0302a5d478943061929855893.dll

Filesize
573KB

MD5
ef1c6bd0302a5d478943061929855893

SHA1
5142d65fd5a9d948585c3ea20440619a117cee44

SHA256
e66df705fb259e10b0cd6fda69e5f15d0ec4989895963bc927f3da1f1723479d

SHA512
20c5d739413fd968b66e95b34bc735b0b66a6517e2c08727be592ae828cd4278c1273b5c2cbe279d87cc7224668430fa0c6ea7ee17ad2b44f53dbc0ba263e50a

Download Submit
memory/1468-24-0x00000000750A0000-0x0000000075140000-memory.dmp

Filesize
640KB

Download
memory/1468-19-0x00000000750A0000-0x0000000075140000-memory.dmp

Filesize
640KB

Download
memory/1468-18-0x00000000750A0000-0x0000000075140000-memory.dmp

Filesize
640KB

Download
memory/2404-30-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2404-28-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2404-27-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2404-26-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2404-23-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2644-5-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2644-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2644-10-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2644-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2644-9-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2644-4-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2704-6-0x00000000750A0000-0x0000000075140000-memory.dmp

Filesize
640KB

Download
memory/2704-0-0x00000000750A0000-0x0000000075140000-memory.dmp

Filesize
640KB

Download
memory/2704-1-0x00000000750A0000-0x0000000075140000-memory.dmp

Filesize
640KB

Download
memory/2704-2-0x00000000750A0000-0x0000000075140000-memory.dmp

Filesize
640KB

Download