qakbot | dbe3468fbf17c02a99b49ee5fca4837811e4bf8e2877374423c2d4512f060569

General

Target

fc77868aae55037dccd9e6734c0bda1f.dll
Size

820KB
MD5

fc77868aae55037dccd9e6734c0bda1f
SHA1

625c1d5de4fb7e5fae3440892e122685b004f88e
SHA256

dbe3468fbf17c02a99b49ee5fca4837811e4bf8e2877374423c2d4512f060569
SHA512

c494179fb0bd6cfc56e19795830c4ea1afdc1eda4c70ae0420c9e967a4d4c7425023efdb41d7e5bd8ac27b3ff0cb10e7212929d7d27794f2d0575316a9bea327
SSDEEP

24576:nO6c3oCrVA7bEK7mJaW2eX8TvE81gIzsk6EzCUfk7Ou:duVeEK7mmeX8TBgIzsk6hUf4h

Score

10^/10

qakbot obama112 1633682302 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama112

Campaign

1633682302

C2

98.157.235.126:443

124.123.42.115:2222

185.250.148.74:443

73.77.87.137:443

188.50.169.158:443

216.201.162.158:443

174.54.193.186:443

27.223.92.142:995

220.255.25.28:2222

103.142.10.177:443

2.222.167.138:443

66.177.215.152:0

122.11.220.212:2222

85.109.229.54:995

140.82.49.12:443

199.27.127.129:443

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

81.241.252.59:2078

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Gzgmm = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Olgniso = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid	Process
2372	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exe

pid	Process
1396	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jatnueruhbo\e1f17cd6 = 4cef298dac2d08ddd7c8c4db79c377c31f27db	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jatnueruhbo	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jatnueruhbo\9eb81320 = 3a0137d5b043439e2f634bf2395368ffc18e10223decd6273db921397756efe757d7592a7a822f0929a82afb0a935339c7f0603cad93dbb345e3fadff26ec7b57751ce5f483fdbf9a1650eff30b07e50db75aad15549abf264578562bf5e62b36ed5e30208b73a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jatnueruhbo\ab27c36e = 4b1f8e3ba2aad063c545da66b415c523890e73529315b84019f6b104f0a43fa7bac402d36091d491fb33fb6af06d48510cd9162d24583816e80131a539cd1ffd55b2eaba2d7dec0da009a3116e26c7583e893bd8c9fa0567dd142b668c18f0e4bc9b9bee4bceee6ef44557f8064ecc36a5e9b50a246a9591c4dac8d37d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jatnueruhbo\a966e312 = bff3e2f868ca6728e78f780be3c836f61c826b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jatnueruhbo\11da8477 = 9adce961062119e23ee6a8cd366c4fa823cc2ba5721543c6dcd5019ae2b8cb489a60bf943919c466eb4d86bcf0cbcb019b631779	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jatnueruhbo\6cd2cbfd = 08e4aa39c1197f67e4cad6954828a1220abf1a4ae555cb3ff46973874182b4cf4f3d9e4eab5ed53aef8f32ca75b775391f9247743ad67f9ab0d94d36eb3f8c2e5f67f3f8e64df87cf02b3d960a6e68863232dd1f33123fdb6c15f9007c049de0b6148c0bc3a8069b50d29d062374015dc3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jatnueruhbo\139ba40b = afe09c898ceb1877bf8dec672fd613edf207d6ecc9a83dde94a766e204bb75ac3b98010fcfe68f0ff93406cebc2af66701568059d92412f450d8afdea4ce80e189b4685a47c0d3b1edefc526f8e792f544a458fd8cbcc01e21	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jatnueruhbo\9eb81320 = 3a0120d5b043763401f9367c7f5395fe8ff59bb887c1def78a9ad4a89be27bbb729261959eb105100cf72128da226c2d0408c1751cfea4a771c8ec1bdc29120577a2e03611c9e7292afa155ae4a737953c4a4386e5d518c85430f038161b0242fd4e22a7b78b0af6ababa956a3f9a904b12d622d044cdeb42cdb895f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Jatnueruhbo\d46eac98 = 36ecdcabe162f30b62aa133eb8e4f3baad011e915a30cfd978cc3b4c3a89e3d5cc62983608bdf40c0352fd5e1705f2a7	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid	Process
3836	rundll32.exe
3836	rundll32.exe
2372	regsvr32.exe
2372	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid	Process
3836	rundll32.exe
2372	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	Process	procid_target
PID 3440 wrote to memory of 3836	3440	rundll32.exe	89
PID 3440 wrote to memory of 3836	3440	rundll32.exe	89
PID 3440 wrote to memory of 3836	3440	rundll32.exe	89
PID 3836 wrote to memory of 224	3836	rundll32.exe	93
PID 3836 wrote to memory of 224	3836	rundll32.exe	93
PID 3836 wrote to memory of 224	3836	rundll32.exe	93
PID 3836 wrote to memory of 224	3836	rundll32.exe	93
PID 3836 wrote to memory of 224	3836	rundll32.exe	93
PID 224 wrote to memory of 1396	224	explorer.exe	94
PID 224 wrote to memory of 1396	224	explorer.exe	94
PID 224 wrote to memory of 1396	224	explorer.exe	94
PID 2308 wrote to memory of 2372	2308	regsvr32.exe	100
PID 2308 wrote to memory of 2372	2308	regsvr32.exe	100
PID 2308 wrote to memory of 2372	2308	regsvr32.exe	100
PID 2372 wrote to memory of 4352	2372	regsvr32.exe	101
PID 2372 wrote to memory of 4352	2372	regsvr32.exe	101
PID 2372 wrote to memory of 4352	2372	regsvr32.exe	101
PID 2372 wrote to memory of 4352	2372	regsvr32.exe	101
PID 2372 wrote to memory of 4352	2372	regsvr32.exe	101
PID 4352 wrote to memory of 3444	4352	explorer.exe	102
PID 4352 wrote to memory of 3444	4352	explorer.exe	102
PID 4352 wrote to memory of 632	4352	explorer.exe	104
PID 4352 wrote to memory of 632	4352	explorer.exe	104

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc77868aae55037dccd9e6734c0bda1f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc77868aae55037dccd9e6734c0bda1f.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hygyzzeotd /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\fc77868aae55037dccd9e6734c0bda1f.dll\"" /SC ONCE /Z /ST 06:49 /ET 07:01
      4⤵
      Creates scheduled task(s)
      PID:1396

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\fc77868aae55037dccd9e6734c0bda1f.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\fc77868aae55037dccd9e6734c0bda1f.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Olgniso" /d "0"
      4⤵
      Windows security bypass
      PID:3444
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Gzgmm" /d "0"
      4⤵
      Windows security bypass
      PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fc77868aae55037dccd9e6734c0bda1f.dll

Filesize
820KB

MD5
fc77868aae55037dccd9e6734c0bda1f

SHA1
625c1d5de4fb7e5fae3440892e122685b004f88e

SHA256
dbe3468fbf17c02a99b49ee5fca4837811e4bf8e2877374423c2d4512f060569

SHA512
c494179fb0bd6cfc56e19795830c4ea1afdc1eda4c70ae0420c9e967a4d4c7425023efdb41d7e5bd8ac27b3ff0cb10e7212929d7d27794f2d0575316a9bea327

Download Submit
memory/224-14-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Filesize
132KB

Download
memory/224-11-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Filesize
132KB

Download
memory/224-12-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Filesize
132KB

Download
memory/224-6-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Filesize
132KB

Download
memory/224-10-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Filesize
132KB

Download
memory/2372-23-0x00000000750C0000-0x0000000075226000-memory.dmp

Filesize
1.4MB

Download
memory/2372-21-0x00000000013A0000-0x00000000013A1000-memory.dmp

Filesize
4KB

Download
memory/2372-19-0x00000000750C0000-0x0000000075226000-memory.dmp

Filesize
1.4MB

Download
memory/2372-18-0x00000000750C0000-0x0000000075226000-memory.dmp

Filesize
1.4MB

Download
memory/3836-7-0x0000000075150000-0x00000000752B6000-memory.dmp

Filesize
1.4MB

Download
memory/3836-2-0x0000000001150000-0x0000000001151000-memory.dmp

Filesize
4KB

Download
memory/3836-3-0x0000000075150000-0x00000000752B6000-memory.dmp

Filesize
1.4MB

Download
memory/3836-5-0x0000000075150000-0x00000000752B6000-memory.dmp

Filesize
1.4MB

Download
memory/3836-0-0x0000000075150000-0x00000000752B6000-memory.dmp

Filesize
1.4MB

Download
memory/3836-1-0x0000000075150000-0x00000000752B6000-memory.dmp

Filesize
1.4MB

Download
memory/4352-26-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Filesize
132KB

Download
memory/4352-29-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Filesize
132KB

Download
memory/4352-22-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Filesize
132KB

Download
memory/4352-25-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Filesize
132KB

Download
memory/4352-27-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads