qakbot | 7f5c0c7b1ee40f554e418c1a834258015fae2f54d754fe5ebbb64a6583a1ed7d

General

Target

ClosingTime.dll
Size

335KB
MD5

173d9eec22fb91ba78f2518b9a0c82ec
SHA1

0dc93e47a48faed932b1228455825ff72a767bde
SHA256

7f5c0c7b1ee40f554e418c1a834258015fae2f54d754fe5ebbb64a6583a1ed7d
SHA512

d0fecba418a15ffe93633b8410cdce3d7d3e8fd24a77cbdad2119361034547652d697d9fdf8b83fe10873be52a53051ebc724ef8443333439fd674fd430c3249

Score

10^/10

qakbot obama192 1655969261 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama192

Campaign

1655969261

C2

100.38.242.113:995

94.59.252.166:2222

74.14.5.179:2222

71.13.93.154:2222

193.253.44.249:2222

108.60.213.141:443

45.241.231.78:993

217.128.122.65:2222

40.134.246.185:995

1.161.124.241:443

70.46.220.114:443

24.43.99.75:443

32.221.224.140:995

80.11.74.81:2222

31.215.184.140:2222

39.49.85.29:995

67.209.195.198:443

186.90.153.162:2222

148.64.96.100:443

67.165.206.193:993

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2932 regsvr32.exe

pid	process
2932	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4688 schtasks.exe

pid	process
4688	schtasks.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mijeqzw\a019af9f = ed3389639caa86bfb510218ca7e79ae78b8985aced	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mijeqzw\df50c069 = a50e7b576f73e77d579ce59007dec9d4ee2c71eaaae40567df3b73d0f240e099804a40f29a5bd79c9feafb7434f2fb8de18ba62bbf68c1b67aae9fa8fbc4b748d0d7a6b0ebbc9fc80b2d8aebcbb4fc671ec3f90fdd0cba9adc80a4ed8c69e45d16d54b554080c9c31680fcc0cb84c1001442c74d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mijeqzw\2d3a18b4 = d8fa1c28ae1a7321afeb4ecc8cd02f8f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mijeqzw	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mijeqzw\df50c069 = a50e6c576f73d429c853c3c480571f91ae2887c2e5336e088d0d99e0c0649ec67dad6d0bb79707b46a43cd1bcc372a3fb037c5f66a602767d45b6fc34c8f714826d68b40deb11749509f966c5fd34090b87be3ea8566c5374e0b5d51d36321	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mijeqzw\e88e305b = 1168cbd156a794c68a9c62ef996f470bd14f8ab2893b6f1b613362e666a1295449220b2abb51ef69dfa4abefe1cfbaa1163e10d3ee3ea74e7d79242decb2318ee7e41c453317557d063b5a624857307f953f74cc09e31950734f70aa011a	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mijeqzw\5032573e = bda8d4033e74784060ed23fa77b7e287988fc19dfeed4d7d7392edf37a7f1cd8c3d5b49473b5308569c5df2e22b1091c2d20e3	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mijeqzw\eacf1027 = 5d3f63d4b4fd8034e6b8883f3443d42ebd23b2d6c5a503332abde178bef80f7e68ae8efe27e2aba9684fe6ee4b4837c2248831476f188a00823e6ed8527cb85fd833361a59c091e2a69fbae69f9bd390f9982914bbc1281f93256435e85c47526361487384c9698e77a61f1874c7637df33496a953168a9f228b74959fb92670a6dbda476665cabfd2131a6c9a45500cb622df93435c9667c849da7608ba8a74033405671a70cf54d105a309fb19d6277bd6843c0bb691d52d94c65445445e3811	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mijeqzw\95867fd1 = 22e3f82f8e3e418d6d277b5b27b34e1199a5ca6c9d032c3bda4efcc2ff75e6ef30950d2a10c65810201cbf1ae8c1439061bc15506316e1f4	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mijeqzw\52737742 = ea1f2bcbac2b291b6d8eecfdebec78f472d71210f16be5e4bf5d3d5ec6876edbf0bb9f59557ec2	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
2240	regsvr32.exe
2240	regsvr32.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe
4680	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2240 regsvr32.exe
2932 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4284 powershell.exe

description	pid	process
Token: SeDebugPrivilege	4284	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 3912 wrote to memory of 2240	3912	regsvr32.exe	regsvr32.exe
PID 3912 wrote to memory of 2240	3912	regsvr32.exe	regsvr32.exe
PID 3912 wrote to memory of 2240	3912	regsvr32.exe	regsvr32.exe
PID 2240 wrote to memory of 4680	2240	regsvr32.exe	explorer.exe
PID 2240 wrote to memory of 4680	2240	regsvr32.exe	explorer.exe
PID 2240 wrote to memory of 4680	2240	regsvr32.exe	explorer.exe
PID 2240 wrote to memory of 4680	2240	regsvr32.exe	explorer.exe
PID 2240 wrote to memory of 4680	2240	regsvr32.exe	explorer.exe
PID 4680 wrote to memory of 4688	4680	explorer.exe	schtasks.exe
PID 4680 wrote to memory of 4688	4680	explorer.exe	schtasks.exe
PID 4680 wrote to memory of 4688	4680	explorer.exe	schtasks.exe
PID 4284 wrote to memory of 1880	4284	powershell.exe	regsvr32.exe
PID 4284 wrote to memory of 1880	4284	powershell.exe	regsvr32.exe
PID 1880 wrote to memory of 2932	1880	regsvr32.exe	regsvr32.exe
PID 1880 wrote to memory of 2932	1880	regsvr32.exe	regsvr32.exe
PID 1880 wrote to memory of 2932	1880	regsvr32.exe	regsvr32.exe
PID 2932 wrote to memory of 3368	2932	regsvr32.exe	explorer.exe
PID 2932 wrote to memory of 3368	2932	regsvr32.exe	explorer.exe
PID 2932 wrote to memory of 3368	2932	regsvr32.exe	explorer.exe
PID 2932 wrote to memory of 3368	2932	regsvr32.exe	explorer.exe
PID 2932 wrote to memory of 3368	2932	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ClosingTime.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3912

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\ClosingTime.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4680

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 19:47 /tn dmnobfz /ET 19:58 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAQwBsAG8AcwBpAG4AZwBUAGkAbQBlAC4AZABsAGwAIgA=" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:4688

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAQwBsAG8AcwBpAG4AZwBUAGkAbQBlAC4AZABsAGwAIgA=
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\ClosingTime.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\ClosingTime.dll
3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2932

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
PID:3368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ClosingTime.dll
Filesize
335KB

MD5
173d9eec22fb91ba78f2518b9a0c82ec

SHA1
0dc93e47a48faed932b1228455825ff72a767bde

SHA256
7f5c0c7b1ee40f554e418c1a834258015fae2f54d754fe5ebbb64a6583a1ed7d

SHA512
d0fecba418a15ffe93633b8410cdce3d7d3e8fd24a77cbdad2119361034547652d697d9fdf8b83fe10873be52a53051ebc724ef8443333439fd674fd430c3249

Download Submit
C:\Users\Admin\AppData\Local\Temp\ClosingTime.dll
Filesize
335KB

MD5
173d9eec22fb91ba78f2518b9a0c82ec

SHA1
0dc93e47a48faed932b1228455825ff72a767bde

SHA256
7f5c0c7b1ee40f554e418c1a834258015fae2f54d754fe5ebbb64a6583a1ed7d

SHA512
d0fecba418a15ffe93633b8410cdce3d7d3e8fd24a77cbdad2119361034547652d697d9fdf8b83fe10873be52a53051ebc724ef8443333439fd674fd430c3249

Download Submit
memory/1880-138-0x0000000000000000-mapping.dmp

Download
memory/2240-130-0x0000000000000000-mapping.dmp

Download
memory/2240-131-0x00000000009F0000-0x0000000000A12000-memory.dmp

Filesize
136KB

Download
memory/2240-133-0x00000000009F0000-0x0000000000A12000-memory.dmp

Filesize
136KB

Download
memory/2932-145-0x0000000001500000-0x0000000001522000-memory.dmp

Filesize
136KB

Download
memory/2932-143-0x0000000001500000-0x0000000001522000-memory.dmp

Filesize
136KB

Download
memory/2932-140-0x0000000000000000-mapping.dmp

Download
memory/3368-147-0x0000000000730000-0x0000000000752000-memory.dmp

Filesize
136KB

Download
memory/3368-146-0x0000000000730000-0x0000000000752000-memory.dmp

Filesize
136KB

Download
memory/3368-144-0x0000000000000000-mapping.dmp

Download
memory/4284-142-0x00007FF8B6760000-0x00007FF8B7221000-memory.dmp

Filesize
10.8MB

Download
memory/4284-137-0x00000263AB1E0000-0x00000263AB202000-memory.dmp

Filesize
136KB

Download
memory/4680-136-0x0000000000B20000-0x0000000000B42000-memory.dmp

Filesize
136KB

Download
memory/4680-135-0x0000000000B20000-0x0000000000B42000-memory.dmp

Filesize
136KB

Download
memory/4680-132-0x0000000000000000-mapping.dmp

Download
memory/4688-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads