qakbot | 2f478b6d30f061323a35c4341799cd770feb8c588a7dad43f0ddfc311d34675a

General

Target

youUp.dll
Size

335KB
MD5

124a1ecde0dc1b0fa212b2f5b1ac5943
SHA1

961063415b239e9fc6e2c88a0252ef22e4cd2b8c
SHA256

2f478b6d30f061323a35c4341799cd770feb8c588a7dad43f0ddfc311d34675a
SHA512

01d8348183b4b7d673698cb8536a695801dfde4860810a68001708280f79171713f5e81703b6d2d9f892e42cbdb2930cb41cac380ebe1a5d041dd96dcf32f527

Score

10^/10

qakbot obama192 1655969261 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama192

Campaign

1655969261

C2

100.38.242.113:995

94.59.252.166:2222

74.14.5.179:2222

71.13.93.154:2222

193.253.44.249:2222

108.60.213.141:443

45.241.231.78:993

217.128.122.65:2222

40.134.246.185:995

1.161.124.241:443

70.46.220.114:443

24.43.99.75:443

32.221.224.140:995

80.11.74.81:2222

31.215.184.140:2222

39.49.85.29:995

67.209.195.198:443

186.90.153.162:2222

148.64.96.100:443

67.165.206.193:993

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2008 regsvr32.exe

pid	process
2008	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1116 schtasks.exe

pid	process
1116	schtasks.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

powershell.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = f0830f2c1688d801	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exepowershell.exeregsvr32.exe

pid	process
1796	regsvr32.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1716	powershell.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
2008	regsvr32.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe
1808	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1796 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1716 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1716	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 1852 wrote to memory of 1796	1852	regsvr32.exe	regsvr32.exe
PID 1852 wrote to memory of 1796	1852	regsvr32.exe	regsvr32.exe
PID 1852 wrote to memory of 1796	1852	regsvr32.exe	regsvr32.exe
PID 1852 wrote to memory of 1796	1852	regsvr32.exe	regsvr32.exe
PID 1852 wrote to memory of 1796	1852	regsvr32.exe	regsvr32.exe
PID 1852 wrote to memory of 1796	1852	regsvr32.exe	regsvr32.exe
PID 1852 wrote to memory of 1796	1852	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1808	1796	regsvr32.exe	explorer.exe
PID 1796 wrote to memory of 1808	1796	regsvr32.exe	explorer.exe
PID 1796 wrote to memory of 1808	1796	regsvr32.exe	explorer.exe
PID 1796 wrote to memory of 1808	1796	regsvr32.exe	explorer.exe
PID 1796 wrote to memory of 1808	1796	regsvr32.exe	explorer.exe
PID 1796 wrote to memory of 1808	1796	regsvr32.exe	explorer.exe
PID 1808 wrote to memory of 1116	1808	explorer.exe	schtasks.exe
PID 1808 wrote to memory of 1116	1808	explorer.exe	schtasks.exe
PID 1808 wrote to memory of 1116	1808	explorer.exe	schtasks.exe
PID 1808 wrote to memory of 1116	1808	explorer.exe	schtasks.exe
PID 528 wrote to memory of 1716	528	taskeng.exe	powershell.exe
PID 528 wrote to memory of 1716	528	taskeng.exe	powershell.exe
PID 528 wrote to memory of 1716	528	taskeng.exe	powershell.exe
PID 1716 wrote to memory of 1884	1716	powershell.exe	regsvr32.exe
PID 1716 wrote to memory of 1884	1716	powershell.exe	regsvr32.exe
PID 1716 wrote to memory of 1884	1716	powershell.exe	regsvr32.exe
PID 1716 wrote to memory of 1884	1716	powershell.exe	regsvr32.exe
PID 1716 wrote to memory of 1884	1716	powershell.exe	regsvr32.exe
PID 1884 wrote to memory of 2008	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 2008	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 2008	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 2008	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 2008	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 2008	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 2008	1884	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\youUp.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\youUp.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 22:03 /tn utatnmzl /ET 22:14 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAeQBvAHUAVQBwAC4AZABsAGwAIgA=" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:1116

C:\Windows\system32\taskeng.exe
taskeng.exe {9ACA440A-1C52-4F76-9509-CAEF240CDA57} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAeQBvAHUAVQBwAC4AZABsAGwAIgA=
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\youUp.dll
3⤵
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\youUp.dll
4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2008

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\youUp.dll
Filesize
335KB

MD5
124a1ecde0dc1b0fa212b2f5b1ac5943

SHA1
961063415b239e9fc6e2c88a0252ef22e4cd2b8c

SHA256
2f478b6d30f061323a35c4341799cd770feb8c588a7dad43f0ddfc311d34675a

SHA512
01d8348183b4b7d673698cb8536a695801dfde4860810a68001708280f79171713f5e81703b6d2d9f892e42cbdb2930cb41cac380ebe1a5d041dd96dcf32f527

Download Submit
\Users\Admin\AppData\Local\Temp\youUp.dll
Filesize
335KB

MD5
124a1ecde0dc1b0fa212b2f5b1ac5943

SHA1
961063415b239e9fc6e2c88a0252ef22e4cd2b8c

SHA256
2f478b6d30f061323a35c4341799cd770feb8c588a7dad43f0ddfc311d34675a

SHA512
01d8348183b4b7d673698cb8536a695801dfde4860810a68001708280f79171713f5e81703b6d2d9f892e42cbdb2930cb41cac380ebe1a5d041dd96dcf32f527

Download Submit
memory/1116-65-0x0000000000000000-mapping.dmp

Download
memory/1716-77-0x000000000123B000-0x000000000125A000-memory.dmp

Filesize
124KB

Download
memory/1716-70-0x000007FEF2BC0000-0x000007FEF371D000-memory.dmp

Filesize
11.4MB

Download
memory/1716-75-0x0000000001234000-0x0000000001237000-memory.dmp

Filesize
12KB

Download
memory/1716-67-0x0000000000000000-mapping.dmp

Download
memory/1716-69-0x000007FEF3720000-0x000007FEF4143000-memory.dmp

Filesize
10.1MB

Download
memory/1716-71-0x0000000001234000-0x0000000001237000-memory.dmp

Filesize
12KB

Download
memory/1796-59-0x00000000001F0000-0x0000000000212000-memory.dmp

Filesize
136KB

Download
memory/1796-57-0x00000000001F0000-0x0000000000212000-memory.dmp

Filesize
136KB

Download
memory/1796-63-0x00000000001F0000-0x0000000000212000-memory.dmp

Filesize
136KB

Download
memory/1796-56-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/1796-55-0x0000000000000000-mapping.dmp

Download
memory/1808-60-0x0000000000000000-mapping.dmp

Download
memory/1808-66-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1808-64-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1808-62-0x0000000074451000-0x0000000074453000-memory.dmp

Filesize
8KB

Download
memory/1852-54-0x000007FEFBAA1000-0x000007FEFBAA3000-memory.dmp

Filesize
8KB

Download
memory/1884-72-0x0000000000000000-mapping.dmp

Download
memory/2008-76-0x0000000000000000-mapping.dmp

Download
memory/2008-80-0x00000000009D0000-0x00000000009F2000-memory.dmp

Filesize
136KB

Download
memory/2008-82-0x00000000009D0000-0x00000000009F2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads