qakbot | 2f478b6d30f061323a35c4341799cd770feb8c588a7dad43f0ddfc311d34675a

General

Target

youUp.dll
Size

335KB
MD5

124a1ecde0dc1b0fa212b2f5b1ac5943
SHA1

961063415b239e9fc6e2c88a0252ef22e4cd2b8c
SHA256

2f478b6d30f061323a35c4341799cd770feb8c588a7dad43f0ddfc311d34675a
SHA512

01d8348183b4b7d673698cb8536a695801dfde4860810a68001708280f79171713f5e81703b6d2d9f892e42cbdb2930cb41cac380ebe1a5d041dd96dcf32f527

Score

10^/10

qakbot obama192 1655969261 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama192

Campaign

1655969261

C2

100.38.242.113:995

94.59.252.166:2222

74.14.5.179:2222

71.13.93.154:2222

193.253.44.249:2222

108.60.213.141:443

45.241.231.78:993

217.128.122.65:2222

40.134.246.185:995

1.161.124.241:443

70.46.220.114:443

24.43.99.75:443

32.221.224.140:995

80.11.74.81:2222

31.215.184.140:2222

39.49.85.29:995

67.209.195.198:443

186.90.153.162:2222

148.64.96.100:443

67.165.206.193:993

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

5116 regsvr32.exe

pid	process
5116	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4456 schtasks.exe

pid	process
4456	schtasks.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

explorer.exepowershell.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiezdeysrz\e33d2e3d = c541f3b84757c36885ed3f045fb85905183f3d8edb0149a2dd05e70da3b1c571c23b334d01ccd3ab60aabb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiezdeysrz\d4e3de0f = 827a4660cb665e0773f3c334197a0b81d827c17f1d6047a4d92952cf191fae59d75c75dd143e810442372e6fc7db2e65792c4a9e7250256e885a66548d21c45b67ffcded8af9d6b1fbde238ebbcf7e7603da63deec688629df6afa	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiezdeysrz\9c7441cb = a09e81cf102824fe71fae447fa801f865e5d0529441942208d8bf0b4f90487387c5251a9657a3afb65	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiezdeysrz\6c5fb96a = a2b74b1753f82c3502a3ee8c2c02fce3483487aa5b2cdf7354ef64f73522951a2d8f2e850333362bb6525fc7f6754fd4f7759b1a	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiezdeysrz\d6a2fe73 = 2f1cbe026a2644b273b7706165ebc9f48152b13750eb5762ae706a6168ca2ac6ca469022cb014b4e1ac193e0b1a93b1a7e8240c275b283e672d96a09ea68fc1a5139e0ee84b1322fd38461689da78808892b8a9af9e31f320d17b335b431bcb79a2dbd32e3113f66c22074b86be1ed3f306da331608124da4e76861770a03b9436f7b13c4e4d172cf7ef54eac166b7d659c75dde46c98085b593001455fb3d73070229069ef75b4fa8d020b10ca8dfe5119faa93	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiezdeysrz\6e1e9916 = e833d026fdcaa970e6e208d3fd7ef12a1334f121ad1933e661e2c1c5e7fb2efcbbb3f63e2262ccd0e4114ebccd2c3b9e83c9af5f81b3edea142c	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiezdeysrz	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiezdeysrz\e33d2e3d = c541e4b84757f006def8418c9042e98aa9e0ebfea8a01888f60dc5650444a0fb1659a083535cfc4a6f3d464bdb9f071070df79788ce082e2b49b81f75ea30f8d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiezdeysrz\1157f6e0 = 3a313174de1b226d20da5f4bae69f867e71ab7961167019f6d494d57af0af05ff2ce6f666d4520c4c2bcaef0d7fa1f55c74ded06d35552b882d34c658a2c8e360d03db25dcb6d52a5981d7a247e8b7579981e20f0e6d43973d95	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiezdeysrz\a9eb9185 = 2979eb8fc6d4a5dd105e0fe35c4898e810938662c182827406f69f85d59ac43850413849c49c9a223771e3965b0622d5d58a22458b711d9cb47b8320675c9025e2	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
1928	regsvr32.exe
1928	regsvr32.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1928 regsvr32.exe
5116 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4892 powershell.exe

description	pid	process
Token: SeDebugPrivilege	4892	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 3816 wrote to memory of 1928	3816	regsvr32.exe	regsvr32.exe
PID 3816 wrote to memory of 1928	3816	regsvr32.exe	regsvr32.exe
PID 3816 wrote to memory of 1928	3816	regsvr32.exe	regsvr32.exe
PID 1928 wrote to memory of 4656	1928	regsvr32.exe	explorer.exe
PID 1928 wrote to memory of 4656	1928	regsvr32.exe	explorer.exe
PID 1928 wrote to memory of 4656	1928	regsvr32.exe	explorer.exe
PID 1928 wrote to memory of 4656	1928	regsvr32.exe	explorer.exe
PID 1928 wrote to memory of 4656	1928	regsvr32.exe	explorer.exe
PID 4656 wrote to memory of 4456	4656	explorer.exe	schtasks.exe
PID 4656 wrote to memory of 4456	4656	explorer.exe	schtasks.exe
PID 4656 wrote to memory of 4456	4656	explorer.exe	schtasks.exe
PID 4892 wrote to memory of 4000	4892	powershell.exe	regsvr32.exe
PID 4892 wrote to memory of 4000	4892	powershell.exe	regsvr32.exe
PID 4000 wrote to memory of 5116	4000	regsvr32.exe	regsvr32.exe
PID 4000 wrote to memory of 5116	4000	regsvr32.exe	regsvr32.exe
PID 4000 wrote to memory of 5116	4000	regsvr32.exe	regsvr32.exe
PID 5116 wrote to memory of 1388	5116	regsvr32.exe	explorer.exe
PID 5116 wrote to memory of 1388	5116	regsvr32.exe	explorer.exe
PID 5116 wrote to memory of 1388	5116	regsvr32.exe	explorer.exe
PID 5116 wrote to memory of 1388	5116	regsvr32.exe	explorer.exe
PID 5116 wrote to memory of 1388	5116	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\youUp.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3816

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\youUp.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4656

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 22:03 /tn mvzjeglrzh /ET 22:14 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAeQBvAHUAVQBwAC4AZABsAGwAIgA=" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:4456

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAeQBvAHUAVQBwAC4AZABsAGwAIgA=
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\youUp.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4000

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\youUp.dll
3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5116

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\youUp.dll
Filesize
335KB

MD5
124a1ecde0dc1b0fa212b2f5b1ac5943

SHA1
961063415b239e9fc6e2c88a0252ef22e4cd2b8c

SHA256
2f478b6d30f061323a35c4341799cd770feb8c588a7dad43f0ddfc311d34675a

SHA512
01d8348183b4b7d673698cb8536a695801dfde4860810a68001708280f79171713f5e81703b6d2d9f892e42cbdb2930cb41cac380ebe1a5d041dd96dcf32f527

Download Submit
C:\Users\Admin\AppData\Local\Temp\youUp.dll
Filesize
335KB

MD5
124a1ecde0dc1b0fa212b2f5b1ac5943

SHA1
961063415b239e9fc6e2c88a0252ef22e4cd2b8c

SHA256
2f478b6d30f061323a35c4341799cd770feb8c588a7dad43f0ddfc311d34675a

SHA512
01d8348183b4b7d673698cb8536a695801dfde4860810a68001708280f79171713f5e81703b6d2d9f892e42cbdb2930cb41cac380ebe1a5d041dd96dcf32f527

Download Submit
memory/1388-147-0x0000000001260000-0x0000000001282000-memory.dmp

Filesize
136KB

Download
memory/1388-146-0x0000000001260000-0x0000000001282000-memory.dmp

Filesize
136KB

Download
memory/1388-144-0x0000000000000000-mapping.dmp

Download
memory/1928-131-0x0000000000560000-0x0000000000582000-memory.dmp

Filesize
136KB

Download
memory/1928-133-0x0000000000560000-0x0000000000582000-memory.dmp

Filesize
136KB

Download
memory/1928-130-0x0000000000000000-mapping.dmp

Download
memory/4000-138-0x0000000000000000-mapping.dmp

Download
memory/4456-134-0x0000000000000000-mapping.dmp

Download
memory/4656-136-0x0000000000720000-0x0000000000742000-memory.dmp

Filesize
136KB

Download
memory/4656-135-0x0000000000720000-0x0000000000742000-memory.dmp

Filesize
136KB

Download
memory/4656-132-0x0000000000000000-mapping.dmp

Download
memory/4892-137-0x0000020E658E0000-0x0000020E65902000-memory.dmp

Filesize
136KB

Download
memory/4892-142-0x00007FFCE2D00000-0x00007FFCE37C1000-memory.dmp

Filesize
10.8MB

Download
memory/5116-140-0x0000000000000000-mapping.dmp

Download
memory/5116-143-0x0000000000ED0000-0x0000000000EF2000-memory.dmp

Filesize
136KB

Download
memory/5116-145-0x0000000000ED0000-0x0000000000EF2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads