qakbot | 4ab64d23b6f8447a6735a68c001613cf033036c999a8f09f363b9180ad7e95c3

General

Target

meHow.dll
Size

335KB
MD5

92a4350f7edd8c185209ce6008e56f6d
SHA1

f84b9587660e426070fb0f0076b740b4f10910e6
SHA256

4ab64d23b6f8447a6735a68c001613cf033036c999a8f09f363b9180ad7e95c3
SHA512

7bf0e122d5b885286b86ed5dd85a73a0fed94d9818dde3f60973c734b79ae5929e95c4c94aac67cd1bc31ae1d3909f56675279ccacdc3b18ecbe7f5efb8fa292

Score

10^/10

qakbot obama192 1655969261 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama192

Campaign

1655969261

C2

100.38.242.113:995

94.59.252.166:2222

74.14.5.179:2222

71.13.93.154:2222

193.253.44.249:2222

108.60.213.141:443

45.241.231.78:993

217.128.122.65:2222

40.134.246.185:995

1.161.124.241:443

70.46.220.114:443

24.43.99.75:443

32.221.224.140:995

80.11.74.81:2222

31.215.184.140:2222

39.49.85.29:995

67.209.195.198:443

186.90.153.162:2222

148.64.96.100:443

67.165.206.193:993

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1080 regsvr32.exe

pid	process
1080	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1872 schtasks.exe

pid	process
1872	schtasks.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 705863971688d801	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exepowershell.exeregsvr32.exe

pid	process
1644	regsvr32.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
848	powershell.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
1080	regsvr32.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe
960	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1644 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 848 powershell.exe

description	pid	process
Token: SeDebugPrivilege	848	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 948 wrote to memory of 1644	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1644	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1644	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1644	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1644	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1644	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1644	948	regsvr32.exe	regsvr32.exe
PID 1644 wrote to memory of 960	1644	regsvr32.exe	explorer.exe
PID 1644 wrote to memory of 960	1644	regsvr32.exe	explorer.exe
PID 1644 wrote to memory of 960	1644	regsvr32.exe	explorer.exe
PID 1644 wrote to memory of 960	1644	regsvr32.exe	explorer.exe
PID 1644 wrote to memory of 960	1644	regsvr32.exe	explorer.exe
PID 1644 wrote to memory of 960	1644	regsvr32.exe	explorer.exe
PID 960 wrote to memory of 1872	960	explorer.exe	schtasks.exe
PID 960 wrote to memory of 1872	960	explorer.exe	schtasks.exe
PID 960 wrote to memory of 1872	960	explorer.exe	schtasks.exe
PID 960 wrote to memory of 1872	960	explorer.exe	schtasks.exe
PID 900 wrote to memory of 848	900	taskeng.exe	powershell.exe
PID 900 wrote to memory of 848	900	taskeng.exe	powershell.exe
PID 900 wrote to memory of 848	900	taskeng.exe	powershell.exe
PID 848 wrote to memory of 1868	848	powershell.exe	regsvr32.exe
PID 848 wrote to memory of 1868	848	powershell.exe	regsvr32.exe
PID 848 wrote to memory of 1868	848	powershell.exe	regsvr32.exe
PID 848 wrote to memory of 1868	848	powershell.exe	regsvr32.exe
PID 848 wrote to memory of 1868	848	powershell.exe	regsvr32.exe
PID 1868 wrote to memory of 1080	1868	regsvr32.exe	regsvr32.exe
PID 1868 wrote to memory of 1080	1868	regsvr32.exe	regsvr32.exe
PID 1868 wrote to memory of 1080	1868	regsvr32.exe	regsvr32.exe
PID 1868 wrote to memory of 1080	1868	regsvr32.exe	regsvr32.exe
PID 1868 wrote to memory of 1080	1868	regsvr32.exe	regsvr32.exe
PID 1868 wrote to memory of 1080	1868	regsvr32.exe	regsvr32.exe
PID 1868 wrote to memory of 1080	1868	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\meHow.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\meHow.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 22:06 /tn jvrtbbqlvw /ET 22:17 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbQBlAEgAbwB3AC4AZABsAGwAIgA=" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:1872

C:\Windows\system32\taskeng.exe
taskeng.exe {263BB000-3773-4E10-A5DE-C0C0A525059C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbQBlAEgAbwB3AC4AZABsAGwAIgA=
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\meHow.dll
3⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\meHow.dll
4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1080

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\meHow.dll
Filesize
335KB

MD5
92a4350f7edd8c185209ce6008e56f6d

SHA1
f84b9587660e426070fb0f0076b740b4f10910e6

SHA256
4ab64d23b6f8447a6735a68c001613cf033036c999a8f09f363b9180ad7e95c3

SHA512
7bf0e122d5b885286b86ed5dd85a73a0fed94d9818dde3f60973c734b79ae5929e95c4c94aac67cd1bc31ae1d3909f56675279ccacdc3b18ecbe7f5efb8fa292

Download Submit
\Users\Admin\AppData\Local\Temp\meHow.dll
Filesize
335KB

MD5
92a4350f7edd8c185209ce6008e56f6d

SHA1
f84b9587660e426070fb0f0076b740b4f10910e6

SHA256
4ab64d23b6f8447a6735a68c001613cf033036c999a8f09f363b9180ad7e95c3

SHA512
7bf0e122d5b885286b86ed5dd85a73a0fed94d9818dde3f60973c734b79ae5929e95c4c94aac67cd1bc31ae1d3909f56675279ccacdc3b18ecbe7f5efb8fa292

Download Submit
memory/848-77-0x0000000000E3B000-0x0000000000E5A000-memory.dmp

Filesize
124KB

Download
memory/848-75-0x0000000000E34000-0x0000000000E37000-memory.dmp

Filesize
12KB

Download
memory/848-70-0x000007FEF34A0000-0x000007FEF3FFD000-memory.dmp

Filesize
11.4MB

Download
memory/848-71-0x0000000000E34000-0x0000000000E37000-memory.dmp

Filesize
12KB

Download
memory/848-69-0x000007FEF4000000-0x000007FEF4A23000-memory.dmp

Filesize
10.1MB

Download
memory/848-67-0x0000000000000000-mapping.dmp

Download
memory/948-54-0x000007FEFB971000-0x000007FEFB973000-memory.dmp

Filesize
8KB

Download
memory/960-66-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/960-64-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/960-62-0x0000000074351000-0x0000000074353000-memory.dmp

Filesize
8KB

Download
memory/960-60-0x0000000000000000-mapping.dmp

Download
memory/1080-76-0x0000000000000000-mapping.dmp

Download
memory/1080-82-0x00000000003F0000-0x0000000000412000-memory.dmp

Filesize
136KB

Download
memory/1080-80-0x00000000003F0000-0x0000000000412000-memory.dmp

Filesize
136KB

Download
memory/1644-59-0x0000000000180000-0x00000000001A2000-memory.dmp

Filesize
136KB

Download
memory/1644-57-0x0000000000180000-0x00000000001A2000-memory.dmp

Filesize
136KB

Download
memory/1644-56-0x0000000074F21000-0x0000000074F23000-memory.dmp

Filesize
8KB

Download
memory/1644-55-0x0000000000000000-mapping.dmp

Download
memory/1644-63-0x0000000000180000-0x00000000001A2000-memory.dmp

Filesize
136KB

Download
memory/1868-72-0x0000000000000000-mapping.dmp

Download
memory/1872-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads