qakbot | 4ab64d23b6f8447a6735a68c001613cf033036c999a8f09f363b9180ad7e95c3

General

Target

meHow.dll
Size

335KB
MD5

92a4350f7edd8c185209ce6008e56f6d
SHA1

f84b9587660e426070fb0f0076b740b4f10910e6
SHA256

4ab64d23b6f8447a6735a68c001613cf033036c999a8f09f363b9180ad7e95c3
SHA512

7bf0e122d5b885286b86ed5dd85a73a0fed94d9818dde3f60973c734b79ae5929e95c4c94aac67cd1bc31ae1d3909f56675279ccacdc3b18ecbe7f5efb8fa292

Score

10^/10

qakbot obama192 1655969261 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama192

Campaign

1655969261

C2

100.38.242.113:995

94.59.252.166:2222

74.14.5.179:2222

71.13.93.154:2222

193.253.44.249:2222

108.60.213.141:443

45.241.231.78:993

217.128.122.65:2222

40.134.246.185:995

1.161.124.241:443

70.46.220.114:443

24.43.99.75:443

32.221.224.140:995

80.11.74.81:2222

31.215.184.140:2222

39.49.85.29:995

67.209.195.198:443

186.90.153.162:2222

148.64.96.100:443

67.165.206.193:993

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1832 regsvr32.exe

pid	process
1832	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

676 schtasks.exe

pid	process
676	schtasks.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wokejumi\2d25772e = 2fad88a379741798c1fb1d630cd56fa60c12b4f6785c278a07	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wokejumi\526c18d8 = 7a499f03d4bc05b13651e181ab3a6cc33bfbc771bbb7b68661f7b4bad95a24afc85c79ef6b02d93f005749fca8e0a6f9250bb859d8ef5dd239	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wokejumi\65b2e8ea = d8272af11bbd73ed0b809f5308c66c7e9125e231986b56dc2239f6f5571943f4ed42831a8f53075e386c79b066a338253f90f40e08129978ce1ce77dfe	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wokejumi\a006c005 = 71cd8d6e8f83bc62d700254ef5b2b28139476525e0320cab6f734b8d663095b795f9a371f744cf8e4542e394db6c794fd00390	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wokejumi\67f3c896 = a96a547ce254a3fd298ce00443ac6057df46c26cd18c2e73c21a2e0daecc3e1175eaec7a198ae52f16801045e65483715481fdffaaff58275d2238598f59bb074789549d4917ecdf3644608fc69ece87b82dd339f96079fd7d313653c6242f09921b4831ebc2f75a5c4d59dc392f6f173b53053cd60f8f154525fa0084d164a97594	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wokejumi	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wokejumi\526c18d8 = 7a498803d4bc36b88d8415e2e5bb9a92b58f6eccd4127b47b493c6360749cd71410d96219a85e7fd712440bf7ce021c60eb77449559f749ceddc0867720d737eb970ffab90ee4ef879d7f29a12d7	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wokejumi\dd0e8f8f = 8a40cfcfe2e12eed39d9f566af120f684b5b73fef34ab43beaae4df0f3eb99b72d3954b0c4ba4c853c1175b994b85aefad90a05dbd093b4d27c8e6f9f189513804ee2092e2c4657ce2aa5bfb1b5afed840e246a5c00908c46237a733bb885b00b675b2389ffcbd64ec192e32	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wokejumi\18baa760 = 3d5643abc34e7df81f4c9708a072ef04b9915ef93dcbf4aaf957f27f59d9d3f346e000167a343220b1d14ddcface13c03dc116d4e9735167f16702fa277c74cd	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wokejumi\df4faff3 = 9120f2eb227f559365b4cb782e7d4924a153ab1a0197981035b806d2b3099592	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
3288	regsvr32.exe
3288	regsvr32.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3288 regsvr32.exe
1832 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 728 powershell.exe

description	pid	process
Token: SeDebugPrivilege	728	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2700 wrote to memory of 3288	2700	regsvr32.exe	regsvr32.exe
PID 2700 wrote to memory of 3288	2700	regsvr32.exe	regsvr32.exe
PID 2700 wrote to memory of 3288	2700	regsvr32.exe	regsvr32.exe
PID 3288 wrote to memory of 2852	3288	regsvr32.exe	explorer.exe
PID 3288 wrote to memory of 2852	3288	regsvr32.exe	explorer.exe
PID 3288 wrote to memory of 2852	3288	regsvr32.exe	explorer.exe
PID 3288 wrote to memory of 2852	3288	regsvr32.exe	explorer.exe
PID 3288 wrote to memory of 2852	3288	regsvr32.exe	explorer.exe
PID 2852 wrote to memory of 676	2852	explorer.exe	schtasks.exe
PID 2852 wrote to memory of 676	2852	explorer.exe	schtasks.exe
PID 2852 wrote to memory of 676	2852	explorer.exe	schtasks.exe
PID 728 wrote to memory of 3656	728	powershell.exe	regsvr32.exe
PID 728 wrote to memory of 3656	728	powershell.exe	regsvr32.exe
PID 3656 wrote to memory of 1832	3656	regsvr32.exe	regsvr32.exe
PID 3656 wrote to memory of 1832	3656	regsvr32.exe	regsvr32.exe
PID 3656 wrote to memory of 1832	3656	regsvr32.exe	regsvr32.exe
PID 1832 wrote to memory of 3000	1832	regsvr32.exe	explorer.exe
PID 1832 wrote to memory of 3000	1832	regsvr32.exe	explorer.exe
PID 1832 wrote to memory of 3000	1832	regsvr32.exe	explorer.exe
PID 1832 wrote to memory of 3000	1832	regsvr32.exe	explorer.exe
PID 1832 wrote to memory of 3000	1832	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\meHow.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\meHow.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3288

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2852

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 22:06 /tn jcnifvgy /ET 22:17 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbQBlAEgAbwB3AC4AZABsAGwAIgA=" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:676

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbQBlAEgAbwB3AC4AZABsAGwAIgA=
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:728

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\meHow.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3656

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\meHow.dll
3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
PID:3000

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\meHow.dll
Filesize
335KB

MD5
92a4350f7edd8c185209ce6008e56f6d

SHA1
f84b9587660e426070fb0f0076b740b4f10910e6

SHA256
4ab64d23b6f8447a6735a68c001613cf033036c999a8f09f363b9180ad7e95c3

SHA512
7bf0e122d5b885286b86ed5dd85a73a0fed94d9818dde3f60973c734b79ae5929e95c4c94aac67cd1bc31ae1d3909f56675279ccacdc3b18ecbe7f5efb8fa292

Download Submit
C:\Users\Admin\AppData\Local\Temp\meHow.dll
Filesize
335KB

MD5
92a4350f7edd8c185209ce6008e56f6d

SHA1
f84b9587660e426070fb0f0076b740b4f10910e6

SHA256
4ab64d23b6f8447a6735a68c001613cf033036c999a8f09f363b9180ad7e95c3

SHA512
7bf0e122d5b885286b86ed5dd85a73a0fed94d9818dde3f60973c734b79ae5929e95c4c94aac67cd1bc31ae1d3909f56675279ccacdc3b18ecbe7f5efb8fa292

Download Submit
memory/676-134-0x0000000000000000-mapping.dmp

Download
memory/728-142-0x00007FFC6F070000-0x00007FFC6FB31000-memory.dmp

Filesize
10.8MB

Download
memory/728-137-0x0000014179FF0000-0x000001417A012000-memory.dmp

Filesize
136KB

Download
memory/1832-140-0x0000000000000000-mapping.dmp

Download
memory/1832-143-0x0000000000AD0000-0x0000000000AF2000-memory.dmp

Filesize
136KB

Download
memory/1832-145-0x0000000000AD0000-0x0000000000AF2000-memory.dmp

Filesize
136KB

Download
memory/2852-136-0x0000000000130000-0x0000000000152000-memory.dmp

Filesize
136KB

Download
memory/2852-135-0x0000000000130000-0x0000000000152000-memory.dmp

Filesize
136KB

Download
memory/2852-132-0x0000000000000000-mapping.dmp

Download
memory/3000-144-0x0000000000000000-mapping.dmp

Download
memory/3000-146-0x00000000003D0000-0x00000000003F2000-memory.dmp

Filesize
136KB

Download
memory/3000-147-0x00000000003D0000-0x00000000003F2000-memory.dmp

Filesize
136KB

Download
memory/3288-133-0x0000000000E40000-0x0000000000E62000-memory.dmp

Filesize
136KB

Download
memory/3288-131-0x0000000000E40000-0x0000000000E62000-memory.dmp

Filesize
136KB

Download
memory/3288-130-0x0000000000000000-mapping.dmp

Download
memory/3656-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads