qakbot | f96e231472ef73cfee0e574b7f3df122433bd372c41a1f1f28681f8861a48543

General

Target

knowSoDay.dll
Size

377KB
MD5

b03acd4fde7a62a021834d8e8cbaba51
SHA1

5f3bfba9cf1f0c697c6e5b48ccbc818cc9f806ee
SHA256

f96e231472ef73cfee0e574b7f3df122433bd372c41a1f1f28681f8861a48543
SHA512

3568caf606fb37f71d59065a9c1859825adfdc207891af1f3220dd52c6961513cb59f1d304d2d290e72d9783404ed5a639c673ecb17a0e0f58a6e01b1300ef5e

Score

10^/10

qakbot obama195 1656400725 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama195

Campaign

1656400725

C2

74.14.5.179:2222

104.34.212.7:32103

142.186.49.224:2222

93.48.80.198:995

94.59.15.180:2222

217.128.122.65:2222

45.241.173.232:993

24.43.99.75:443

89.101.97.139:443

70.46.220.114:443

32.221.224.140:995

67.209.195.198:443

37.34.253.233:443

80.11.74.81:2222

81.214.215.234:443

67.165.206.193:993

173.174.216.62:443

186.90.153.162:2222

148.64.96.100:443

176.205.23.138:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1844 regsvr32.exe

pid	process
1844	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4732 schtasks.exe

pid	process
4732	schtasks.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hbritlrgylz\e7128277 = 2d162347edbb24dbd9000a09c581c9b1bbf2e7ac3fa3239d7c1a98d65cb3d243148296aa81bb	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hbritlrgylz\6a31355c = d4ce50c8017dfc8253703712b46ab0707f6fc2c0efd3ee2f54bd2b0aacdd5863eb4c18bcc1d4d34391dc88af41fd3b7bcf274c039d906644fef7eb60a35cbef0457106d3abc3700df01b406792bc0c6a51b0b951218348a9f2dbd61257197eb844166928b7c2	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hbritlrgylz\985bed81 = 2a7dc0af4b071666db903763bc4b3abac2513cc709cb535ec8269f0b884ee2952a149ff4cf96d89c460c00c2b2a29d12761b1213b98a90964d6ce6f40885aac7cac03a7f5265cc681c53c7ce26d6da6ce49e628b1f8c24cf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hbritlrgylz\15785aaa = 0283fe10c694a4ca1520ef24feb276d510ed2e6d83790ee2374b4ada0b20e543267bb6ee8082a727bb0ab194185a9afcdba06afee7084f7c086ccfd2fcefddd9d3fd576bece9bc610f49582ddca137658c16c6713322baab839bebd444d2cf397fdcf62f6d205d738059017bce9c05c1a7	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hbritlrgylz\6a31355c = d4ce47c8017dcf182eaf4e71f8158b679231eb8393dc63fa61e108273aabfe0c29991e595fe3c28d27243273c17c27f88ceefa366f40d0a5682793c31005eb3477eb2592b3d09abe2a70b26419ee4ade4b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hbritlrgylz\e553a20b = d87fbbe27940ed93570d0ad5705be2d60ada7e8607989740637ce246b0eafebce18d50	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hbritlrgylz	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hbritlrgylz\5defc56e = 4f46595464105ed865d00bb060ff4a97e055	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hbritlrgylz\5faee512 = 331bdc12a529401f5563b771d55100c4988a2e6bfe972bdcfcd479e13dd1b758ebb4f26151156ea61d0fbf4499dddb06bdfcad8645587ae8c9f291c2160891bff9d26fc394ec8e717569a5a00d068ffc9bd624f60132458b464ce39c7f5c01da938911f90a9afcc9	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hbritlrgylz\20e78ae4 = e9f91f303626f1f358fbfc09deb07148cfce672742d7a8640e6b0ff88eb5	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
4748	regsvr32.exe
4748	regsvr32.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe
4604	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

4748 regsvr32.exe
1844 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 176 powershell.exe

description	pid	process
Token: SeDebugPrivilege	176	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 3476 wrote to memory of 4748	3476	regsvr32.exe	regsvr32.exe
PID 3476 wrote to memory of 4748	3476	regsvr32.exe	regsvr32.exe
PID 3476 wrote to memory of 4748	3476	regsvr32.exe	regsvr32.exe
PID 4748 wrote to memory of 4604	4748	regsvr32.exe	explorer.exe
PID 4748 wrote to memory of 4604	4748	regsvr32.exe	explorer.exe
PID 4748 wrote to memory of 4604	4748	regsvr32.exe	explorer.exe
PID 4748 wrote to memory of 4604	4748	regsvr32.exe	explorer.exe
PID 4748 wrote to memory of 4604	4748	regsvr32.exe	explorer.exe
PID 4604 wrote to memory of 4732	4604	explorer.exe	schtasks.exe
PID 4604 wrote to memory of 4732	4604	explorer.exe	schtasks.exe
PID 4604 wrote to memory of 4732	4604	explorer.exe	schtasks.exe
PID 176 wrote to memory of 3980	176	powershell.exe	regsvr32.exe
PID 176 wrote to memory of 3980	176	powershell.exe	regsvr32.exe
PID 3980 wrote to memory of 1844	3980	regsvr32.exe	regsvr32.exe
PID 3980 wrote to memory of 1844	3980	regsvr32.exe	regsvr32.exe
PID 3980 wrote to memory of 1844	3980	regsvr32.exe	regsvr32.exe
PID 1844 wrote to memory of 2284	1844	regsvr32.exe	explorer.exe
PID 1844 wrote to memory of 2284	1844	regsvr32.exe	explorer.exe
PID 1844 wrote to memory of 2284	1844	regsvr32.exe	explorer.exe
PID 1844 wrote to memory of 2284	1844	regsvr32.exe	explorer.exe
PID 1844 wrote to memory of 2284	1844	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\knowSoDay.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3476

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\knowSoDay.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4748

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4604

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 12:24 /tn gpngexb /ET 12:35 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAawBuAG8AdwBTAG8ARABhAHkALgBkAGwAbAAiAA==" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:4732

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAawBuAG8AdwBTAG8ARABhAHkALgBkAGwAbAAiAA==
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:176

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\knowSoDay.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3980

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\knowSoDay.dll
3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
PID:2284

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\knowSoDay.dll
Filesize
377KB

MD5
b03acd4fde7a62a021834d8e8cbaba51

SHA1
5f3bfba9cf1f0c697c6e5b48ccbc818cc9f806ee

SHA256
f96e231472ef73cfee0e574b7f3df122433bd372c41a1f1f28681f8861a48543

SHA512
3568caf606fb37f71d59065a9c1859825adfdc207891af1f3220dd52c6961513cb59f1d304d2d290e72d9783404ed5a639c673ecb17a0e0f58a6e01b1300ef5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\knowSoDay.dll
Filesize
377KB

MD5
b03acd4fde7a62a021834d8e8cbaba51

SHA1
5f3bfba9cf1f0c697c6e5b48ccbc818cc9f806ee

SHA256
f96e231472ef73cfee0e574b7f3df122433bd372c41a1f1f28681f8861a48543

SHA512
3568caf606fb37f71d59065a9c1859825adfdc207891af1f3220dd52c6961513cb59f1d304d2d290e72d9783404ed5a639c673ecb17a0e0f58a6e01b1300ef5e

Download Submit
memory/176-142-0x00007FF821F90000-0x00007FF822A51000-memory.dmp

Filesize
10.8MB

Download
memory/176-137-0x000001786AFE0000-0x000001786B002000-memory.dmp

Filesize
136KB

Download
memory/1844-140-0x0000000000000000-mapping.dmp

Download
memory/1844-145-0x0000000000E40000-0x0000000000E62000-memory.dmp

Filesize
136KB

Download
memory/1844-143-0x0000000000E40000-0x0000000000E62000-memory.dmp

Filesize
136KB

Download
memory/2284-147-0x0000000000710000-0x0000000000732000-memory.dmp

Filesize
136KB

Download
memory/2284-146-0x0000000000710000-0x0000000000732000-memory.dmp

Filesize
136KB

Download
memory/2284-144-0x0000000000000000-mapping.dmp

Download
memory/3980-138-0x0000000000000000-mapping.dmp

Download
memory/4604-136-0x0000000000950000-0x0000000000972000-memory.dmp

Filesize
136KB

Download
memory/4604-135-0x0000000000950000-0x0000000000972000-memory.dmp

Filesize
136KB

Download
memory/4604-132-0x0000000000000000-mapping.dmp

Download
memory/4732-134-0x0000000000000000-mapping.dmp

Download
memory/4748-130-0x0000000000000000-mapping.dmp

Download
memory/4748-133-0x0000000000D30000-0x0000000000D52000-memory.dmp

Filesize
136KB

Download
memory/4748-131-0x0000000000D30000-0x0000000000D52000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads