qakbot | 772a5c107d48b8f36c9c590b4b065ecf4e8e1a51acdb2d12b3d420c412e61e98

General

Target

sheThingSo.dll
Size

537KB
MD5

7991d4293ff55e991e2e5633380523be
SHA1

017380f803803b9a153df9ea451e67483b13a8ac
SHA256

772a5c107d48b8f36c9c590b4b065ecf4e8e1a51acdb2d12b3d420c412e61e98
SHA512

058a2b5d2dc018bcec6fdef86dd775b708f7c29abd80586eec11b4d4670e1c6cfd1768e994dde15619e07416cf5796623cfbca932791043cead846f64d653c20

Score

10^/10

qakbot obama198 1656660122 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama198

Campaign

1656660122

C2

86.200.151.188:2222

41.228.22.180:443

47.23.89.60:993

129.208.0.52:995

1.161.72.70:995

39.53.124.57:995

189.78.107.163:32101

24.43.99.75:443

197.89.17.87:443

111.125.245.116:995

80.11.74.81:2222

78.180.100.59:443

86.97.209.157:2222

24.178.196.158:2222

120.150.218.241:995

100.38.242.113:995

89.101.97.139:443

93.48.80.198:995

74.14.5.179:2222

40.134.246.185:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

5068 regsvr32.exe

pid	process
5068	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4696 schtasks.exe

pid	process
4696	schtasks.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zuokwyzu\dd3c1915 = 86c147110cbd5457c8fc96a7ed684c273dd355d77f996eb10c1a48656131c23e30f20ed761cead707d28ea43bfba525d8f3f06f491afcff9aef8efa327be361b66fa6ad1ea781925736302117b8ba7afc873b13299fc66f833774e3699ff9ebe7e7db290b65abc8f13ce9337aac1c7e17af1eb43402a2cb89c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zuokwyzu\65807e70 = 39671291635c6e3b2bbf244d6fac96e4761f709e9596fabe3a298a4b6918caa5325db1f5199599e73cdec9a73c6b95fd5677	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zuokwyzu\1ac91186 = 9e55710ac292f0ecca403b3bae60ebf9cd3e577d10eb88be94f28ee6c01a9aafbe044f084d89c34f7a3a976ea655a33a38f7c623d02a57e5b2923e5d5d380399313e0d8aec9f8487898dc17338faa382875a5120f327ca2c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zuokwyzu\a27576e3 = 29271e8bb27f9bda7e55beb41588a7d5b89de7c4090c052de4d723b56e3ca5fa11abbcba34e15cc498b8b32dedab7ce2541f859a5f278b610ead56ec3af03fa9aa64c47ae2ab9775740062f3dd0db6566a37fa90c97b563b396624	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zuokwyzu\df7d3969 = 651705d53c883dd55f4dc1476fcbaf299d148efb8fb6ef70989fa4aa7a5d7512bfeffc032216132e567acdcf72077ed08caee48490607e27b30e58c4	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zuokwyzu\97eaa6ad = bd90ec51dc4b071b5c9d0447c66765d9b13f56b6b1fb52e01d405b7a6d979ebc0ed35f718fe43491c8d3ba2ed5f09ca4510f27428cbdca63f8bb2d0fd9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zuokwyzu\e8a3c95b = 3b7a29c1ddf194101719ed0cee190b8b05be970de35e3751aa121ae31c6bf85cf56e22852d3690d4e4ae8b94ff763ea017644994f8a7f1640d2fee49b6ffbebe0a388555af7b9faaeab7ae7706a4a357d8590859a3452c7d8bcc649e3b2134a29438996d87b295e2c68fe9141c3ff9a1456bf89e8beb710d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zuokwyzu	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zuokwyzu\e8a3c95b = 3b7a3ec1ddf1a74a9bebf7836f90c7bd5322d7b9e6f2241cb754ba9228b33b3248787467148ea8c1a7549d6199acaf5483f771be3e495b2779dcc3fff3a8d9d1b1d48d9d49313bd8049755d25237443d0061545190f6f2cf1af7bf8c8ec7005aaa0c59	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zuokwyzu\67c15e0c = 67f59f995dfc869a6437ecde6fb77516162d88cc67d6369cd8149ed84b665cad229a9049c65052c93584485c89fc	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
2764	regsvr32.exe
2764	regsvr32.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2764 regsvr32.exe
5068 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4532 powershell.exe

description	pid	process
Token: SeDebugPrivilege	4532	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2476 wrote to memory of 2764	2476	regsvr32.exe	regsvr32.exe
PID 2476 wrote to memory of 2764	2476	regsvr32.exe	regsvr32.exe
PID 2476 wrote to memory of 2764	2476	regsvr32.exe	regsvr32.exe
PID 2764 wrote to memory of 4484	2764	regsvr32.exe	explorer.exe
PID 2764 wrote to memory of 4484	2764	regsvr32.exe	explorer.exe
PID 2764 wrote to memory of 4484	2764	regsvr32.exe	explorer.exe
PID 2764 wrote to memory of 4484	2764	regsvr32.exe	explorer.exe
PID 2764 wrote to memory of 4484	2764	regsvr32.exe	explorer.exe
PID 4484 wrote to memory of 4696	4484	explorer.exe	schtasks.exe
PID 4484 wrote to memory of 4696	4484	explorer.exe	schtasks.exe
PID 4484 wrote to memory of 4696	4484	explorer.exe	schtasks.exe
PID 4532 wrote to memory of 1288	4532	powershell.exe	regsvr32.exe
PID 4532 wrote to memory of 1288	4532	powershell.exe	regsvr32.exe
PID 1288 wrote to memory of 5068	1288	regsvr32.exe	regsvr32.exe
PID 1288 wrote to memory of 5068	1288	regsvr32.exe	regsvr32.exe
PID 1288 wrote to memory of 5068	1288	regsvr32.exe	regsvr32.exe
PID 5068 wrote to memory of 2756	5068	regsvr32.exe	explorer.exe
PID 5068 wrote to memory of 2756	5068	regsvr32.exe	explorer.exe
PID 5068 wrote to memory of 2756	5068	regsvr32.exe	explorer.exe
PID 5068 wrote to memory of 2756	5068	regsvr32.exe	explorer.exe
PID 5068 wrote to memory of 2756	5068	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\sheThingSo.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2476

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\sheThingSo.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2764

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4484

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 21:46 /tn pivyoflxmg /ET 21:57 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwBoAGUAVABoAGkAbgBnAFMAbwAuAGQAbABsACIA" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:4696

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwBoAGUAVABoAGkAbgBnAFMAbwAuAGQAbABsACIA
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\sheThingSo.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\sheThingSo.dll
3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5068

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
PID:2756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sheThingSo.dll
Filesize
537KB

MD5
7991d4293ff55e991e2e5633380523be

SHA1
017380f803803b9a153df9ea451e67483b13a8ac

SHA256
772a5c107d48b8f36c9c590b4b065ecf4e8e1a51acdb2d12b3d420c412e61e98

SHA512
058a2b5d2dc018bcec6fdef86dd775b708f7c29abd80586eec11b4d4670e1c6cfd1768e994dde15619e07416cf5796623cfbca932791043cead846f64d653c20

Download Submit
C:\Users\Admin\AppData\Local\Temp\sheThingSo.dll
Filesize
537KB

MD5
7991d4293ff55e991e2e5633380523be

SHA1
017380f803803b9a153df9ea451e67483b13a8ac

SHA256
772a5c107d48b8f36c9c590b4b065ecf4e8e1a51acdb2d12b3d420c412e61e98

SHA512
058a2b5d2dc018bcec6fdef86dd775b708f7c29abd80586eec11b4d4670e1c6cfd1768e994dde15619e07416cf5796623cfbca932791043cead846f64d653c20

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1288-138-0x0000000000000000-mapping.dmp

Download
memory/2756-147-0x0000000000B00000-0x0000000000B22000-memory.dmp

Filesize
136KB

Download
memory/2756-145-0x0000000000000000-mapping.dmp

Download
memory/2756-148-0x0000000000B00000-0x0000000000B22000-memory.dmp

Filesize
136KB

Download
memory/2764-133-0x0000000002E90000-0x0000000002EB2000-memory.dmp

Filesize
136KB

Download
memory/2764-131-0x0000000002E90000-0x0000000002EB2000-memory.dmp

Filesize
136KB

Download
memory/2764-130-0x0000000000000000-mapping.dmp

Download
memory/4484-136-0x0000000000B30000-0x0000000000B52000-memory.dmp

Filesize
136KB

Download
memory/4484-135-0x0000000000B30000-0x0000000000B52000-memory.dmp

Filesize
136KB

Download
memory/4484-132-0x0000000000000000-mapping.dmp

Download
memory/4532-142-0x00007FF97E8B0000-0x00007FF97F371000-memory.dmp

Filesize
10.8MB

Download
memory/4532-137-0x00000226B8270000-0x00000226B8292000-memory.dmp

Filesize
136KB

Download
memory/4696-134-0x0000000000000000-mapping.dmp

Download
memory/5068-144-0x0000000000DC0000-0x0000000000DE2000-memory.dmp

Filesize
136KB

Download
memory/5068-140-0x0000000000000000-mapping.dmp

Download
memory/5068-146-0x0000000000DC0000-0x0000000000DE2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads