qakbot | 62653335118bb647653455b6aba600123b00a26e2b1fb74ad422b66abba60cfe

General

Target

wayNewBy.dll
Size

537KB
MD5

9a2bb67af0a90c70f19289c1bde3ec0f
SHA1

ab755f5be63bc573b4405bcc76803f03c14d8d9a
SHA256

62653335118bb647653455b6aba600123b00a26e2b1fb74ad422b66abba60cfe
SHA512

cc03ffb662ca094b12449321410dc567317446e27c34bf52ca0ac1c5937f98a68abf006b9656eaae7f60825d791c19b01bbf06f0c116cd54a0cc97d74b3a58ff

Score

10^/10

qakbot obama198 1656660122 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama198

Campaign

1656660122

C2

86.200.151.188:2222

41.228.22.180:443

47.23.89.60:993

129.208.0.52:995

1.161.72.70:995

39.53.124.57:995

189.78.107.163:32101

24.43.99.75:443

197.89.17.87:443

111.125.245.116:995

80.11.74.81:2222

78.180.100.59:443

86.97.209.157:2222

24.178.196.158:2222

120.150.218.241:995

100.38.242.113:995

89.101.97.139:443

93.48.80.198:995

74.14.5.179:2222

40.134.246.185:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1232 regsvr32.exe

pid	process
1232	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2008 schtasks.exe

pid	process
2008	schtasks.exe

Modifies data under HKEY_USERS 12 IoCs

Processes:

explorer.exepowershell.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Avauxya\e41ef2d5 = 2ac3f9b95b7fe2e8b28c22667b9ad78c3686fc1289b3bedc2dd272fd3004739cc901fc4df5363e0193337b185936e07db9b6498c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Avauxya\d3c002e7 = 0d5ff979c6fc7c72df257f6b7268cdd54892cd51db6319196d3d676f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Avauxya\693d45fe = 5f96e40665cd1d9916e4ff1e878af8501fa25903c9b966120abefd5494e762ad81af929ac2810956294732d914c49dbe80f085f85f6e566eafa05960a6405c4b22933a71275fe09648d88727f6fd053f5bf880314770a12383933c31e44a56544dc8e498	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Avauxya	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Avauxya\6b7c6582 = 50b49ddca1207eecbf43a6078aeaf2a3630769a4fb7a7dbab93985827e5fbd41de90578f21cd0c07d56d9c91bde132daf46c4fed0e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Avauxya\16742a08 = 88e5fc5d9ff8ecb473fb31d01a2f4003ba42419cd053a7c19df560bc7bd14ca6275ab4c1ab7567c2828e17d965168c54f20c6e97fb5074ae90e0a4f14f74f5bae9d84707d581f1e8d0ef54242a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Avauxya\aec84d6d = df4a38354a24d1d99a4f1f14899cde9823ab64d7fbcf6b30f7ca63a4b306e03b9b927fa50e52e4e1ae57838e29005ddcbbec4c5a9a8180bc3b219544fc369976b6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Avauxya\9b579d23 = 1bf568bf902baa634042397355608c3b4938622d1fd39e6b9d93d960caff1d16e916a5582a694bd2e22d1de83212341277068dd34f2ee697e03ef9db099b6d3465be03f3370b29fd0b771cc50b5b44fce14007bcb13f3b0f4d8391ad2a5cef2fe312bdba0088853744639797abe47c1e20ac	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Avauxya\e41ef2d5 = 2ac3eeb95b7fd12fc71656ae9101f18774461829f4fd3b37a601d8f752d8a12fd4e30c408dc9855df887ca63043ef210a136000487abb0718691fe048cdcb66164539800aff9dac3fc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 50194ed83295d801	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Avauxya\d181229b = 8f7f9ab9c65cfa88d4c222f590d8f2509e321b1d7650190ca35b72730e83ca05e4eaff546320b0c29592d2abdb906e340d6c1fd17b85497385103266b230d8e65337c20b2a5aa4a662ed2a2d25f23936ea45955e62a794ca2f1d5e2ec13cd2ee65b377d9cfcb0b4fa3fe23cf7d6fd15996f340928c914d	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exepowershell.exeregsvr32.exe

pid	process
1816	regsvr32.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
1684	powershell.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
1232	regsvr32.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1816 regsvr32.exe
1232 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1684 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1684	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 324 wrote to memory of 1816	324	regsvr32.exe	regsvr32.exe
PID 324 wrote to memory of 1816	324	regsvr32.exe	regsvr32.exe
PID 324 wrote to memory of 1816	324	regsvr32.exe	regsvr32.exe
PID 324 wrote to memory of 1816	324	regsvr32.exe	regsvr32.exe
PID 324 wrote to memory of 1816	324	regsvr32.exe	regsvr32.exe
PID 324 wrote to memory of 1816	324	regsvr32.exe	regsvr32.exe
PID 324 wrote to memory of 1816	324	regsvr32.exe	regsvr32.exe
PID 1816 wrote to memory of 2016	1816	regsvr32.exe	explorer.exe
PID 1816 wrote to memory of 2016	1816	regsvr32.exe	explorer.exe
PID 1816 wrote to memory of 2016	1816	regsvr32.exe	explorer.exe
PID 1816 wrote to memory of 2016	1816	regsvr32.exe	explorer.exe
PID 1816 wrote to memory of 2016	1816	regsvr32.exe	explorer.exe
PID 1816 wrote to memory of 2016	1816	regsvr32.exe	explorer.exe
PID 2016 wrote to memory of 2008	2016	explorer.exe	schtasks.exe
PID 2016 wrote to memory of 2008	2016	explorer.exe	schtasks.exe
PID 2016 wrote to memory of 2008	2016	explorer.exe	schtasks.exe
PID 2016 wrote to memory of 2008	2016	explorer.exe	schtasks.exe
PID 300 wrote to memory of 1684	300	taskeng.exe	powershell.exe
PID 300 wrote to memory of 1684	300	taskeng.exe	powershell.exe
PID 300 wrote to memory of 1684	300	taskeng.exe	powershell.exe
PID 1684 wrote to memory of 1356	1684	powershell.exe	regsvr32.exe
PID 1684 wrote to memory of 1356	1684	powershell.exe	regsvr32.exe
PID 1684 wrote to memory of 1356	1684	powershell.exe	regsvr32.exe
PID 1684 wrote to memory of 1356	1684	powershell.exe	regsvr32.exe
PID 1684 wrote to memory of 1356	1684	powershell.exe	regsvr32.exe
PID 1356 wrote to memory of 1232	1356	regsvr32.exe	regsvr32.exe
PID 1356 wrote to memory of 1232	1356	regsvr32.exe	regsvr32.exe
PID 1356 wrote to memory of 1232	1356	regsvr32.exe	regsvr32.exe
PID 1356 wrote to memory of 1232	1356	regsvr32.exe	regsvr32.exe
PID 1356 wrote to memory of 1232	1356	regsvr32.exe	regsvr32.exe
PID 1356 wrote to memory of 1232	1356	regsvr32.exe	regsvr32.exe
PID 1356 wrote to memory of 1232	1356	regsvr32.exe	regsvr32.exe
PID 1232 wrote to memory of 1744	1232	regsvr32.exe	explorer.exe
PID 1232 wrote to memory of 1744	1232	regsvr32.exe	explorer.exe
PID 1232 wrote to memory of 1744	1232	regsvr32.exe	explorer.exe
PID 1232 wrote to memory of 1744	1232	regsvr32.exe	explorer.exe
PID 1232 wrote to memory of 1744	1232	regsvr32.exe	explorer.exe
PID 1232 wrote to memory of 1744	1232	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\wayNewBy.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:324

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\wayNewBy.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 14:31 /tn apxplyapc /ET 14:42 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAdwBhAHkATgBlAHcAQgB5AC4AZABsAGwAIgA=" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\taskeng.exe
taskeng.exe {55001CC7-BA51-4CBE-AC48-C46DDED83E5A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAdwBhAHkATgBlAHcAQgB5AC4AZABsAGwAIgA=
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\wayNewBy.dll
3⤵
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\wayNewBy.dll
4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- Modifies data under HKEY_USERS
PID:1744

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wayNewBy.dll
Filesize
537KB

MD5
9a2bb67af0a90c70f19289c1bde3ec0f

SHA1
ab755f5be63bc573b4405bcc76803f03c14d8d9a

SHA256
62653335118bb647653455b6aba600123b00a26e2b1fb74ad422b66abba60cfe

SHA512
cc03ffb662ca094b12449321410dc567317446e27c34bf52ca0ac1c5937f98a68abf006b9656eaae7f60825d791c19b01bbf06f0c116cd54a0cc97d74b3a58ff

Download Submit
\Users\Admin\AppData\Local\Temp\wayNewBy.dll
Filesize
537KB

MD5
9a2bb67af0a90c70f19289c1bde3ec0f

SHA1
ab755f5be63bc573b4405bcc76803f03c14d8d9a

SHA256
62653335118bb647653455b6aba600123b00a26e2b1fb74ad422b66abba60cfe

SHA512
cc03ffb662ca094b12449321410dc567317446e27c34bf52ca0ac1c5937f98a68abf006b9656eaae7f60825d791c19b01bbf06f0c116cd54a0cc97d74b3a58ff

Download Submit
memory/324-54-0x000007FEFBA61000-0x000007FEFBA63000-memory.dmp

Filesize
8KB

Download
memory/1232-87-0x0000000000240000-0x0000000000262000-memory.dmp

Filesize
136KB

Download
memory/1232-83-0x0000000000240000-0x0000000000262000-memory.dmp

Filesize
136KB

Download
memory/1232-81-0x0000000000240000-0x0000000000262000-memory.dmp

Filesize
136KB

Download
memory/1232-76-0x0000000000000000-mapping.dmp

Download
memory/1356-72-0x0000000000000000-mapping.dmp

Download
memory/1684-69-0x000007FEF3F70000-0x000007FEF4993000-memory.dmp

Filesize
10.1MB

Download
memory/1684-75-0x000000000112B000-0x000000000114A000-memory.dmp

Filesize
124KB

Download
memory/1684-78-0x000000000112B000-0x000000000114A000-memory.dmp

Filesize
124KB

Download
memory/1684-67-0x0000000000000000-mapping.dmp

Download
memory/1684-77-0x0000000001124000-0x0000000001127000-memory.dmp

Filesize
12KB

Download
memory/1684-70-0x000007FEF3410000-0x000007FEF3F6D000-memory.dmp

Filesize
11.4MB

Download
memory/1684-71-0x0000000001124000-0x0000000001127000-memory.dmp

Filesize
12KB

Download
memory/1744-84-0x0000000000000000-mapping.dmp

Download
memory/1744-88-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1816-63-0x00000000001D0000-0x00000000001F2000-memory.dmp

Filesize
136KB

Download
memory/1816-59-0x00000000001D0000-0x00000000001F2000-memory.dmp

Filesize
136KB

Download
memory/1816-57-0x00000000001D0000-0x00000000001F2000-memory.dmp

Filesize
136KB

Download
memory/1816-56-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/1816-55-0x0000000000000000-mapping.dmp

Download
memory/2008-65-0x0000000000000000-mapping.dmp

Download
memory/2016-62-0x00000000743D1000-0x00000000743D3000-memory.dmp

Filesize
8KB

Download
memory/2016-60-0x0000000000000000-mapping.dmp

Download
memory/2016-64-0x00000000000C0000-0x00000000000E2000-memory.dmp

Filesize
136KB

Download
memory/2016-66-0x00000000000C0000-0x00000000000E2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads