qakbot | 1cbd5c3072fd99bff1408bc1f8a3b09206322de8b83b743a57efa24adefdb44f

General

Target

allThis.dll
Size

368KB
MD5

aaabcb8c5464c4fdb6d72816f77f3b65
SHA1

7397d48671bde4ef13ae59f3427f0c1a1e7977d4
SHA256

1cbd5c3072fd99bff1408bc1f8a3b09206322de8b83b743a57efa24adefdb44f
SHA512

c5165a9e1f8185a94256bb67cf89d035f743e461795f0444208ee116df53bec5633673527cf52727462a8c543286c2f05f74dcc16078e5a1d2689ea434876546
SSDEEP

6144:0u8T9zrStWm3C3klS1gqbe5L05kVxVFInAPexY5ixyizO8wj+A:/8ZSg24Vbe5LFVxVFIAPWelSZm

Score

10^/10

qakbot obama202 1663062752 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.858

Botnet

obama202

Campaign

1663062752

C2

99.232.140.205:2222

41.69.118.117:995

179.111.111.88:32101

37.210.148.30:995

47.146.182.110:443

191.97.234.238:995

64.207.215.69:443

88.233.194.154:2222

81.131.161.131:2078

86.98.156.176:993

200.161.62.126:32101

88.244.84.195:443

78.100.254.17:2222

85.114.99.34:443

113.170.216.154:443

194.49.79.231:443

193.3.19.37:443

84.38.133.191:443

175.110.231.67:443

191.84.204.214:995

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Extracted

Family

qakbot

Attributes

salt
�S3�t q��Ĩ:��$sNt�XtD�e��

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1120 regsvr32.exe

pid	process
1120	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1264 schtasks.exe

pid	process
1264	schtasks.exe

Modifies data under HKEY_USERS 12 IoCs

Processes:

explorer.exepowershell.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oteperulgnxiid\d63aadc = 2c92ca8c9dbded2821b762d93a14dab966bbaabcad7666d75c921bda03c040bc43ecbbcdb90e9b49e3f7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oteperulgnxiid\3abd5aee = e9416ff555a05176fa3ade1bf5890ff47d50fc34247bae53fa7529835f86c14dd28cda5d98d510e6c82c6a16af49bfa086854ea8494ff4500d0a269d5961fe44243db7	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oteperulgnxiid	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oteperulgnxiid\38fc7a92 = 9c5652c4e3218f40fd8b06ddd5f484525c90c4abdbf32316f066e0931f613281684cec2566449f1f85798dc39974d436f098c6086241fa93b8f81fdd0f1d39259aab406bd029fc5c25e41af134e649cf05933fb7c3b3957099c15498c9e967d3bc5f60adaaffc989e93c0219bfc6fe040c7a4e9a5ed44f6a41e7568e33dc49b1a2fb232765b563e8d2ae45ffc75d90bc7eaf2bc677d3f148e45aded7bc97eb60f1e6ad	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oteperulgnxiid\82013d8b = d04bf103ac78ab85448f63c911ed5c914db9bd4f622b09bc1c8550f0891b5d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oteperulgnxiid\ff097201 = 4ea81f9990f2e13c1a21474924aeae4b4b3e78eb94d8671bb175587a124f90fd9657d10b2b433896bbfe4bffa9d3e0997b74ba235c189b63ad15	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oteperulgnxiid\47b51564 = 49c750f351bbe11d85d1f57455b598a17379f0d1cbdedc833b1b40e7e51f47f5e4b57799a040d7d9fc117b53cb13bee9a4e1beaaf29d6c60715fca9fb29e65d5911295941f623bd9f28b5b1203ee054b7adf7d51e157f2077eb39413dc7981b730e1b72b502126ec4a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oteperulgnxiid\80401df7 = 9e8dbe7e4a77e58fb6d5ffcaf8064458e88108b36534203878dc021abe6cc714025852b5ef17da1a51ae361ef868cc02ff849591dcef5dca5e545f3285b89ba2d57fabe8a07e46aac54a5d30c5ce48803086735379bba1d43edf5ceff85a10def425	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = e091534269c8d801	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oteperulgnxiid\722ac52a = 18b56aa0bb6a8b02250929378a0ec91b74a0001357d765ef089fe1e6513e5ad1673216b21107cf9608625b5e2b32910c8c0e8f804e791c3b1b09411f4da382641f6b3a1b507fb310005779a5ffa2dbdc46ea16bbad5523480324f6edc3b4c62b7af69836e6689b220156	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oteperulgnxiid\d63aadc = 2c92dd8c9dbdded626067ca97a20c8d4cd6d1e81bbd071eaa3819226d72292cb91f2dced93ea2190012cbebe387fa432894185bf9962c0fb0a86496bdbb81e	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exepowershell.exeregsvr32.exe

pid	process
2032	regsvr32.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1656	powershell.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1120	regsvr32.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe
1680	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2032 regsvr32.exe
1120 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1656 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1656	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1948 wrote to memory of 2032	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 2032	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 2032	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 2032	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 2032	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 2032	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 2032	1948	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1680	2032	regsvr32.exe	explorer.exe
PID 2032 wrote to memory of 1680	2032	regsvr32.exe	explorer.exe
PID 2032 wrote to memory of 1680	2032	regsvr32.exe	explorer.exe
PID 2032 wrote to memory of 1680	2032	regsvr32.exe	explorer.exe
PID 2032 wrote to memory of 1680	2032	regsvr32.exe	explorer.exe
PID 2032 wrote to memory of 1680	2032	regsvr32.exe	explorer.exe
PID 1680 wrote to memory of 1264	1680	explorer.exe	schtasks.exe
PID 1680 wrote to memory of 1264	1680	explorer.exe	schtasks.exe
PID 1680 wrote to memory of 1264	1680	explorer.exe	schtasks.exe
PID 1680 wrote to memory of 1264	1680	explorer.exe	schtasks.exe
PID 332 wrote to memory of 1656	332	taskeng.exe	powershell.exe
PID 332 wrote to memory of 1656	332	taskeng.exe	powershell.exe
PID 332 wrote to memory of 1656	332	taskeng.exe	powershell.exe
PID 1656 wrote to memory of 636	1656	powershell.exe	regsvr32.exe
PID 1656 wrote to memory of 636	1656	powershell.exe	regsvr32.exe
PID 1656 wrote to memory of 636	1656	powershell.exe	regsvr32.exe
PID 1656 wrote to memory of 636	1656	powershell.exe	regsvr32.exe
PID 1656 wrote to memory of 636	1656	powershell.exe	regsvr32.exe
PID 636 wrote to memory of 1120	636	regsvr32.exe	regsvr32.exe
PID 636 wrote to memory of 1120	636	regsvr32.exe	regsvr32.exe
PID 636 wrote to memory of 1120	636	regsvr32.exe	regsvr32.exe
PID 636 wrote to memory of 1120	636	regsvr32.exe	regsvr32.exe
PID 636 wrote to memory of 1120	636	regsvr32.exe	regsvr32.exe
PID 636 wrote to memory of 1120	636	regsvr32.exe	regsvr32.exe
PID 636 wrote to memory of 1120	636	regsvr32.exe	regsvr32.exe
PID 1120 wrote to memory of 1404	1120	regsvr32.exe	explorer.exe
PID 1120 wrote to memory of 1404	1120	regsvr32.exe	explorer.exe
PID 1120 wrote to memory of 1404	1120	regsvr32.exe	explorer.exe
PID 1120 wrote to memory of 1404	1120	regsvr32.exe	explorer.exe
PID 1120 wrote to memory of 1404	1120	regsvr32.exe	explorer.exe
PID 1120 wrote to memory of 1404	1120	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\allThis.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\allThis.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 18:39 /tn zldgambdbe /ET 18:50 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYQBsAGwAVABoAGkAcwAuAGQAbABsACIA" /SC ONCE
4⤵
- Creates scheduled task(s)
PID:1264

C:\Windows\system32\taskeng.exe
taskeng.exe {9207E15A-AF75-48C0-A455-7CAC359BDF44} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYQBsAGwAVABoAGkAcwAuAGQAbABsACIA
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\allThis.dll
3⤵
- Suspicious use of WriteProcessMemory
PID:636

C:\Windows\SysWOW64\regsvr32.exe
C:\Users\Admin\AppData\Local\Temp\allThis.dll
4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- Modifies data under HKEY_USERS
PID:1404

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\allThis.dll
Filesize
368KB

MD5
aaabcb8c5464c4fdb6d72816f77f3b65

SHA1
7397d48671bde4ef13ae59f3427f0c1a1e7977d4

SHA256
1cbd5c3072fd99bff1408bc1f8a3b09206322de8b83b743a57efa24adefdb44f

SHA512
c5165a9e1f8185a94256bb67cf89d035f743e461795f0444208ee116df53bec5633673527cf52727462a8c543286c2f05f74dcc16078e5a1d2689ea434876546

Download Submit
\Users\Admin\AppData\Local\Temp\allThis.dll
Filesize
368KB

MD5
aaabcb8c5464c4fdb6d72816f77f3b65

SHA1
7397d48671bde4ef13ae59f3427f0c1a1e7977d4

SHA256
1cbd5c3072fd99bff1408bc1f8a3b09206322de8b83b743a57efa24adefdb44f

SHA512
c5165a9e1f8185a94256bb67cf89d035f743e461795f0444208ee116df53bec5633673527cf52727462a8c543286c2f05f74dcc16078e5a1d2689ea434876546

Download Submit
memory/636-72-0x0000000000000000-mapping.dmp

Download
memory/1120-86-0x00000000002C0000-0x00000000002E2000-memory.dmp

Filesize
136KB

Download
memory/1120-82-0x00000000002C0000-0x00000000002E2000-memory.dmp

Filesize
136KB

Download
memory/1120-80-0x00000000002C0000-0x00000000002E2000-memory.dmp

Filesize
136KB

Download
memory/1120-77-0x0000000000000000-mapping.dmp

Download
memory/1264-65-0x0000000000000000-mapping.dmp

Download
memory/1404-87-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1404-83-0x0000000000000000-mapping.dmp

Download
memory/1656-69-0x000007FEF3440000-0x000007FEF3E63000-memory.dmp

Filesize
10.1MB

Download
memory/1656-75-0x000000000134B000-0x000000000136A000-memory.dmp

Filesize
124KB

Download
memory/1656-67-0x0000000000000000-mapping.dmp

Download
memory/1656-71-0x0000000001344000-0x0000000001347000-memory.dmp

Filesize
12KB

Download
memory/1656-70-0x000007FEF28E0000-0x000007FEF343D000-memory.dmp

Filesize
11.4MB

Download
memory/1656-74-0x0000000001344000-0x0000000001347000-memory.dmp

Filesize
12KB

Download
memory/1680-66-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1680-64-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1680-63-0x00000000741C1000-0x00000000741C3000-memory.dmp

Filesize
8KB

Download
memory/1680-61-0x0000000000000000-mapping.dmp

Download
memory/1948-54-0x000007FEFB831000-0x000007FEFB833000-memory.dmp

Filesize
8KB

Download
memory/2032-60-0x0000000000170000-0x00000000001F0000-memory.dmp

Filesize
512KB

Download
memory/2032-59-0x0000000000170000-0x00000000001F0000-memory.dmp

Filesize
512KB

Download
memory/2032-57-0x0000000000180000-0x00000000001A2000-memory.dmp

Filesize
136KB

Download
memory/2032-56-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/2032-55-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads