qakbot | 2644c5fcc66cd9ea02d47d84d137d5dac00aef6184bab8ae91ea3d5fc789573b

General

Target

5514720759761290.ocx.dll
Size

2.3MB
MD5

b51abd1701b4854418d170d52dc17070
SHA1

5bb1ea7f89bbe7461b0b24944042dbdacdea04a7
SHA256

2644c5fcc66cd9ea02d47d84d137d5dac00aef6184bab8ae91ea3d5fc789573b
SHA512

bd8a949dd87b90054223cbcc279076932764db07c4ee711c233834660dfee7f741d1486f0fe2fb61ae8b94df275bd6b36af98da6ffa01ef93ad20c0adde7871d

Score

10^/10

qakbot obama150 1640256791 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama150

Campaign

1640256791

C2

96.21.251.127:2222

70.51.134.181:2222

69.14.172.24:443

186.64.87.213:443

94.62.161.77:995

103.139.242.30:990

114.79.148.170:443

217.164.247.241:2222

178.153.86.181:443

136.232.34.70:443

37.210.226.125:61202

173.21.10.71:2222

31.219.154.176:32101

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

106.51.48.170:50001

114.38.161.124:995

96.37.113.36:993

190.39.205.165:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1548 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1208 schtasks.exe

pid	process
1548	regsvr32.exe

pid	process
1208	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wxglwoqdfvlw\cfed60ba = 77f881973843cea089298e1456a6105c49c2a026a901111687f45624789e830821a242728512d71aba2b3d66fc2eba0caed7c37eb3b8c87b2b73646a4492ebd28eb012b004e65da29d9ffd3e6c3975096d85286e26	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wxglwoqdfvlw\775107df = 92bf62673bad233d0b4e73a562669f0e833792ce6a8951f6fe5f20c6f87992fbf728d7a9ac7f96a5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wxglwoqdfvlw\a594855 = 54ec6ae4b2290dea1e27dedee8b13f3e943cc4380a78425f6975b5c4d76b555df26b55a424400d45e72257f93c8897c60b90969f5d25d1db8c196e23727b5848317fab1b16127d291dd62daae28ee421806f3c90b87c0c85	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wxglwoqdfvlw\b2e52f30 = 991f3998c19bdc93c1ac1500f31d256c8fa2e26fc9bfc065fd54d893048971e0b179406adf26635cebe34494210ef7415e273cae9f40f4d2277da3997ead481e61ffdab9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wxglwoqdfvlw\751027a3 = fbdb742722d2abd29cdafb1bc8a64a0d0cb79e5fd69d031a486edefc72d2d0f658c01e7fbf18d83eb1c2d583f558c4f610e4c30129ebcc51771f2c8644472fe480404a40d38913758d697130196170bc6000eb558b06a1a0c2f7c44207f36d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wxglwoqdfvlw\877aff7e = 97278a862ba3b12594d6a1f7c9784bd211ddb09e80becf2d7f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wxglwoqdfvlw\f8339088 = 6c09c5bd712183b1ecbb175ef7c52713c7715c7f63a363924d6895c95d415b9af7da0771ae14f8e767bbaed8cc8e3526e23da65ec4d1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wxglwoqdfvlw\cdac40c6 = 569084d28370c28a37cf2544c189728f1c6d9d0c5994987d630b8eada2d9548323bb1f7cbbe4e50cd5e4421032ada4a3fb2f1362017f3267d2b64bfd5c887f0bf449f7c12ac42baa23e900fb73c8a33c86460bf269724e275ec99cb2494866bde657ea094a1eeec059b44439a28560b48f8c46d3d5c99bfa625e8b56e223051ef1b23d926bd6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wxglwoqdfvlw\f8339088 = 6c09d2bd7121b6606e98e74fb41de2ca6983c17d73d4e47fafd931f82eeb90bdaf2f9b2a0a44deacdd1a4296f75baa48b1cdf7f4f6bc936ab7176a713ba7e11826db8ef11b01171afb086b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wxglwoqdfvlw	explorer.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1396	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1396 regsvr32.exe
1548 regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1696 wrote to memory of 1396	1696	regsvr32.exe	regsvr32.exe
PID 1696 wrote to memory of 1396	1696	regsvr32.exe	regsvr32.exe
PID 1696 wrote to memory of 1396	1696	regsvr32.exe	regsvr32.exe
PID 1696 wrote to memory of 1396	1696	regsvr32.exe	regsvr32.exe
PID 1696 wrote to memory of 1396	1696	regsvr32.exe	regsvr32.exe
PID 1696 wrote to memory of 1396	1696	regsvr32.exe	regsvr32.exe
PID 1696 wrote to memory of 1396	1696	regsvr32.exe	regsvr32.exe
PID 1396 wrote to memory of 1120	1396	regsvr32.exe	explorer.exe
PID 1396 wrote to memory of 1120	1396	regsvr32.exe	explorer.exe
PID 1396 wrote to memory of 1120	1396	regsvr32.exe	explorer.exe
PID 1396 wrote to memory of 1120	1396	regsvr32.exe	explorer.exe
PID 1396 wrote to memory of 1120	1396	regsvr32.exe	explorer.exe
PID 1396 wrote to memory of 1120	1396	regsvr32.exe	explorer.exe
PID 1120 wrote to memory of 1208	1120	explorer.exe	schtasks.exe
PID 1120 wrote to memory of 1208	1120	explorer.exe	schtasks.exe
PID 1120 wrote to memory of 1208	1120	explorer.exe	schtasks.exe
PID 1120 wrote to memory of 1208	1120	explorer.exe	schtasks.exe
PID 1500 wrote to memory of 844	1500	taskeng.exe	regsvr32.exe
PID 1500 wrote to memory of 844	1500	taskeng.exe	regsvr32.exe
PID 1500 wrote to memory of 844	1500	taskeng.exe	regsvr32.exe
PID 1500 wrote to memory of 844	1500	taskeng.exe	regsvr32.exe
PID 1500 wrote to memory of 844	1500	taskeng.exe	regsvr32.exe
PID 844 wrote to memory of 1548	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 1548	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 1548	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 1548	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 1548	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 1548	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 1548	844	regsvr32.exe	regsvr32.exe
PID 1548 wrote to memory of 1780	1548	regsvr32.exe	explorer.exe
PID 1548 wrote to memory of 1780	1548	regsvr32.exe	explorer.exe
PID 1548 wrote to memory of 1780	1548	regsvr32.exe	explorer.exe
PID 1548 wrote to memory of 1780	1548	regsvr32.exe	explorer.exe
PID 1548 wrote to memory of 1780	1548	regsvr32.exe	explorer.exe
PID 1548 wrote to memory of 1780	1548	regsvr32.exe	explorer.exe
PID 1780 wrote to memory of 1068	1780	explorer.exe	reg.exe
PID 1780 wrote to memory of 1068	1780	explorer.exe	reg.exe
PID 1780 wrote to memory of 1068	1780	explorer.exe	reg.exe
PID 1780 wrote to memory of 1068	1780	explorer.exe	reg.exe
PID 1780 wrote to memory of 1956	1780	explorer.exe	reg.exe
PID 1780 wrote to memory of 1956	1780	explorer.exe	reg.exe
PID 1780 wrote to memory of 1956	1780	explorer.exe	reg.exe
PID 1780 wrote to memory of 1956	1780	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5514720759761290.ocx.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\5514720759761290.ocx.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn erbayvk /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\5514720759761290.ocx.dll\"" /SC ONCE /Z /ST 18:05 /ET 18:17
4⤵
- Creates scheduled task(s)
PID:1208

C:\Windows\system32\taskeng.exe
taskeng.exe {4D013B54-B671-4EAF-8373-EDEC1402B837} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\5514720759761290.ocx.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\5514720759761290.ocx.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Wyycd" /d "0"
5⤵
PID:1068

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Miziiq" /d "0"
5⤵
PID:1956

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5514720759761290.ocx.dll
MD5
b51abd1701b4854418d170d52dc17070

SHA1
5bb1ea7f89bbe7461b0b24944042dbdacdea04a7

SHA256
2644c5fcc66cd9ea02d47d84d137d5dac00aef6184bab8ae91ea3d5fc789573b

SHA512
bd8a949dd87b90054223cbcc279076932764db07c4ee711c233834660dfee7f741d1486f0fe2fb61ae8b94df275bd6b36af98da6ffa01ef93ad20c0adde7871d

Download Submit
\Users\Admin\AppData\Local\Temp\5514720759761290.ocx.dll
MD5
b51abd1701b4854418d170d52dc17070

SHA1
5bb1ea7f89bbe7461b0b24944042dbdacdea04a7

SHA256
2644c5fcc66cd9ea02d47d84d137d5dac00aef6184bab8ae91ea3d5fc789573b

SHA512
bd8a949dd87b90054223cbcc279076932764db07c4ee711c233834660dfee7f741d1486f0fe2fb61ae8b94df275bd6b36af98da6ffa01ef93ad20c0adde7871d

Download Submit
memory/844-67-0x0000000000000000-mapping.dmp

Download
memory/1068-82-0x0000000000000000-mapping.dmp

Download
memory/1120-62-0x0000000000000000-mapping.dmp

Download
memory/1120-66-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1120-64-0x0000000074851000-0x0000000074853000-memory.dmp

Filesize
8KB

Download
memory/1120-61-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/1208-65-0x0000000000000000-mapping.dmp

Download
memory/1396-58-0x00000000001B0000-0x0000000000230000-memory.dmp

Filesize
512KB

Download
memory/1396-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1396-54-0x0000000000000000-mapping.dmp

Download
memory/1396-59-0x0000000002370000-0x00000000024F0000-memory.dmp

Filesize
1.5MB

Download
memory/1396-57-0x00000000001B0000-0x0000000000230000-memory.dmp

Filesize
512KB

Download
memory/1396-56-0x0000000002010000-0x000000000226A000-memory.dmp

Filesize
2.4MB

Download
memory/1396-60-0x0000000002010000-0x000000000226A000-memory.dmp

Filesize
2.4MB

Download
memory/1548-75-0x00000000002D0000-0x000000000034B000-memory.dmp

Filesize
492KB

Download
memory/1548-73-0x0000000000A90000-0x0000000000CEA000-memory.dmp

Filesize
2.4MB

Download
memory/1548-70-0x0000000000000000-mapping.dmp

Download
memory/1548-74-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1548-76-0x0000000000EB0000-0x0000000001030000-memory.dmp

Filesize
1.5MB

Download
memory/1548-77-0x0000000000A90000-0x0000000000CEA000-memory.dmp

Filesize
2.4MB

Download
memory/1696-53-0x000007FEFC081000-0x000007FEFC083000-memory.dmp

Filesize
8KB

Download
memory/1780-79-0x0000000000000000-mapping.dmp

Download
memory/1780-84-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1956-83-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads