qakbot | 2644c5fcc66cd9ea02d47d84d137d5dac00aef6184bab8ae91ea3d5fc789573b

General

Target

5514720759761290.ocx.dll
Size

2.3MB
MD5

b51abd1701b4854418d170d52dc17070
SHA1

5bb1ea7f89bbe7461b0b24944042dbdacdea04a7
SHA256

2644c5fcc66cd9ea02d47d84d137d5dac00aef6184bab8ae91ea3d5fc789573b
SHA512

bd8a949dd87b90054223cbcc279076932764db07c4ee711c233834660dfee7f741d1486f0fe2fb61ae8b94df275bd6b36af98da6ffa01ef93ad20c0adde7871d

Score

10^/10

qakbot obama150 1640256791 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama150

Campaign

1640256791

C2

96.21.251.127:2222

70.51.134.181:2222

69.14.172.24:443

186.64.87.213:443

94.62.161.77:995

103.139.242.30:990

114.79.148.170:443

217.164.247.241:2222

178.153.86.181:443

136.232.34.70:443

37.210.226.125:61202

173.21.10.71:2222

31.219.154.176:32101

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

106.51.48.170:50001

114.38.161.124:995

96.37.113.36:993

190.39.205.165:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 2 IoCs

Processes:

regsvr32.exe

pid process

1464 regsvr32.exe
1464 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

628 schtasks.exe

pid	process
1464	regsvr32.exe
1464	regsvr32.exe

pid	process
628	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ymahbiaibfg	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ymahbiaibfg\57766ae8 = 9d045ae273c2ae8b3dfb167573938e5126c01b8727ff2e500af3b5881366619a9010e0c2a80c92bc89230783aafa14b4c1688d66decb860b960c3e3dda79bed78f8916b97f4d25ad4083dc33a62e0dc6fc70f0d6d4197df6d421038fb7fc95681e8cbe8a6812e493304249777d1fa94c58d2c31521f5668460a23f6e265304b5d58a1f02257146fd61958d0e797fc96c757c57f62519b5818c59d0b66a0e2d11944d7bac99f17086fce08f81a4ae4efe31124014	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ymahbiaibfg\55374a94 = 3de7ab17889a9e8f216c0de62e56c5df58ff662a2589ce3438220fff8d6e7762e118a940a0bbdf2c4e3aec9161e59abb05629cf31fd043c6a06411a4b978af40c495e127d5b480480c0925f3e9334948fe9d026d81928b67c9e7f34eea732a6f260e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ymahbiaibfg\ed8b2df1 = 09e8621140889acc1e9dd4e3111641b1798651dd6dfb61d0eaf26eceea4353a616aae772d6db38cd94f5f6871ed5a81b5afad8260cab575e28354a4576889d6361069ac5f4683257303ef67dd2e4b1cb8553d3a3c6baa6b49e12e07c1f34faef63f11aec5631bb1d2a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ymahbiaibfg\283f051e = c51cf7c9e286c73b7240e1ac0bc3d0fe4ab3d044ad3a7e940e9d34d2d6865d6f86dc79f4fd582146d6b9d2a3e792cf709d6ba05e8680681736472be582	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ymahbiaibfg\1da0d550 = 18571122b95adfa770aa17eff319757f6b6e14c7fe915f9836235e146fa6ad8ed2feac06819d08bc30cb1355fb686dc9c06beaee0502861c25ba0ca733fab129286de71d0cd2e9831dde8e05e0b6394cf8e43ef9dbd3384cb2e49a577096d12af250ffda17eb03da0995929ba20f1821	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ymahbiaibfg\62e9baa6 = 4deb714f0b7ca923203063cc3d5059c84c19595ecadfe5f6b6aed84c3048e048c6399b24b51e5cce987607ac481afb2012111f6ef0ce6afdbc67e1ca4c648a212048940ccecaf1a63537745607d0d015d6cc868c0fc9d7d45639c11804	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ymahbiaibfg\9083627b = 36edd1571887880cfb05fea3815a1b2ad2d51726f973fae120453cf055a00b6a61b2818afc3d54c3a9e0138c22efc4b7ea9486cfa0ccb24647621badb1d7394a15acb24b15ac2a123fd60e359b6f206cd490e2841ed9f947e7320241f524984c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ymahbiaibfg\efca0d8d = a1cc6ef182e1ad0731a5b6e0f067d559a467e1371367744a3f9b32c712b6c51bbba50ccceb06390a37082afde8a4f23bdc5452f6d03245a963ccdb3bed9dbc373816c7701dcd45efc2726f57b7c6bbf7b52991	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ymahbiaibfg\62e9baa6 = 4deb664f0b7c9cc9235d1c4275dbfc1747144c1644a9439f3b0e1ed1d3813b3bf66e950140cda9a7e0ac1aada49df7cf34d418ad22e1902618c33efb97c8e5315c540d90dd251a44569e32d77c9c68132d234c2f6b997b0155c37573b5347f7cb0dc6de0dc48bec76909aeb99c6827736a9c	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
2408	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe
1464	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2408 regsvr32.exe
1464 regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2324 wrote to memory of 2408	2324	regsvr32.exe	regsvr32.exe
PID 2324 wrote to memory of 2408	2324	regsvr32.exe	regsvr32.exe
PID 2324 wrote to memory of 2408	2324	regsvr32.exe	regsvr32.exe
PID 2408 wrote to memory of 804	2408	regsvr32.exe	explorer.exe
PID 2408 wrote to memory of 804	2408	regsvr32.exe	explorer.exe
PID 2408 wrote to memory of 804	2408	regsvr32.exe	explorer.exe
PID 2408 wrote to memory of 804	2408	regsvr32.exe	explorer.exe
PID 2408 wrote to memory of 804	2408	regsvr32.exe	explorer.exe
PID 804 wrote to memory of 628	804	explorer.exe	schtasks.exe
PID 804 wrote to memory of 628	804	explorer.exe	schtasks.exe
PID 804 wrote to memory of 628	804	explorer.exe	schtasks.exe
PID 1124 wrote to memory of 1464	1124	regsvr32.exe	regsvr32.exe
PID 1124 wrote to memory of 1464	1124	regsvr32.exe	regsvr32.exe
PID 1124 wrote to memory of 1464	1124	regsvr32.exe	regsvr32.exe
PID 1464 wrote to memory of 3676	1464	regsvr32.exe	explorer.exe
PID 1464 wrote to memory of 3676	1464	regsvr32.exe	explorer.exe
PID 1464 wrote to memory of 3676	1464	regsvr32.exe	explorer.exe
PID 1464 wrote to memory of 3676	1464	regsvr32.exe	explorer.exe
PID 1464 wrote to memory of 3676	1464	regsvr32.exe	explorer.exe
PID 3676 wrote to memory of 3344	3676	explorer.exe	reg.exe
PID 3676 wrote to memory of 3344	3676	explorer.exe	reg.exe
PID 3676 wrote to memory of 1200	3676	explorer.exe	reg.exe
PID 3676 wrote to memory of 1200	3676	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5514720759761290.ocx.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2324

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\5514720759761290.ocx.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2408

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:804

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pusvfukpzy /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\5514720759761290.ocx.dll\"" /SC ONCE /Z /ST 03:27 /ET 03:39
4⤵
- Creates scheduled task(s)
PID:628

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\5514720759761290.ocx.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\5514720759761290.ocx.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3676

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Uyeyhiui" /d "0"
4⤵
PID:3344

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ozkoervp" /d "0"
4⤵
PID:1200

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5514720759761290.ocx.dll
MD5
b51abd1701b4854418d170d52dc17070

SHA1
5bb1ea7f89bbe7461b0b24944042dbdacdea04a7

SHA256
2644c5fcc66cd9ea02d47d84d137d5dac00aef6184bab8ae91ea3d5fc789573b

SHA512
bd8a949dd87b90054223cbcc279076932764db07c4ee711c233834660dfee7f741d1486f0fe2fb61ae8b94df275bd6b36af98da6ffa01ef93ad20c0adde7871d

Download Submit
\Users\Admin\AppData\Local\Temp\5514720759761290.ocx.dll
MD5
b51abd1701b4854418d170d52dc17070

SHA1
5bb1ea7f89bbe7461b0b24944042dbdacdea04a7

SHA256
2644c5fcc66cd9ea02d47d84d137d5dac00aef6184bab8ae91ea3d5fc789573b

SHA512
bd8a949dd87b90054223cbcc279076932764db07c4ee711c233834660dfee7f741d1486f0fe2fb61ae8b94df275bd6b36af98da6ffa01ef93ad20c0adde7871d

Download Submit
\Users\Admin\AppData\Local\Temp\5514720759761290.ocx.dll
MD5
b51abd1701b4854418d170d52dc17070

SHA1
5bb1ea7f89bbe7461b0b24944042dbdacdea04a7

SHA256
2644c5fcc66cd9ea02d47d84d137d5dac00aef6184bab8ae91ea3d5fc789573b

SHA512
bd8a949dd87b90054223cbcc279076932764db07c4ee711c233834660dfee7f741d1486f0fe2fb61ae8b94df275bd6b36af98da6ffa01ef93ad20c0adde7871d

Download Submit
memory/628-122-0x0000000000000000-mapping.dmp

Download
memory/804-121-0x00000000010F0000-0x0000000001111000-memory.dmp

Filesize
132KB

Download
memory/804-123-0x0000000003820000-0x0000000003821000-memory.dmp

Filesize
4KB

Download
memory/804-124-0x0000000003820000-0x0000000003821000-memory.dmp

Filesize
4KB

Download
memory/804-120-0x0000000000000000-mapping.dmp

Download
memory/1200-137-0x0000000000000000-mapping.dmp

Download
memory/1464-131-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/1464-134-0x00000000030B0000-0x000000000330A000-memory.dmp

Filesize
2.4MB

Download
memory/1464-126-0x0000000000000000-mapping.dmp

Download
memory/1464-132-0x0000000003410000-0x000000000348B000-memory.dmp

Filesize
492KB

Download
memory/1464-133-0x0000000003490000-0x000000000361E000-memory.dmp

Filesize
1.6MB

Download
memory/1464-129-0x00000000030B0000-0x000000000330A000-memory.dmp

Filesize
2.4MB

Download
memory/1464-130-0x00000000030B1000-0x0000000003203000-memory.dmp

Filesize
1.3MB

Download
memory/2408-119-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download
memory/2408-116-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Filesize
4KB

Download
memory/2408-117-0x0000000004D40000-0x0000000004F4E000-memory.dmp

Filesize
2.1MB

Download
memory/2408-118-0x0000000004F80000-0x000000000510E000-memory.dmp

Filesize
1.6MB

Download
memory/2408-115-0x0000000000000000-mapping.dmp

Download
memory/3344-136-0x0000000000000000-mapping.dmp

Download
memory/3676-135-0x0000000000000000-mapping.dmp

Download
memory/3676-139-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/3676-138-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/3676-140-0x0000000000A70000-0x0000000000A91000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads