qakbot | 7b8f2ca41b14c1eaf68fd23e82ac8b0ac6d34a820d6a16ccf310924017c5342d

General

Target

VDscytujyctfjkvu1.ocx.dll
Size

2.3MB
MD5

ab5a61357539cc40216cfe4621b41fc5
SHA1

33b00d1e32944e1919c004c0f16deaf6422d8efd
SHA256

7b8f2ca41b14c1eaf68fd23e82ac8b0ac6d34a820d6a16ccf310924017c5342d
SHA512

fc2efe47439f673acd0d564f5712f55ad5864ede9f45e515884597af501453da08447bbee6998d80771cfd12ed8770fcab57f9d74bca2660115ee5c9ee123b4c

Score

10^/10

qakbot obama150 1640256791 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama150

Campaign

1640256791

C2

96.21.251.127:2222

70.51.134.181:2222

69.14.172.24:443

186.64.87.213:443

94.62.161.77:995

103.139.242.30:990

114.79.148.170:443

217.164.247.241:2222

178.153.86.181:443

136.232.34.70:443

37.210.226.125:61202

173.21.10.71:2222

31.219.154.176:32101

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

106.51.48.170:50001

114.38.161.124:995

96.37.113.36:993

190.39.205.165:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1212 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1492 schtasks.exe

pid	process
1212	regsvr32.exe

pid	process
1492	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zeiyoahu\8e8a874c = 13936827c4f523c768fb6a124c1d6ebdfdb18431	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zeiyoahu	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zeiyoahu\3a93067 = e1f5311274c17dc7e570cde3245c71b3b42cd873d2713efe7e1b90678685dcdc168319213fad6e5707fd193ed1dd69eff3341d2227da8eeba0771a5c8bb4290805a7a8a981595cd1f5bee9c446f954b6a979fbb585f69759e3164ce5b45d00f6ad991dbabc9eea3541	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zeiyoahu\c61d1888 = fb62b0b7c31b46e50ac6c1de98e16e20a499f4de98	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zeiyoahu\7ea17fed = f646d8f11f6159e216a24f47b4428827d38fc43dbf722ff1a61d860b5490103bd7aaf04d5c140c25dd9404075df758c989892b343e459bc65f7d886ade5c79f446f9bb9f9c9bd4aa32cd2bb65159ae2147988f80ec5af8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zeiyoahu\bb155702 = 98cdb42138c1f606e0294280f69a58c4ff23ae7daf33333bef9a1fabf54a2ddd30b5b02cbbff7fcde22462b902006a180ccf980026	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zeiyoahu\7ce05f91 = 32a61f5a3752c08acb057a0fb8a885bf1d600a4b67a5d30542cb2d1679545eea3ae968b2ef64e39d17	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zeiyoahu\f1c3e8ba = 4094b9d6cbf0f7af93b491bd4166f4f8a181cc4e6fff1af32aadaaf4046c5d08d598afccb9c4f04493ebbfb21f2726570e9a52736328d3a00e1e3fc5094a5891b409bff56d58078c764f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zeiyoahu\f1c3e8ba = 4094aed6cbf0c28739058ae9a9eecaee780d9613aec9e57f5082cd7107042fc5053e1962363df149dc1061e5974e910b6fbee10954	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zeiyoahu\c45c38f4 = 95baf699e6c888fd0713685b8abfb32e6ce801d9bb4cbefb296a7226a69a5b558378dc82c1c2bb4cfc6be98f2e46192d3bc66c8fab57ac88259c70c9f7fff240fc7a1359b8ad0feadf03de098d5e8c8ff7c0d4b1353390e536198c2275226aabf210d1db5c70879399a7fc40a81d1e11d226528597ca7f7184d6f24e44444f7c8e5aedee6aeb1352e21115391c3f07ddb4caeb29ca7365e314238434855bea72	explorer.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

752 regsvr32.exe
1212 regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 944 wrote to memory of 752	944	regsvr32.exe	regsvr32.exe
PID 944 wrote to memory of 752	944	regsvr32.exe	regsvr32.exe
PID 944 wrote to memory of 752	944	regsvr32.exe	regsvr32.exe
PID 944 wrote to memory of 752	944	regsvr32.exe	regsvr32.exe
PID 944 wrote to memory of 752	944	regsvr32.exe	regsvr32.exe
PID 944 wrote to memory of 752	944	regsvr32.exe	regsvr32.exe
PID 944 wrote to memory of 752	944	regsvr32.exe	regsvr32.exe
PID 752 wrote to memory of 476	752	regsvr32.exe	explorer.exe
PID 752 wrote to memory of 476	752	regsvr32.exe	explorer.exe
PID 752 wrote to memory of 476	752	regsvr32.exe	explorer.exe
PID 752 wrote to memory of 476	752	regsvr32.exe	explorer.exe
PID 752 wrote to memory of 476	752	regsvr32.exe	explorer.exe
PID 752 wrote to memory of 476	752	regsvr32.exe	explorer.exe
PID 476 wrote to memory of 1492	476	explorer.exe	schtasks.exe
PID 476 wrote to memory of 1492	476	explorer.exe	schtasks.exe
PID 476 wrote to memory of 1492	476	explorer.exe	schtasks.exe
PID 476 wrote to memory of 1492	476	explorer.exe	schtasks.exe
PID 1132 wrote to memory of 1012	1132	taskeng.exe	regsvr32.exe
PID 1132 wrote to memory of 1012	1132	taskeng.exe	regsvr32.exe
PID 1132 wrote to memory of 1012	1132	taskeng.exe	regsvr32.exe
PID 1132 wrote to memory of 1012	1132	taskeng.exe	regsvr32.exe
PID 1132 wrote to memory of 1012	1132	taskeng.exe	regsvr32.exe
PID 1012 wrote to memory of 1212	1012	regsvr32.exe	regsvr32.exe
PID 1012 wrote to memory of 1212	1012	regsvr32.exe	regsvr32.exe
PID 1012 wrote to memory of 1212	1012	regsvr32.exe	regsvr32.exe
PID 1012 wrote to memory of 1212	1012	regsvr32.exe	regsvr32.exe
PID 1012 wrote to memory of 1212	1012	regsvr32.exe	regsvr32.exe
PID 1012 wrote to memory of 1212	1012	regsvr32.exe	regsvr32.exe
PID 1012 wrote to memory of 1212	1012	regsvr32.exe	regsvr32.exe
PID 1212 wrote to memory of 1580	1212	regsvr32.exe	explorer.exe
PID 1212 wrote to memory of 1580	1212	regsvr32.exe	explorer.exe
PID 1212 wrote to memory of 1580	1212	regsvr32.exe	explorer.exe
PID 1212 wrote to memory of 1580	1212	regsvr32.exe	explorer.exe
PID 1212 wrote to memory of 1580	1212	regsvr32.exe	explorer.exe
PID 1212 wrote to memory of 1580	1212	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 1924	1580	explorer.exe	reg.exe
PID 1580 wrote to memory of 1924	1580	explorer.exe	reg.exe
PID 1580 wrote to memory of 1924	1580	explorer.exe	reg.exe
PID 1580 wrote to memory of 1924	1580	explorer.exe	reg.exe
PID 1580 wrote to memory of 1912	1580	explorer.exe	reg.exe
PID 1580 wrote to memory of 1912	1580	explorer.exe	reg.exe
PID 1580 wrote to memory of 1912	1580	explorer.exe	reg.exe
PID 1580 wrote to memory of 1912	1580	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu1.ocx.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu1.ocx.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:476

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn apemnuk /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu1.ocx.dll\"" /SC ONCE /Z /ST 15:15 /ET 15:27
4⤵
- Creates scheduled task(s)
PID:1492

C:\Windows\system32\taskeng.exe
taskeng.exe {DFAF2D6C-6178-433B-9A93-DF9FF11E97BC} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1132

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu1.ocx.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1012

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu1.ocx.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Jzpxonyzlbbv" /d "0"
5⤵
PID:1924

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ofmuyvmtab" /d "0"
5⤵
PID:1912

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu1.ocx.dll
MD5
ab5a61357539cc40216cfe4621b41fc5

SHA1
33b00d1e32944e1919c004c0f16deaf6422d8efd

SHA256
7b8f2ca41b14c1eaf68fd23e82ac8b0ac6d34a820d6a16ccf310924017c5342d

SHA512
fc2efe47439f673acd0d564f5712f55ad5864ede9f45e515884597af501453da08447bbee6998d80771cfd12ed8770fcab57f9d74bca2660115ee5c9ee123b4c

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu1.ocx.dll
MD5
ab5a61357539cc40216cfe4621b41fc5

SHA1
33b00d1e32944e1919c004c0f16deaf6422d8efd

SHA256
7b8f2ca41b14c1eaf68fd23e82ac8b0ac6d34a820d6a16ccf310924017c5342d

SHA512
fc2efe47439f673acd0d564f5712f55ad5864ede9f45e515884597af501453da08447bbee6998d80771cfd12ed8770fcab57f9d74bca2660115ee5c9ee123b4c

Download Submit
memory/476-62-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/476-67-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/476-65-0x0000000074441000-0x0000000074443000-memory.dmp

Filesize
8KB

Download
memory/476-63-0x0000000000000000-mapping.dmp

Download
memory/752-59-0x00000000002B0000-0x0000000000330000-memory.dmp

Filesize
512KB

Download
memory/752-56-0x0000000075431000-0x0000000075433000-memory.dmp

Filesize
8KB

Download
memory/752-55-0x0000000000000000-mapping.dmp

Download
memory/752-60-0x0000000002C40000-0x0000000002DC0000-memory.dmp

Filesize
1.5MB

Download
memory/752-61-0x0000000001EF0000-0x000000000214A000-memory.dmp

Filesize
2.4MB

Download
memory/752-58-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/752-57-0x0000000001EF0000-0x000000000214A000-memory.dmp

Filesize
2.4MB

Download
memory/944-54-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Filesize
8KB

Download
memory/1012-68-0x0000000000000000-mapping.dmp

Download
memory/1212-74-0x0000000000A40000-0x0000000000C9A000-memory.dmp

Filesize
2.4MB

Download
memory/1212-76-0x00000000002B0000-0x000000000032B000-memory.dmp

Filesize
492KB

Download
memory/1212-75-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1212-77-0x0000000000DC0000-0x0000000000F40000-memory.dmp

Filesize
1.5MB

Download
memory/1212-78-0x0000000000A40000-0x0000000000C9A000-memory.dmp

Filesize
2.4MB

Download
memory/1212-71-0x0000000000000000-mapping.dmp

Download
memory/1492-66-0x0000000000000000-mapping.dmp

Download
memory/1580-80-0x0000000000000000-mapping.dmp

Download
memory/1580-86-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1912-85-0x0000000000000000-mapping.dmp

Download
memory/1924-84-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads