qakbot | 7b8f2ca41b14c1eaf68fd23e82ac8b0ac6d34a820d6a16ccf310924017c5342d

General

Target

VDscytujyctfjkvu1.ocx.dll
Size

2.3MB
MD5

ab5a61357539cc40216cfe4621b41fc5
SHA1

33b00d1e32944e1919c004c0f16deaf6422d8efd
SHA256

7b8f2ca41b14c1eaf68fd23e82ac8b0ac6d34a820d6a16ccf310924017c5342d
SHA512

fc2efe47439f673acd0d564f5712f55ad5864ede9f45e515884597af501453da08447bbee6998d80771cfd12ed8770fcab57f9d74bca2660115ee5c9ee123b4c

Score

10^/10

qakbot obama150 1640256791 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama150

Campaign

1640256791

C2

96.21.251.127:2222

70.51.134.181:2222

69.14.172.24:443

186.64.87.213:443

94.62.161.77:995

103.139.242.30:990

114.79.148.170:443

217.164.247.241:2222

178.153.86.181:443

136.232.34.70:443

37.210.226.125:61202

173.21.10.71:2222

31.219.154.176:32101

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

106.51.48.170:50001

114.38.161.124:995

96.37.113.36:993

190.39.205.165:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3064 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2916 schtasks.exe

pid	process
3064	regsvr32.exe

pid	process
2916	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wuejomfdyao\e0d8c252 = f67b1dd145f7c11e9abc17736588b3ae877cdf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wuejomfdyao\256ceabd = cb892d922ca92c3ef565fc4a2d16d2d6c55e0ed150e15f125c1bcf8da77386c543830a483682d4d04a926545fbc95fcf2d74a5369f6ff2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wuejomfdyao\e299e22e = 991687dcf15f45ca78744f0adf2077af4f0b1a417b100187f02137f77d507366ec9fb87cea025bbfdf3cf29cbb7b01f511f0abaef6759eb9fae0c5e6d16042be	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wuejomfdyao\6fba5505 = 1a570dcaf6b4e27858ebc8a3592a55ec77b5ef6d42ca6216f159e19f58ae10cbc56a48bb9cb7a2a62443f81d68826f6a267172634db3dc	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wuejomfdyao	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wuejomfdyao\5a25854b = ebe1722df7b24119bc17cd3876bfaea32014ef0681e0e1bd5cc227168cd722b80ff6e8ffdfe7c1bd7265bde479899cafe9a361480db9db3f4c12ec03181b0a0e7137a0c5592ed74c2215a34c76ed6139c5dbb9a81a634068438b20982933fdf5ffc31a13a79e9314ca24f65317894313c32a7c78770f80c65112173643240ae39e96872855dcd0c33ac9c96b4d6df61b56d48fa1f5dbe9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wuejomfdyao\5864a537 = 0ea0f4a4011c3f2739cadfd175ba4b662d1b8fed90ebc6de09b1738f62b1398efb2eebaec0b1a4daf7ce6db1bb9a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wuejomfdyao\6fba5505 = 1a571acaf6b4d73e6f330420858383d8f734cdfd237f941bc4738c3917220f7d2082	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wuejomfdyao\9dd08dd8 = f32f393643dc94482f8a62563d2451030dae3679086d71b95d54fe655b82fcf6e8ac9aa315e694a0071bdcac35b480bbe43cd07ebe7fc157ea6785df693f8ec2eab7c88b4abc2a77f78b63088d7bd8b9a628780799d6c8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wuejomfdyao\10f33af3 = d18f41b64fec3a8d47dc5527ced518cf273be82f34b0bb3fe19f2df9fbd91a3bcda73ba17a065e3426d6ea92a6e672fede5ea826c5ac7b0432ff5955	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3540	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3540 regsvr32.exe
3064 regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2712 wrote to memory of 3540	2712	regsvr32.exe	regsvr32.exe
PID 2712 wrote to memory of 3540	2712	regsvr32.exe	regsvr32.exe
PID 2712 wrote to memory of 3540	2712	regsvr32.exe	regsvr32.exe
PID 3540 wrote to memory of 2204	3540	regsvr32.exe	explorer.exe
PID 3540 wrote to memory of 2204	3540	regsvr32.exe	explorer.exe
PID 3540 wrote to memory of 2204	3540	regsvr32.exe	explorer.exe
PID 3540 wrote to memory of 2204	3540	regsvr32.exe	explorer.exe
PID 3540 wrote to memory of 2204	3540	regsvr32.exe	explorer.exe
PID 2204 wrote to memory of 2916	2204	explorer.exe	schtasks.exe
PID 2204 wrote to memory of 2916	2204	explorer.exe	schtasks.exe
PID 2204 wrote to memory of 2916	2204	explorer.exe	schtasks.exe
PID 724 wrote to memory of 3064	724	regsvr32.exe	regsvr32.exe
PID 724 wrote to memory of 3064	724	regsvr32.exe	regsvr32.exe
PID 724 wrote to memory of 3064	724	regsvr32.exe	regsvr32.exe
PID 3064 wrote to memory of 2840	3064	regsvr32.exe	explorer.exe
PID 3064 wrote to memory of 2840	3064	regsvr32.exe	explorer.exe
PID 3064 wrote to memory of 2840	3064	regsvr32.exe	explorer.exe
PID 3064 wrote to memory of 2840	3064	regsvr32.exe	explorer.exe
PID 3064 wrote to memory of 2840	3064	regsvr32.exe	explorer.exe
PID 2840 wrote to memory of 320	2840	explorer.exe	reg.exe
PID 2840 wrote to memory of 320	2840	explorer.exe	reg.exe
PID 2840 wrote to memory of 1276	2840	explorer.exe	reg.exe
PID 2840 wrote to memory of 1276	2840	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu1.ocx.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2712

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu1.ocx.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3540

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2204

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn blsbirelgw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu1.ocx.dll\"" /SC ONCE /Z /ST 03:27 /ET 03:39
4⤵
- Creates scheduled task(s)
PID:2916

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu1.ocx.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:724

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu1.ocx.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2840

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Yozxz" /d "0"
4⤵
PID:320

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Kuoxejt" /d "0"
4⤵
PID:1276

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu1.ocx.dll
MD5
ab5a61357539cc40216cfe4621b41fc5

SHA1
33b00d1e32944e1919c004c0f16deaf6422d8efd

SHA256
7b8f2ca41b14c1eaf68fd23e82ac8b0ac6d34a820d6a16ccf310924017c5342d

SHA512
fc2efe47439f673acd0d564f5712f55ad5864ede9f45e515884597af501453da08447bbee6998d80771cfd12ed8770fcab57f9d74bca2660115ee5c9ee123b4c

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu1.ocx.dll
MD5
ab5a61357539cc40216cfe4621b41fc5

SHA1
33b00d1e32944e1919c004c0f16deaf6422d8efd

SHA256
7b8f2ca41b14c1eaf68fd23e82ac8b0ac6d34a820d6a16ccf310924017c5342d

SHA512
fc2efe47439f673acd0d564f5712f55ad5864ede9f45e515884597af501453da08447bbee6998d80771cfd12ed8770fcab57f9d74bca2660115ee5c9ee123b4c

Download Submit
memory/320-133-0x0000000000000000-mapping.dmp

Download
memory/1276-134-0x0000000000000000-mapping.dmp

Download
memory/2204-120-0x0000000000000000-mapping.dmp

Download
memory/2204-123-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Filesize
4KB

Download
memory/2204-124-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Filesize
4KB

Download
memory/2204-121-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Filesize
132KB

Download
memory/2840-136-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2840-137-0x0000000000450000-0x0000000000471000-memory.dmp

Filesize
132KB

Download
memory/2840-131-0x0000000000000000-mapping.dmp

Download
memory/2840-135-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/2916-122-0x0000000000000000-mapping.dmp

Download
memory/3064-126-0x0000000000000000-mapping.dmp

Download
memory/3064-129-0x0000000003500000-0x000000000357B000-memory.dmp

Filesize
492KB

Download
memory/3064-128-0x0000000002C40000-0x0000000002C41000-memory.dmp

Filesize
4KB

Download
memory/3064-130-0x0000000003580000-0x000000000370E000-memory.dmp

Filesize
1.6MB

Download
memory/3540-115-0x0000000000000000-mapping.dmp

Download
memory/3540-116-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/3540-118-0x0000000004D60000-0x0000000004F6E000-memory.dmp

Filesize
2.1MB

Download
memory/3540-117-0x0000000004D60000-0x0000000004F6E000-memory.dmp

Filesize
2.1MB

Download
memory/3540-119-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads