qakbot | 13f83d6f27eb4d6b8181cf6f7a40b9bcd13657ab7f0f4c83f78ad0408b70c167

General

Target

VDscytujyctfjkvu2.ocx.dll
Size

2.3MB
MD5

5fe03b7b159f55254f5e841967008aa5
SHA1

66fe123b0ec5c652007558b0f06ca47e354b06d1
SHA256

13f83d6f27eb4d6b8181cf6f7a40b9bcd13657ab7f0f4c83f78ad0408b70c167
SHA512

5fe4dc54c8de8e8f4b6b3313da8422c36756d1374cc46c7fedfb24c6035ab8fe0ccf8132e81410b1f6d086f42a21dab379bc603f8aaaac920ae96e4dd3113fb7

Score

10^/10

qakbot obama150 1640256791 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama150

Campaign

1640256791

C2

96.21.251.127:2222

70.51.134.181:2222

69.14.172.24:443

186.64.87.213:443

94.62.161.77:995

103.139.242.30:990

114.79.148.170:443

217.164.247.241:2222

178.153.86.181:443

136.232.34.70:443

37.210.226.125:61202

173.21.10.71:2222

31.219.154.176:32101

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

106.51.48.170:50001

114.38.161.124:995

96.37.113.36:993

190.39.205.165:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1392 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1616 schtasks.exe

pid	process
1392	regsvr32.exe

pid	process
1616	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vzpyvywi	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vzpyvywi\ef9aa685 = e94177dfb75bf8ed0d1b7f33f428fb433905f65fe2f0fdc4c52e8e52b20fd222027b35df5491e1df5391d7a37eb84507c7e96d13e36cc9cce77a5f87a93bb286e2daa688d430bb85ea35028e329dcf133a86551f23c46b766acfafc592ddd4ccaa0264bb0afd54646f9097da77fcb80f2b4749e1550279a1e44fcab5039a2b70e2ec890d90f193d01f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vzpyvywi\eddb86f9 = 5589012ba049b645d0e573bc86fbb5121734127e21ff83fe22337beeadf4cf1e674d1a27a88f3ccbd5ee95318375e2ef1405d0e698b2498ae3e834dc80295734ba2e24a2b475a3c15031aed122feffdd8bedcbae8cd852bee33bb66a070d3124733bdfbecdb3576ec82600855ca54c403b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vzpyvywi\5567e19c = a4d762e59160361b84ffd19ec4f037b4b6556a4cb0b61b74034e60bd7ef27f921f60b4876e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vzpyvywi\5726c1e0 = 8a9a08b779c9fef2819e9a999ea70600d15b63cb1057cc8ee1a8ae8ee116969f54438548733313908635760f47ba17613b343260099164f2d9969c829202272be2a37f85f1b375575184b16843dc19be1f94c1c5a24447f02a8d0f1f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vzpyvywi\a54c193d = b6bc0ffc2d48056d8eb7211163368d02d1fcc62a0e0bacdf25aa193c269cceb9fc93f50643a2e5d4fb3017d49cde8d161771c3566cf709a38bdc9505e7e6c02034bd57b53197dedac2563420eefc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vzpyvywi\da0576cb = ff6ffcc81e5300393937540f9e2a9358af27131fd27cbe33ff18fe920d638f6c9dcc29bc06846593cb256be01dc1b6feccc14918f4aa15ad5b64a8249fe0149b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vzpyvywi\286fae16 = 80c78dae58aedd3b74d405fcf03f461a14c5608f05d5e75d5a34764588fa19f984c4a69620e385564dc9d595c664	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vzpyvywi\90d3c973 = 677d0c62821c62f1b2262acdc6143f5d9027dc83eeb8a64c750d3b965167b7c26bf90f3dde35f946058bbe3db8def0579a2ae1d4f123d5ee35	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vzpyvywi\da0576cb = ff6febc81e5335fc470086260b72c03ff2e06abb723c869786c04fc5c156a7a4f548e5ccb6ca5cd89e56d42cc29b20ec5675bc0c2435475eac5c86d1bd0589d793c95eb94a1056eb9826de1cc8c5fe9d9731a16f68	explorer.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1588	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1588 regsvr32.exe
1392 regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 600 wrote to memory of 1588	600	regsvr32.exe	regsvr32.exe
PID 600 wrote to memory of 1588	600	regsvr32.exe	regsvr32.exe
PID 600 wrote to memory of 1588	600	regsvr32.exe	regsvr32.exe
PID 600 wrote to memory of 1588	600	regsvr32.exe	regsvr32.exe
PID 600 wrote to memory of 1588	600	regsvr32.exe	regsvr32.exe
PID 600 wrote to memory of 1588	600	regsvr32.exe	regsvr32.exe
PID 600 wrote to memory of 1588	600	regsvr32.exe	regsvr32.exe
PID 1588 wrote to memory of 468	1588	regsvr32.exe	explorer.exe
PID 1588 wrote to memory of 468	1588	regsvr32.exe	explorer.exe
PID 1588 wrote to memory of 468	1588	regsvr32.exe	explorer.exe
PID 1588 wrote to memory of 468	1588	regsvr32.exe	explorer.exe
PID 1588 wrote to memory of 468	1588	regsvr32.exe	explorer.exe
PID 1588 wrote to memory of 468	1588	regsvr32.exe	explorer.exe
PID 468 wrote to memory of 1616	468	explorer.exe	schtasks.exe
PID 468 wrote to memory of 1616	468	explorer.exe	schtasks.exe
PID 468 wrote to memory of 1616	468	explorer.exe	schtasks.exe
PID 468 wrote to memory of 1616	468	explorer.exe	schtasks.exe
PID 1976 wrote to memory of 1776	1976	taskeng.exe	regsvr32.exe
PID 1976 wrote to memory of 1776	1976	taskeng.exe	regsvr32.exe
PID 1976 wrote to memory of 1776	1976	taskeng.exe	regsvr32.exe
PID 1976 wrote to memory of 1776	1976	taskeng.exe	regsvr32.exe
PID 1976 wrote to memory of 1776	1976	taskeng.exe	regsvr32.exe
PID 1776 wrote to memory of 1392	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1392	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1392	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1392	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1392	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1392	1776	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1392	1776	regsvr32.exe	regsvr32.exe
PID 1392 wrote to memory of 1764	1392	regsvr32.exe	explorer.exe
PID 1392 wrote to memory of 1764	1392	regsvr32.exe	explorer.exe
PID 1392 wrote to memory of 1764	1392	regsvr32.exe	explorer.exe
PID 1392 wrote to memory of 1764	1392	regsvr32.exe	explorer.exe
PID 1392 wrote to memory of 1764	1392	regsvr32.exe	explorer.exe
PID 1392 wrote to memory of 1764	1392	regsvr32.exe	explorer.exe
PID 1764 wrote to memory of 2036	1764	explorer.exe	reg.exe
PID 1764 wrote to memory of 2036	1764	explorer.exe	reg.exe
PID 1764 wrote to memory of 2036	1764	explorer.exe	reg.exe
PID 1764 wrote to memory of 2036	1764	explorer.exe	reg.exe
PID 1764 wrote to memory of 2028	1764	explorer.exe	reg.exe
PID 1764 wrote to memory of 2028	1764	explorer.exe	reg.exe
PID 1764 wrote to memory of 2028	1764	explorer.exe	reg.exe
PID 1764 wrote to memory of 2028	1764	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu2.ocx.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:600

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu2.ocx.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:468

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ecoyjacj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu2.ocx.dll\"" /SC ONCE /Z /ST 15:15 /ET 15:27
4⤵
- Creates scheduled task(s)
PID:1616

C:\Windows\system32\taskeng.exe
taskeng.exe {6368F6E2-4BF3-49D2-AE98-5064DFAAEFD8} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu2.ocx.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu2.ocx.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Xiskeuanuioj" /d "0"
5⤵
PID:2036

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Juycksjreyue" /d "0"
5⤵
PID:2028

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu2.ocx.dll
MD5
5fe03b7b159f55254f5e841967008aa5

SHA1
66fe123b0ec5c652007558b0f06ca47e354b06d1

SHA256
13f83d6f27eb4d6b8181cf6f7a40b9bcd13657ab7f0f4c83f78ad0408b70c167

SHA512
5fe4dc54c8de8e8f4b6b3313da8422c36756d1374cc46c7fedfb24c6035ab8fe0ccf8132e81410b1f6d086f42a21dab379bc603f8aaaac920ae96e4dd3113fb7

Download Submit
\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu2.ocx.dll
MD5
5fe03b7b159f55254f5e841967008aa5

SHA1
66fe123b0ec5c652007558b0f06ca47e354b06d1

SHA256
13f83d6f27eb4d6b8181cf6f7a40b9bcd13657ab7f0f4c83f78ad0408b70c167

SHA512
5fe4dc54c8de8e8f4b6b3313da8422c36756d1374cc46c7fedfb24c6035ab8fe0ccf8132e81410b1f6d086f42a21dab379bc603f8aaaac920ae96e4dd3113fb7

Download Submit
memory/468-62-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/468-67-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/468-65-0x00000000743E1000-0x00000000743E3000-memory.dmp

Filesize
8KB

Download
memory/468-63-0x0000000000000000-mapping.dmp

Download
memory/600-54-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp

Filesize
8KB

Download
memory/1392-76-0x0000000000340000-0x00000000003BB000-memory.dmp

Filesize
492KB

Download
memory/1392-71-0x0000000000000000-mapping.dmp

Download
memory/1392-77-0x0000000000CF0000-0x0000000000E70000-memory.dmp

Filesize
1.5MB

Download
memory/1392-78-0x0000000000990000-0x0000000000BEA000-memory.dmp

Filesize
2.4MB

Download
memory/1392-75-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1392-74-0x0000000000990000-0x0000000000BEA000-memory.dmp

Filesize
2.4MB

Download
memory/1588-58-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1588-57-0x0000000000AB0000-0x0000000000D0A000-memory.dmp

Filesize
2.4MB

Download
memory/1588-56-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1588-61-0x0000000000AB0000-0x0000000000D0A000-memory.dmp

Filesize
2.4MB

Download
memory/1588-55-0x0000000000000000-mapping.dmp

Download
memory/1588-60-0x0000000002380000-0x0000000002500000-memory.dmp

Filesize
1.5MB

Download
memory/1588-59-0x0000000000220000-0x00000000002A0000-memory.dmp

Filesize
512KB

Download
memory/1616-66-0x0000000000000000-mapping.dmp

Download
memory/1764-80-0x0000000000000000-mapping.dmp

Download
memory/1764-85-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1776-68-0x0000000000000000-mapping.dmp

Download
memory/2028-84-0x0000000000000000-mapping.dmp

Download
memory/2036-83-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads