qakbot | 13f83d6f27eb4d6b8181cf6f7a40b9bcd13657ab7f0f4c83f78ad0408b70c167

General

Target

VDscytujyctfjkvu2.ocx.dll
Size

2.3MB
MD5

5fe03b7b159f55254f5e841967008aa5
SHA1

66fe123b0ec5c652007558b0f06ca47e354b06d1
SHA256

13f83d6f27eb4d6b8181cf6f7a40b9bcd13657ab7f0f4c83f78ad0408b70c167
SHA512

5fe4dc54c8de8e8f4b6b3313da8422c36756d1374cc46c7fedfb24c6035ab8fe0ccf8132e81410b1f6d086f42a21dab379bc603f8aaaac920ae96e4dd3113fb7

Score

10^/10

qakbot obama150 1640256791 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama150

Campaign

1640256791

C2

96.21.251.127:2222

70.51.134.181:2222

69.14.172.24:443

186.64.87.213:443

94.62.161.77:995

103.139.242.30:990

114.79.148.170:443

217.164.247.241:2222

178.153.86.181:443

136.232.34.70:443

37.210.226.125:61202

173.21.10.71:2222

31.219.154.176:32101

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

106.51.48.170:50001

114.38.161.124:995

96.37.113.36:993

190.39.205.165:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 2 IoCs

Processes:

regsvr32.exe

pid process

440 regsvr32.exe
440 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3172 schtasks.exe

pid	process
440	regsvr32.exe
440	regsvr32.exe

pid	process
3172	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uagaauadupa\8f3dc062 = 03291994952447c7a8363aef53bd6b0668b8a23cbd6f17a182e4c63e4796d89d825899eea756fbcc64d5ec828c5040a125562f5e2468aabb140e1ae118b00aac4c6d8e579ff8fdcafff4588e6a78d1096b92a524228084f7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uagaauadupa\c5eb7fda = 94ef1142f586387d61ea36f94303f516875d0bad8d7c2ef8f534b504d792cd57603c44a11f226606eb81ef989ec6893c3510880e42db11	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uagaauadupa\f074af94 = de4fb2488efb344d4b8d2e7aef5ea8a99e793c146c87818be5a2309685b11a33fd78c54ec68992526ca9fac2726119ab5fa46625e943817f4417b5291622cc341b05bd46c667e9da2f49ffe85619ec8634dded69b6df977528e6fea9e888c11ffb30eb93b266d230eb143629b5592c4b0a6dbe3074f486a365ffb56566513872b6f57bfc0d60edb3a3ecace82a6487e568	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uagaauadupa\f2358fe8 = 757c7c5375038f78319fa4b412fb7442a4cf9532cfe3e043d7abe9a52991a51d361c78f3a36d2d87ef2c7297f5e97000b93061ed5b9d68aa4e82771f688aaa930c23355a189ea063702794596f8d7cfd1524f120760b9fc5c53f1037958f901d5619ec7b86d21e00d1a3be37c4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uagaauadupa\4a89e88d = e88cc33f4876ecb89c7d6fa5e458acfe16ef5f78a2453bd64c7a7c6d16f6984a9e957a41b837	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uagaauadupa\3781a707 = 460d23aaa42d7b524f66880ad8b7fe227e59739b1151b72d3994640e1980bddd3815	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uagaauadupa\48c8c8f1 = 1b1c3ae9076ea6a02eb831d654a8e4c3c401abf1af47ad0d2308d91119722c55980674a2ddd89ec42b3030069c0d4a90044f45eeb16b45203bb97897cf756128d2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uagaauadupa\baa2102c = 9a876e6d8722b1022562a7c3af77ba995fd48ae7ca76aee7f7e8558c13755f3ad5be8a399b2cd08efaf681e8adf65bcae3ad194a3eb5cd9c272c	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uagaauadupa	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uagaauadupa\c5eb7fda = 94ef0642f5860d25262d25cdbb0daad16b789c45e5d4b6043f9bf66b8b166e53b125	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
3280	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe
440	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3280 regsvr32.exe
440 regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3672 wrote to memory of 3280	3672	regsvr32.exe	regsvr32.exe
PID 3672 wrote to memory of 3280	3672	regsvr32.exe	regsvr32.exe
PID 3672 wrote to memory of 3280	3672	regsvr32.exe	regsvr32.exe
PID 3280 wrote to memory of 872	3280	regsvr32.exe	explorer.exe
PID 3280 wrote to memory of 872	3280	regsvr32.exe	explorer.exe
PID 3280 wrote to memory of 872	3280	regsvr32.exe	explorer.exe
PID 3280 wrote to memory of 872	3280	regsvr32.exe	explorer.exe
PID 3280 wrote to memory of 872	3280	regsvr32.exe	explorer.exe
PID 872 wrote to memory of 3172	872	explorer.exe	schtasks.exe
PID 872 wrote to memory of 3172	872	explorer.exe	schtasks.exe
PID 872 wrote to memory of 3172	872	explorer.exe	schtasks.exe
PID 1244 wrote to memory of 440	1244	regsvr32.exe	regsvr32.exe
PID 1244 wrote to memory of 440	1244	regsvr32.exe	regsvr32.exe
PID 1244 wrote to memory of 440	1244	regsvr32.exe	regsvr32.exe
PID 440 wrote to memory of 3592	440	regsvr32.exe	explorer.exe
PID 440 wrote to memory of 3592	440	regsvr32.exe	explorer.exe
PID 440 wrote to memory of 3592	440	regsvr32.exe	explorer.exe
PID 440 wrote to memory of 3592	440	regsvr32.exe	explorer.exe
PID 440 wrote to memory of 3592	440	regsvr32.exe	explorer.exe
PID 3592 wrote to memory of 3228	3592	explorer.exe	reg.exe
PID 3592 wrote to memory of 3228	3592	explorer.exe	reg.exe
PID 3592 wrote to memory of 1184	3592	explorer.exe	reg.exe
PID 3592 wrote to memory of 1184	3592	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu2.ocx.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3672

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu2.ocx.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3280

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:872

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn aipupip /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu2.ocx.dll\"" /SC ONCE /Z /ST 12:04 /ET 12:16
4⤵
- Creates scheduled task(s)
PID:3172

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu2.ocx.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu2.ocx.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:440

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3592

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ijgampuloyx" /d "0"
4⤵
PID:3228

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Jfyluo" /d "0"
4⤵
PID:1184

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu2.ocx.dll
MD5
5fe03b7b159f55254f5e841967008aa5

SHA1
66fe123b0ec5c652007558b0f06ca47e354b06d1

SHA256
13f83d6f27eb4d6b8181cf6f7a40b9bcd13657ab7f0f4c83f78ad0408b70c167

SHA512
5fe4dc54c8de8e8f4b6b3313da8422c36756d1374cc46c7fedfb24c6035ab8fe0ccf8132e81410b1f6d086f42a21dab379bc603f8aaaac920ae96e4dd3113fb7

Download Submit
\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu2.ocx.dll
MD5
5fe03b7b159f55254f5e841967008aa5

SHA1
66fe123b0ec5c652007558b0f06ca47e354b06d1

SHA256
13f83d6f27eb4d6b8181cf6f7a40b9bcd13657ab7f0f4c83f78ad0408b70c167

SHA512
5fe4dc54c8de8e8f4b6b3313da8422c36756d1374cc46c7fedfb24c6035ab8fe0ccf8132e81410b1f6d086f42a21dab379bc603f8aaaac920ae96e4dd3113fb7

Download Submit
\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu2.ocx.dll
MD5
5fe03b7b159f55254f5e841967008aa5

SHA1
66fe123b0ec5c652007558b0f06ca47e354b06d1

SHA256
13f83d6f27eb4d6b8181cf6f7a40b9bcd13657ab7f0f4c83f78ad0408b70c167

SHA512
5fe4dc54c8de8e8f4b6b3313da8422c36756d1374cc46c7fedfb24c6035ab8fe0ccf8132e81410b1f6d086f42a21dab379bc603f8aaaac920ae96e4dd3113fb7

Download Submit
memory/440-136-0x0000000000AE0000-0x0000000000D3A000-memory.dmp

Filesize
2.4MB

Download
memory/440-128-0x0000000000000000-mapping.dmp

Download
memory/440-134-0x0000000000E80000-0x0000000000EFB000-memory.dmp

Filesize
492KB

Download
memory/440-135-0x0000000002F80000-0x000000000310E000-memory.dmp

Filesize
1.6MB

Download
memory/440-133-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/440-132-0x0000000000AE1000-0x0000000000C33000-memory.dmp

Filesize
1.3MB

Download
memory/440-131-0x0000000000AE0000-0x0000000000D3A000-memory.dmp

Filesize
2.4MB

Download
memory/872-125-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/872-122-0x0000000000000000-mapping.dmp

Download
memory/872-126-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Filesize
132KB

Download
memory/872-124-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1184-139-0x0000000000000000-mapping.dmp

Download
memory/3172-123-0x0000000000000000-mapping.dmp

Download
memory/3228-138-0x0000000000000000-mapping.dmp

Download
memory/3280-116-0x0000000000BA0000-0x0000000000DFA000-memory.dmp

Filesize
2.4MB

Download
memory/3280-117-0x0000000000BA1000-0x0000000000CF3000-memory.dmp

Filesize
1.3MB

Download
memory/3280-121-0x0000000004380000-0x000000000458E000-memory.dmp

Filesize
2.1MB

Download
memory/3280-120-0x0000000000BA0000-0x0000000000DFA000-memory.dmp

Filesize
2.4MB

Download
memory/3280-115-0x0000000000000000-mapping.dmp

Download
memory/3280-119-0x0000000004380000-0x000000000458E000-memory.dmp

Filesize
2.1MB

Download
memory/3280-118-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/3592-137-0x0000000000000000-mapping.dmp

Download
memory/3592-140-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/3592-141-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/3592-142-0x0000000000B70000-0x0000000000B91000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads