qakbot | 1b0e1a3708343d218c2379408d99674e7523ba6f55b69a613b6de605d8d602d4

General

Target

VDscytujyctfjkvu3.ocx.dll
Size

2.3MB
MD5

1ad7366c5b3bd3b73a594e8152dc5327
SHA1

2731f7672e14261c73d8216983e3465cccd87d16
SHA256

1b0e1a3708343d218c2379408d99674e7523ba6f55b69a613b6de605d8d602d4
SHA512

2e9fa32304bb7e377fe21862b11d76b74f2ac3b1dfcef9dddfe6a3188cf6057ccdc35237f8475555b41f55b17ddd0678e990adf9209a942c54f8b1f1b79d096c

Score

10^/10

qakbot obama150 1640256791 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama150

Campaign

1640256791

C2

96.21.251.127:2222

70.51.134.181:2222

69.14.172.24:443

186.64.87.213:443

94.62.161.77:995

103.139.242.30:990

114.79.148.170:443

217.164.247.241:2222

178.153.86.181:443

136.232.34.70:443

37.210.226.125:61202

173.21.10.71:2222

31.219.154.176:32101

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

106.51.48.170:50001

114.38.161.124:995

96.37.113.36:993

190.39.205.165:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1548 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

560 schtasks.exe

pid	process
1548	regsvr32.exe

pid	process
560	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pjpfdfoodns	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pjpfdfoodns\aae30247 = 6e5edb341e5cdeff452164134324049bea432efa7b074a2fbe78d059942b8d4461491f704e9a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pjpfdfoodns\101e455e = f4a59976e0c4bb1d89b5015471ebbf4039ddb46ce7f2871def10630afa2bd6ff900e53627bf981ef27f104781786767b4d7fabcb982d0b96d49a3cdec9c9c2d579aaddba1d82a5029ad7575d48	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pjpfdfoodns\9d3df275 = 7ad1d5a31a7e9b56af48344144f20ccf4211a8975f46f4edb32c228df3a7bdda88ead09123264208505f004556af4a9bd0c78d005bad1ee4abd5acf113f635fd8891fb8c82a406729220959a2ba12a3c0f7d2b0749c6a3f63b765256ff95161813ac9d9a618cd2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pjpfdfoodns\9d3df275 = 7ad1c2a31a7eae6f61d00b42baa29025facd46d8bb34d86f4c022e5b409cbea52b35c44de912a1d0d9ff84e4ce45988d39330fbfd24f5a4fe4a4de0e7ba5ac7c2f0233945d14ecb661003ed666c31b34d8e8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pjpfdfoodns\a8a2223b = 1cf6aa94ca1725385abdecb199272cad600f357fa18b11f36950899387374748ad499103956b48e298b2d35a6e058b97bd6fe4713dc357680b356d207f58a539b66367f0ca5d33c12d975b0494f5aac275a23360eab4f783a2578071403a74761bf1e9c1c11cbee3b7d4342b7362aa78b256c44636071d71d33467cff7e28a603bb2a447ab3a12ac58fc12d7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pjpfdfoodns\125f6522 = d1bd9ff65fc915a567c5a03adb390da8da01030b9c320429a71cad08080ff45b00ec7bb87092fad874edbf9e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pjpfdfoodns\6f572aa8 = ac5d7939a604e1a856d58e78bcd2c103a6d31cfac0a91d94de0e3faa5c4b19e860	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pjpfdfoodns\d7eb4dcd = d079be6e1c10852d72fed46b8a044fa4cf6b5ee2d6928c823ed7a7dd96a78105436e56a58f4dbc3a7516177501def239a1b18d34eb37d08519bdbae9a475155111ab6501	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pjpfdfoodns\e2749d83 = 65cbfd21466fdb07f12670a04abcc1b03df0c6c79851210f80f1e9021f7f4e08b08bc1	explorer.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1304	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe
1548	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1304 regsvr32.exe
1548 regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 948 wrote to memory of 1304	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1304	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1304	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1304	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1304	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1304	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1304	948	regsvr32.exe	regsvr32.exe
PID 1304 wrote to memory of 1560	1304	regsvr32.exe	explorer.exe
PID 1304 wrote to memory of 1560	1304	regsvr32.exe	explorer.exe
PID 1304 wrote to memory of 1560	1304	regsvr32.exe	explorer.exe
PID 1304 wrote to memory of 1560	1304	regsvr32.exe	explorer.exe
PID 1304 wrote to memory of 1560	1304	regsvr32.exe	explorer.exe
PID 1304 wrote to memory of 1560	1304	regsvr32.exe	explorer.exe
PID 1560 wrote to memory of 560	1560	explorer.exe	schtasks.exe
PID 1560 wrote to memory of 560	1560	explorer.exe	schtasks.exe
PID 1560 wrote to memory of 560	1560	explorer.exe	schtasks.exe
PID 1560 wrote to memory of 560	1560	explorer.exe	schtasks.exe
PID 1784 wrote to memory of 1632	1784	taskeng.exe	regsvr32.exe
PID 1784 wrote to memory of 1632	1784	taskeng.exe	regsvr32.exe
PID 1784 wrote to memory of 1632	1784	taskeng.exe	regsvr32.exe
PID 1784 wrote to memory of 1632	1784	taskeng.exe	regsvr32.exe
PID 1784 wrote to memory of 1632	1784	taskeng.exe	regsvr32.exe
PID 1632 wrote to memory of 1548	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1548	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1548	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1548	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1548	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1548	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1548	1632	regsvr32.exe	regsvr32.exe
PID 1548 wrote to memory of 1752	1548	regsvr32.exe	explorer.exe
PID 1548 wrote to memory of 1752	1548	regsvr32.exe	explorer.exe
PID 1548 wrote to memory of 1752	1548	regsvr32.exe	explorer.exe
PID 1548 wrote to memory of 1752	1548	regsvr32.exe	explorer.exe
PID 1548 wrote to memory of 1752	1548	regsvr32.exe	explorer.exe
PID 1548 wrote to memory of 1752	1548	regsvr32.exe	explorer.exe
PID 1752 wrote to memory of 1388	1752	explorer.exe	reg.exe
PID 1752 wrote to memory of 1388	1752	explorer.exe	reg.exe
PID 1752 wrote to memory of 1388	1752	explorer.exe	reg.exe
PID 1752 wrote to memory of 1388	1752	explorer.exe	reg.exe
PID 1752 wrote to memory of 1972	1752	explorer.exe	reg.exe
PID 1752 wrote to memory of 1972	1752	explorer.exe	reg.exe
PID 1752 wrote to memory of 1972	1752	explorer.exe	reg.exe
PID 1752 wrote to memory of 1972	1752	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu3.ocx.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu3.ocx.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ljqciyotgv /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu3.ocx.dll\"" /SC ONCE /Z /ST 16:15 /ET 16:27
4⤵
- Creates scheduled task(s)
PID:560

C:\Windows\system32\taskeng.exe
taskeng.exe {CCB268A1-D7A3-46CB-AFE2-5B1DF52AFCFF} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu3.ocx.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu3.ocx.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Opvtezanwiap" /d "0"
5⤵
PID:1388

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Malpg" /d "0"
5⤵
PID:1972

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu3.ocx.dll
MD5
1ad7366c5b3bd3b73a594e8152dc5327

SHA1
2731f7672e14261c73d8216983e3465cccd87d16

SHA256
1b0e1a3708343d218c2379408d99674e7523ba6f55b69a613b6de605d8d602d4

SHA512
2e9fa32304bb7e377fe21862b11d76b74f2ac3b1dfcef9dddfe6a3188cf6057ccdc35237f8475555b41f55b17ddd0678e990adf9209a942c54f8b1f1b79d096c

Download Submit
\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu3.ocx.dll
MD5
1ad7366c5b3bd3b73a594e8152dc5327

SHA1
2731f7672e14261c73d8216983e3465cccd87d16

SHA256
1b0e1a3708343d218c2379408d99674e7523ba6f55b69a613b6de605d8d602d4

SHA512
2e9fa32304bb7e377fe21862b11d76b74f2ac3b1dfcef9dddfe6a3188cf6057ccdc35237f8475555b41f55b17ddd0678e990adf9209a942c54f8b1f1b79d096c

Download Submit
memory/560-67-0x0000000000000000-mapping.dmp

Download
memory/948-55-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Filesize
8KB

Download
memory/1304-65-0x0000000001DA0000-0x0000000001E20000-memory.dmp

Filesize
512KB

Download
memory/1304-57-0x0000000075F91000-0x0000000075F93000-memory.dmp

Filesize
8KB

Download
memory/1304-59-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1304-56-0x0000000000000000-mapping.dmp

Download
memory/1304-60-0x0000000002100000-0x000000000217B000-memory.dmp

Filesize
492KB

Download
memory/1304-64-0x0000000002C00000-0x0000000002D80000-memory.dmp

Filesize
1.5MB

Download
memory/1304-58-0x0000000001DA1000-0x0000000001EF3000-memory.dmp

Filesize
1.3MB

Download
memory/1388-82-0x0000000000000000-mapping.dmp

Download
memory/1548-84-0x0000000000E80000-0x0000000001000000-memory.dmp

Filesize
1.5MB

Download
memory/1548-77-0x0000000000890000-0x000000000090B000-memory.dmp

Filesize
492KB

Download
memory/1548-76-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1548-72-0x0000000000000000-mapping.dmp

Download
memory/1548-85-0x0000000000B20000-0x0000000000D7A000-memory.dmp

Filesize
2.4MB

Download
memory/1548-75-0x0000000000B20000-0x0000000000D7A000-memory.dmp

Filesize
2.4MB

Download
memory/1560-61-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/1560-68-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1560-66-0x00000000744F1000-0x00000000744F3000-memory.dmp

Filesize
8KB

Download
memory/1560-62-0x0000000000000000-mapping.dmp

Download
memory/1632-69-0x0000000000000000-mapping.dmp

Download
memory/1752-79-0x0000000000000000-mapping.dmp

Download
memory/1752-86-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1972-83-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads