qakbot | 1b0e1a3708343d218c2379408d99674e7523ba6f55b69a613b6de605d8d602d4

General

Target

VDscytujyctfjkvu3.ocx.dll
Size

2.3MB
MD5

1ad7366c5b3bd3b73a594e8152dc5327
SHA1

2731f7672e14261c73d8216983e3465cccd87d16
SHA256

1b0e1a3708343d218c2379408d99674e7523ba6f55b69a613b6de605d8d602d4
SHA512

2e9fa32304bb7e377fe21862b11d76b74f2ac3b1dfcef9dddfe6a3188cf6057ccdc35237f8475555b41f55b17ddd0678e990adf9209a942c54f8b1f1b79d096c

Score

10^/10

qakbot obama150 1640256791 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama150

Campaign

1640256791

C2

96.21.251.127:2222

70.51.134.181:2222

69.14.172.24:443

186.64.87.213:443

94.62.161.77:995

103.139.242.30:990

114.79.148.170:443

217.164.247.241:2222

178.153.86.181:443

136.232.34.70:443

37.210.226.125:61202

173.21.10.71:2222

31.219.154.176:32101

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

106.51.48.170:50001

114.38.161.124:995

96.37.113.36:993

190.39.205.165:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 2 IoCs

Processes:

regsvr32.exe

pid process

1028 regsvr32.exe
1028 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3340 schtasks.exe

pid	process
1028	regsvr32.exe
1028	regsvr32.exe

pid	process
3340	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bryoyqiee\cfbd8041 = 9996929f9de00fb4447691bd8069e542ea5eafed6cd454e0ad1a320a625d5c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bryoyqiee\a09a8ae = fcdeffed160be872330a1f861aac76b9dbaf31df4ffbf7f9f5b650c4a4ab0660e2b2acd90319d8e4913ea278dad8f33ddbfe347db67a1db4403776734ce6d8fc3b58c06513fd7d63b24f4f5094d965e56cf42ab588d5c9f85989324654b5ebd0df381a2cee7f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bryoyqiee\3f9678e0 = 4323aefb2c80ea3c977779ecc3ee56ec8322590795fdb1db4009263bcfd854c4c4f35eee7b593e750b5c7f311a0b228cd7f5d7363b69	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bryoyqiee	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bryoyqiee\7540c758 = 3b824c429612d9374ee79806db615d182672535400fc9439c713807807a9b1b3d3b1e19a5e9fa92f695b173fdc458639cae2c66849cca65bfceaef82cee24f2d350cb41c54fa92980846e78710897a11c9ffb73e91d3eabc902839caa6eb8c133977fda694e4018836cd88f89dad20992c3211c011f98030421e3f1ef002b6a1bfc40fe6133701e317e3247d23193fcdf79a5580a1c701ee7b188a22f995a32f21ba	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bryoyqiee\7701e724 = 5999154ee45ed43e13d55c47d810a0a257a77658343ef37fba9959e602bea8db6455c90460bc1af877d6c0d07a499907ced6ed9f611b635b5bfc99fe67843a1cfa212e16461a0d3f9ad62bc9bb99532e04e666154b4f22ce22ed	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bryoyqiee\40df1716 = f4bd072d73c205bb0a0e8405a980bde0b8cd985f21ca71d509175c5d937ae0daf7997ea63d15d27ba20aa305cde3187dde66d43c3ba8bef79ad1248b0b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bryoyqiee\40df1716 = f4bd102d73c230645581309b67db9c22089ef0a18e8e5c42cba9ee2f7b80cfa7d1867782b637a9df	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bryoyqiee\b2b5cfcb = ea888adf250dd6d429e42a0b59ac7b5ebf4ddbf74abcd4d75ce9a0b8167b5f812cb5aa03c1b6a01f8e31d77682fb3438630670c56d0f708dc0e70eb45933d966f571df67f7915eb1fa6891f37e0b15b1498ed2f0b2333fb8713cb4e9ca100b81d5b0808c52bc490e39deeca33a761a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bryoyqiee\cdfca03d = 8759c4aa8ee9f6bbe8867048b914f971f8f3aa944d4264af386993d53645f15f462aec4c293f156962a8ef4052	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2744 regsvr32.exe
1028 regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2696 wrote to memory of 2744	2696	regsvr32.exe	regsvr32.exe
PID 2696 wrote to memory of 2744	2696	regsvr32.exe	regsvr32.exe
PID 2696 wrote to memory of 2744	2696	regsvr32.exe	regsvr32.exe
PID 2744 wrote to memory of 1644	2744	regsvr32.exe	explorer.exe
PID 2744 wrote to memory of 1644	2744	regsvr32.exe	explorer.exe
PID 2744 wrote to memory of 1644	2744	regsvr32.exe	explorer.exe
PID 2744 wrote to memory of 1644	2744	regsvr32.exe	explorer.exe
PID 2744 wrote to memory of 1644	2744	regsvr32.exe	explorer.exe
PID 1644 wrote to memory of 3340	1644	explorer.exe	schtasks.exe
PID 1644 wrote to memory of 3340	1644	explorer.exe	schtasks.exe
PID 1644 wrote to memory of 3340	1644	explorer.exe	schtasks.exe
PID 788 wrote to memory of 1028	788	regsvr32.exe	regsvr32.exe
PID 788 wrote to memory of 1028	788	regsvr32.exe	regsvr32.exe
PID 788 wrote to memory of 1028	788	regsvr32.exe	regsvr32.exe
PID 1028 wrote to memory of 1340	1028	regsvr32.exe	explorer.exe
PID 1028 wrote to memory of 1340	1028	regsvr32.exe	explorer.exe
PID 1028 wrote to memory of 1340	1028	regsvr32.exe	explorer.exe
PID 1028 wrote to memory of 1340	1028	regsvr32.exe	explorer.exe
PID 1028 wrote to memory of 1340	1028	regsvr32.exe	explorer.exe
PID 1340 wrote to memory of 3980	1340	explorer.exe	reg.exe
PID 1340 wrote to memory of 3980	1340	explorer.exe	reg.exe
PID 1340 wrote to memory of 1432	1340	explorer.exe	reg.exe
PID 1340 wrote to memory of 1432	1340	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu3.ocx.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2696

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu3.ocx.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2744

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn icqtavlu /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu3.ocx.dll\"" /SC ONCE /Z /ST 15:15 /ET 15:27
4⤵
- Creates scheduled task(s)
PID:3340

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu3.ocx.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu3.ocx.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Wehlkioycy" /d "0"
4⤵
PID:3980

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Lkdcgy" /d "0"
4⤵
PID:1432

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu3.ocx.dll
MD5
1ad7366c5b3bd3b73a594e8152dc5327

SHA1
2731f7672e14261c73d8216983e3465cccd87d16

SHA256
1b0e1a3708343d218c2379408d99674e7523ba6f55b69a613b6de605d8d602d4

SHA512
2e9fa32304bb7e377fe21862b11d76b74f2ac3b1dfcef9dddfe6a3188cf6057ccdc35237f8475555b41f55b17ddd0678e990adf9209a942c54f8b1f1b79d096c

Download Submit
\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu3.ocx.dll
MD5
1ad7366c5b3bd3b73a594e8152dc5327

SHA1
2731f7672e14261c73d8216983e3465cccd87d16

SHA256
1b0e1a3708343d218c2379408d99674e7523ba6f55b69a613b6de605d8d602d4

SHA512
2e9fa32304bb7e377fe21862b11d76b74f2ac3b1dfcef9dddfe6a3188cf6057ccdc35237f8475555b41f55b17ddd0678e990adf9209a942c54f8b1f1b79d096c

Download Submit
\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu3.ocx.dll
MD5
1ad7366c5b3bd3b73a594e8152dc5327

SHA1
2731f7672e14261c73d8216983e3465cccd87d16

SHA256
1b0e1a3708343d218c2379408d99674e7523ba6f55b69a613b6de605d8d602d4

SHA512
2e9fa32304bb7e377fe21862b11d76b74f2ac3b1dfcef9dddfe6a3188cf6057ccdc35237f8475555b41f55b17ddd0678e990adf9209a942c54f8b1f1b79d096c

Download Submit
memory/1028-133-0x00000000033F0000-0x000000000357E000-memory.dmp

Filesize
1.6MB

Download
memory/1028-134-0x0000000002ED0000-0x000000000312A000-memory.dmp

Filesize
2.4MB

Download
memory/1028-132-0x0000000003370000-0x00000000033EB000-memory.dmp

Filesize
492KB

Download
memory/1028-131-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download
memory/1028-130-0x0000000002ED1000-0x0000000003023000-memory.dmp

Filesize
1.3MB

Download
memory/1028-129-0x0000000002ED0000-0x000000000312A000-memory.dmp

Filesize
2.4MB

Download
memory/1028-126-0x0000000000000000-mapping.dmp

Download
memory/1340-135-0x0000000000000000-mapping.dmp

Download
memory/1340-140-0x00000000031D0000-0x00000000031F1000-memory.dmp

Filesize
132KB

Download
memory/1340-139-0x0000000003890000-0x0000000003891000-memory.dmp

Filesize
4KB

Download
memory/1340-138-0x0000000003890000-0x0000000003891000-memory.dmp

Filesize
4KB

Download
memory/1432-137-0x0000000000000000-mapping.dmp

Download
memory/1644-123-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1644-120-0x0000000000000000-mapping.dmp

Download
memory/1644-122-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1644-124-0x0000000000840000-0x0000000000861000-memory.dmp

Filesize
132KB

Download
memory/2744-115-0x0000000000000000-mapping.dmp

Download
memory/2744-119-0x0000000000400000-0x000000000065A000-memory.dmp

Filesize
2.4MB

Download
memory/2744-118-0x0000000004F10000-0x000000000509E000-memory.dmp

Filesize
1.6MB

Download
memory/2744-116-0x0000000003200000-0x00000000032AE000-memory.dmp

Filesize
696KB

Download
memory/2744-117-0x0000000004CD0000-0x0000000004EDE000-memory.dmp

Filesize
2.1MB

Download
memory/3340-121-0x0000000000000000-mapping.dmp

Download
memory/3980-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads