QakBot IOC's 6/11/20

QAKBOT IOCs 6/11/2020
*********************

File Writes
************

%TEMP%\dasfdsfsdf.exe - 736330AAA3A4683D3CC866153510763351A60062A236D22B12F4FE0F10853582
%TEMP%\PicturesViewer.dll - b514db7aeac55469b010812c04c3f817de2c5ae6120f3da9800de76b6e74dcf5
Compiled Created Thursday 11 June 2020, 13.28.00
AppData\Roaming\Ecry\qeuxig.dll


Execution Tree
**************
WScript.exe <Qakbot.vbs> -> Rundll32.exe %TEMP%\PicturesViewer.dll, DllRegisterServer -> MSIExec.exe Injection into Explorer.exe

Commands Run by C2
******************

%TEMP%\dasfdsfsdf.exe
cmd.exe /c net view /all /domain
cmd.exe /c net view /all
cmd.exe /c net config workstation
cmd.exe /c ipconfig /all


Network IOCs
*************
50.87.248[.]35:80
111.118.212[.]254:80
intervpn[.]xyz
sometechsense[.]com
xeemoquo[.]top
cccommercialcleaning.com[.]au

Get Requests
*************
sometechsense.com/wp-includes/js/tinymce/plugins/wptextpattern/tbpfdfelf/8888888.jpg

Import Names
************
GetModuleHandleW
GetProcAddress
GetStockObject
LoadLibraryA
PathToRegion
RegQueryValueExA
SetErrorMode
StrokePath
VirtualAllocEx