Thread by @Max_Mal_

#Qakbot Infection New TTPs 🚨

[+] Deliver ISO (T1204.002)
[+] DLL Search Order Hijacking (T1574.001)🔥
[+] Regsvr32 (T1218.010)
[+] Process Hollowing (T1055.012)
[+] Discovery (TA0007)
[+] Credentials from Web Browsers (T1555.003)
[+] Data from Local System (T1005)

#Qakbot C2 server:
IP: 92.27.86[.]48
Port: 2222

Additional C2 IP:
23.111.114[.]52

#Qakbot initial exec flow #DFIR:
ISO > LNK > cmd.exe /c control.exe > e:\control.exe > regsvr32.exe msoffice32.dll > Injection

#Qakbot targets browser data (cookies and browser history) #DFIR:
esentutl.exe /r V01 /l"C:\Users\{User}\AppData\Local\Microsoft\Windows\WebCache" /s"C:\Users\{User}\AppData\Local\Microsoft\Windows\WebCache" /d"C:\Users\{User}\AppData\Local\Microsoft\Windows\WebCache"