qakbot | a468327ee5c173269fec06282bdc618a10f5770112147280fae282659d65ac44

General

Target

Kaufvertrag_335774592927_20052020.vbs
Size

36.2MB
MD5

e4c51a265a25b187d92ce90b381aff5f
SHA1

b95bb9ca726d717703880c340f7a5c3c3f5e7bed
SHA256

a468327ee5c173269fec06282bdc618a10f5770112147280fae282659d65ac44
SHA512

de7ef4026401a3c371e58e3c40e63ed18adec9273a6c88e955eb32570e844f0b0cb640fd274eae0a485474f244ea1990cfd16bc47688e380a45015a81bc2e33c

Score

10^/10

trojan banker stealer qakbot

Malware Config

Extracted

Family

qakbot

Botnet

spx124

Campaign

1590052330

C2

188.173.185.139:443

117.241.53.130:443

81.103.144.77:443

217.219.50.172:990

103.76.160.110:443

68.204.164.222:443

98.32.60.217:443

173.245.152.231:443

72.240.245.253:443

112.171.126.153:443

141.85.114.172:443

31.5.189.71:443

71.77.231.251:443

72.190.101.70:443

140.82.21.191:443

31.5.41.52:443

78.188.109.130:443

70.124.29.226:443

24.43.22.220:993

101.108.114.66:443

Signatures

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

wrilecp.exePicturesViewer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	wrilecp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	PicturesViewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	PicturesViewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	PicturesViewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	wrilecp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	wrilecp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	wrilecp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	PicturesViewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	PicturesViewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	PicturesViewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	wrilecp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	wrilecp.exe

Blacklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

4 3656 WScript.exe

flow	pid	process
4	3656	WScript.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

WScript.exePicturesViewer.exewrilecp.exe

description	pid	process	target process
PID 3656 wrote to memory of 3904	3656	WScript.exe	PicturesViewer.exe
PID 3656 wrote to memory of 3904	3656	WScript.exe	PicturesViewer.exe
PID 3656 wrote to memory of 3904	3656	WScript.exe	PicturesViewer.exe
PID 3904 wrote to memory of 3388	3904	PicturesViewer.exe	PicturesViewer.exe
PID 3904 wrote to memory of 3388	3904	PicturesViewer.exe	PicturesViewer.exe
PID 3904 wrote to memory of 3388	3904	PicturesViewer.exe	PicturesViewer.exe
PID 3904 wrote to memory of 4092	3904	PicturesViewer.exe	wrilecp.exe
PID 3904 wrote to memory of 4092	3904	PicturesViewer.exe	wrilecp.exe
PID 3904 wrote to memory of 4092	3904	PicturesViewer.exe	wrilecp.exe
PID 3904 wrote to memory of 3896	3904	PicturesViewer.exe	schtasks.exe
PID 3904 wrote to memory of 3896	3904	PicturesViewer.exe	schtasks.exe
PID 3904 wrote to memory of 3896	3904	PicturesViewer.exe	schtasks.exe
PID 4092 wrote to memory of 1756	4092	wrilecp.exe	wrilecp.exe
PID 4092 wrote to memory of 1756	4092	wrilecp.exe	wrilecp.exe
PID 4092 wrote to memory of 1756	4092	wrilecp.exe	wrilecp.exe
PID 4092 wrote to memory of 3436	4092	wrilecp.exe	explorer.exe
PID 4092 wrote to memory of 3436	4092	wrilecp.exe	explorer.exe
PID 4092 wrote to memory of 3436	4092	wrilecp.exe	explorer.exe
PID 4092 wrote to memory of 3436	4092	wrilecp.exe	explorer.exe

Executes dropped EXE 4 IoCs

Processes:

PicturesViewer.exePicturesViewer.exewrilecp.exewrilecp.exe

pid process

3904 PicturesViewer.exe
3388 PicturesViewer.exe
4092 wrilecp.exe
1756 wrilecp.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

PicturesViewer.exePicturesViewer.exewrilecp.exewrilecp.exeexplorer.exe

pid	process
3904	PicturesViewer.exe
3904	PicturesViewer.exe
3388	PicturesViewer.exe
3388	PicturesViewer.exe
3388	PicturesViewer.exe
3388	PicturesViewer.exe
4092	wrilecp.exe
4092	wrilecp.exe
1756	wrilecp.exe
1756	wrilecp.exe
1756	wrilecp.exe
1756	wrilecp.exe
3436	explorer.exe
3436	explorer.exe
3436	explorer.exe
3436	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

wrilecp.exe

pid process

4092 wrilecp.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3896 schtasks.exe
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

pid	process
4092	wrilecp.exe

pid	process
3896	schtasks.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Kaufvertrag_335774592927_20052020.vbs"
1⤵
- Blacklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
  C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- - C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
    C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe /C
    3⤵
    - Checks SCSI registry key(s)
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3388
- - C:\Users\Admin\AppData\Roaming\Microsoft\Lftuthm\wrilecp.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Lftuthm\wrilecp.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4092
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Lftuthm\wrilecp.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Lftuthm\wrilecp.exe /C
      4⤵
      Checks SCSI registry key(s)
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1756
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3436
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qjwmhptqx /tr "\"C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe\" /I qjwmhptqx" /SC ONCE /Z /ST 16:09 /ET 16:21
    3⤵
    - Creates scheduled task(s)
    PID:3896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lftuthm\wrilecp.dat

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lftuthm\wrilecp.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lftuthm\wrilecp.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lftuthm\wrilecp.exe

Download Submit
memory/1756-7-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/3388-3-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/4092-8-0x0000000002650000-0x000000000268A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads