qakbot | a468327ee5c173269fec06282bdc618a10f5770112147280fae282659d65ac44

Analysis

max time kernel
146s
max time network
149s
platform
windows10_x64
resource
win10v200430
submitted
24/05/2020, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kaufvertrag_335774592927_20052020.vbs
Size 36.2MB
Sample200524-vdjbk14fbx
SHA256 a468327ee5c173269fec06282bdc618a10f5770112147280fae282659d65ac44
MD5 e4c51a265a25b187d92ce90b381aff5f
SHA1 b95bb9ca726d717703880c340f7a5c3c3f5e7bed
SHA512 de7ef4026401a3c371e58e3c40e63ed18adec9273a6c88e955eb32570e844f0b0cb640fd274eae0a485474f244ea1990cfd16bc47688e380a45015a81bc2e33c
MD5 SHA1 SHA512

Score

10^/10

trojan banker stealer qakbot

Malware Config

Extracted

Family

qakbot

Botnet

spx124

Campaign

1590052330

188.173.185.139:443
117.241.53.130:443
81.103.144.77:443
217.219.50.172:990
103.76.160.110:443
68.204.164.222:443
98.32.60.217:443
173.245.152.231:443
72.240.245.253:443
112.171.126.153:443
141.85.114.172:443
31.5.189.71:443
71.77.231.251:443
72.190.101.70:443
140.82.21.191:443
31.5.41.52:443
78.188.109.130:443
70.124.29.226:443
24.43.22.220:993
101.108.114.66:443
137.103.143.124:443
203.213.104.25:995
182.56.134.44:995
24.201.79.208:2078
24.110.96.149:443
98.222.23.221:443
50.104.186.71:443
67.83.54.76:2222
104.36.135.227:443
68.1.171.93:443
24.43.22.220:995
75.183.171.155:3389
47.41.3.40:443
68.98.142.248:995
81.133.234.36:2222
98.121.187.78:443
47.205.231.60:443
66.26.160.37:443
69.92.54.95:995
67.209.195.198:3389
41.228.231.93:443
184.98.104.7:995
72.204.242.138:6881
210.61.141.92:443
35.142.12.163:2222
24.46.40.189:2222
96.56.237.174:993
189.231.179.154:443
98.115.138.61:443
50.29.166.232:995
173.79.220.156:443
70.174.3.241:443
47.146.169.85:443
50.29.181.193:995
216.110.249.252:2222
76.117.227.153:443
98.118.156.172:443
70.173.46.139:443
79.114.195.15:443
75.110.250.89:443
50.96.232.242:995
203.106.194.13:443
47.232.26.181:443
47.180.66.10:443
71.8.33.238:443
71.241.247.189:443
71.80.66.107:443
207.255.161.8:2222
173.173.68.41:443
116.202.36.62:21
68.46.142.48:443
100.40.48.96:443
47.136.224.60:443
98.173.34.212:995
197.37.177.211:993
185.145.113.249:443
95.77.223.148:443
72.204.242.138:20
68.60.221.169:465
72.204.242.138:2087
72.69.180.183:61202
68.4.137.211:443
72.204.242.138:53
59.124.10.133:443
171.97.10.201:2222
188.214.99.182:995
102.190.173.155:6881
108.58.9.238:443
188.173.214.88:443
66.76.255.133:2078
41.129.128.231:443
5.15.237.243:443
50.244.112.10:443
72.204.242.138:443
72.204.242.138:2078
72.204.242.138:990
102.41.118.44:995
47.153.115.154:443
68.149.64.58:2222
207.255.161.8:995
207.255.161.8:2078
73.76.47.127:443
76.187.97.98:2222
5.14.251.226:443
65.116.179.83:443
96.35.170.82:2222
84.117.60.157:443
108.58.9.238:993
207.255.161.8:2087
142.129.227.86:443
37.8.32.154:443
24.96.22.21:443
207.255.161.8:32102
1.40.42.4:443
108.58.9.238:995
74.33.69.208:443
66.222.88.126:995
47.152.210.233:443
24.99.180.247:443
50.244.112.106:443
172.242.156.50:443
67.131.59.17:443
24.10.42.174:443
190.198.125.194:2078
49.191.9.180:995
41.96.210.164:443
50.247.230.33:995
76.170.77.99:443
70.183.127.6:995
66.68.22.151:443
97.127.144.203:2222
137.99.224.198:443
209.182.121.133:2222
50.78.93.74:443
72.204.242.138:50003
79.101.206.85:995
24.122.228.88:443
24.213.191.38:0
50.246.229.50:443
203.33.139.134:443
75.137.60.81:443
207.255.161.8:443
24.229.245.124:995
24.43.22.220:443
172.78.87.180:443
67.0.73.239:443
79.116.237.126:443
47.155.19.205:443
75.81.25.223:443
31.5.21.66:443

Signatures

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	wrilecp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	PicturesViewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	PicturesViewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	PicturesViewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	wrilecp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	wrilecp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	wrilecp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	PicturesViewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	PicturesViewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	PicturesViewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	wrilecp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	wrilecp.exe

Blacklisted process makes network request 1 IoCs

flow	pid	Process
4	3656	WScript.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 3904	3656	WScript.exe	73
PID 3656 wrote to memory of 3904	3656	WScript.exe	73
PID 3656 wrote to memory of 3904	3656	WScript.exe	73
PID 3904 wrote to memory of 3388	3904	PicturesViewer.exe	74
PID 3904 wrote to memory of 3388	3904	PicturesViewer.exe	74
PID 3904 wrote to memory of 3388	3904	PicturesViewer.exe	74
PID 3904 wrote to memory of 4092	3904	PicturesViewer.exe	75
PID 3904 wrote to memory of 4092	3904	PicturesViewer.exe	75
PID 3904 wrote to memory of 4092	3904	PicturesViewer.exe	75
PID 3904 wrote to memory of 3896	3904	PicturesViewer.exe	76
PID 3904 wrote to memory of 3896	3904	PicturesViewer.exe	76
PID 3904 wrote to memory of 3896	3904	PicturesViewer.exe	76
PID 4092 wrote to memory of 1756	4092	wrilecp.exe	78
PID 4092 wrote to memory of 1756	4092	wrilecp.exe	78
PID 4092 wrote to memory of 1756	4092	wrilecp.exe	78
PID 4092 wrote to memory of 3436	4092	wrilecp.exe	79
PID 4092 wrote to memory of 3436	4092	wrilecp.exe	79
PID 4092 wrote to memory of 3436	4092	wrilecp.exe	79
PID 4092 wrote to memory of 3436	4092	wrilecp.exe	79

Executes dropped EXE 4 IoCs

pid	Process
3904	PicturesViewer.exe
3388	PicturesViewer.exe
4092	wrilecp.exe
1756	wrilecp.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3904	PicturesViewer.exe
3904	PicturesViewer.exe
3388	PicturesViewer.exe
3388	PicturesViewer.exe
3388	PicturesViewer.exe
3388	PicturesViewer.exe
4092	wrilecp.exe
4092	wrilecp.exe
1756	wrilecp.exe
1756	wrilecp.exe
1756	wrilecp.exe
1756	wrilecp.exe
3436	explorer.exe
3436	explorer.exe
3436	explorer.exe
3436	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4092	wrilecp.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3896	schtasks.exe

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Kaufvertrag_335774592927_20052020.vbs"
1⤵
- Blacklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
  C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- - C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
    C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe /C
    3⤵
    - Checks SCSI registry key(s)
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3388
- - C:\Users\Admin\AppData\Roaming\Microsoft\Lftuthm\wrilecp.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Lftuthm\wrilecp.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4092
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Lftuthm\wrilecp.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Lftuthm\wrilecp.exe /C
      4⤵
      Checks SCSI registry key(s)
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1756
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3436
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qjwmhptqx /tr "\"C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe\" /I qjwmhptqx" /SC ONCE /Z /ST 16:09 /ET 16:21
    3⤵
    - Creates scheduled task(s)
    PID:3896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-7-0x0000000002760000-0x0000000002761000-memory.dmp

Download

memory/3388-3-0x0000000002620000-0x0000000002621000-memory.dmp

Download

memory/4092-8-0x0000000002650000-0x000000000268A000-memory.dmp

Download