qakbot | a390df73b5c61444c493b1e5285b4067c5ac8a9a08bfeb90f5bec9e88f741ebb

General

Target

Fedex_30470_11242020.xls
Size

61KB
MD5

b1073c53d1ade04d034805f6584b2dfb
SHA1

a612eba63d014eae2f7a370b56180f46299ab6a1
SHA256

a390df73b5c61444c493b1e5285b4067c5ac8a9a08bfeb90f5bec9e88f741ebb
SHA512

91122bfff6ad1994e951321a8fc2aef9c98585acdfbae29144b26f6acf079db0a6ab38d81f2333b72a1ececaf8d142f28d193d026871fea48ae1d28a2607c581

Score

10^/10

qakbot abc101 1606331967 banker cryptone packer stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

abc101

Campaign

1606331967

C2

76.104.230.174:443

187.227.86.129:995

219.255.28.241:443

78.184.6.94:443

95.159.45.82:443

91.228.36.95:443

79.115.215.125:443

24.244.161.36:443

24.71.28.247:443

73.239.229.107:995

187.153.119.36:443

190.75.167.44:2222

83.110.111.159:443

174.76.21.134:443

75.109.180.221:443

85.122.141.42:995

156.222.6.246:995

188.24.183.193:443

88.106.237.152:2222

79.166.83.103:2222

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2208	756	regsvr32.exe	EXCEL.EXE

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

CryptOne packer 2 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

Processes:

resource	yara_rule
C:\LotWin\LotWin2\Horsew.dll	cryptone
\LotWin\LotWin2\Horsew.dll	cryptone

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

996 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2136 996 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
2136	996	WerFault.exe	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

756 EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

regsvr32.exeWerFault.exe

pid	process
996	regsvr32.exe
996	regsvr32.exe
996	regsvr32.exe
996	regsvr32.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

996 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2136 WerFault.exe
Token: SeBackupPrivilege 2136 WerFault.exe
Token: SeDebugPrivilege 2136 WerFault.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

756 EXCEL.EXE
756 EXCEL.EXE

description	pid	process
Token: SeRestorePrivilege	2136	WerFault.exe
Token: SeBackupPrivilege	2136	WerFault.exe
Token: SeDebugPrivilege	2136	WerFault.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

EXCEL.EXE

pid	process
756	EXCEL.EXE
756	EXCEL.EXE
756	EXCEL.EXE
756	EXCEL.EXE
756	EXCEL.EXE
756	EXCEL.EXE
756	EXCEL.EXE
756	EXCEL.EXE
756	EXCEL.EXE
756	EXCEL.EXE
756	EXCEL.EXE
756	EXCEL.EXE
756	EXCEL.EXE
756	EXCEL.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

EXCEL.EXEregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 756 wrote to memory of 2208	756	EXCEL.EXE	regsvr32.exe
PID 756 wrote to memory of 2208	756	EXCEL.EXE	regsvr32.exe
PID 2208 wrote to memory of 996	2208	regsvr32.exe	regsvr32.exe
PID 2208 wrote to memory of 996	2208	regsvr32.exe	regsvr32.exe
PID 2208 wrote to memory of 996	2208	regsvr32.exe	regsvr32.exe
PID 996 wrote to memory of 2704	996	regsvr32.exe	explorer.exe
PID 996 wrote to memory of 2704	996	regsvr32.exe	explorer.exe
PID 996 wrote to memory of 2704	996	regsvr32.exe	explorer.exe
PID 996 wrote to memory of 2704	996	regsvr32.exe	explorer.exe
PID 996 wrote to memory of 2704	996	regsvr32.exe	explorer.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Fedex_30470_11242020.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\SYSTEM32\regsvr32.exe
regsvr32.exe -s C:\LotWin\LotWin2\Horsew.dll
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\regsvr32.exe
-s C:\LotWin\LotWin2\Horsew.dll
3⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 760
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2136

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\LotWin\LotWin2\Horsew.dll
MD5
c216dbb8adb5f374a69dda6f30566eac

SHA1
f252ee4972f095510aafca29d9a21b7126281b20

SHA256
eb2be93487c9db618922995dfaa2674c26f0a43c3603e8a862e3e48192a64c2e

SHA512
96052a1436cd2bc18b98fc3cc53b046b7eb9d1df45a54d99387dff4b7334bbc73e2651f2fa4372772b2e4ab3859bcf057393a19e48475f4129ff504159583c1d

Download Submit
\LotWin\LotWin2\Horsew.dll
MD5
c216dbb8adb5f374a69dda6f30566eac

SHA1
f252ee4972f095510aafca29d9a21b7126281b20

SHA256
eb2be93487c9db618922995dfaa2674c26f0a43c3603e8a862e3e48192a64c2e

SHA512
96052a1436cd2bc18b98fc3cc53b046b7eb9d1df45a54d99387dff4b7334bbc73e2651f2fa4372772b2e4ab3859bcf057393a19e48475f4129ff504159583c1d

Download Submit
memory/756-2-0x00007FFFD22B0000-0x00007FFFD28E7000-memory.dmp

Filesize
6.2MB

Download
memory/996-16-0x0000000000000000-mapping.dmp

Download
memory/996-5-0x0000000000000000-mapping.dmp

Download
memory/996-7-0x0000000004620000-0x0000000004640000-memory.dmp

Filesize
128KB

Download
memory/996-17-0x0000000000000000-mapping.dmp

Download
memory/996-9-0x00000000045F0000-0x0000000004610000-memory.dmp

Filesize
128KB

Download
memory/996-15-0x0000000000000000-mapping.dmp

Download
memory/2136-14-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/2136-13-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/2136-18-0x00000000056D0000-0x00000000056D1000-memory.dmp

Filesize
4KB

Download
memory/2208-3-0x0000000000000000-mapping.dmp

Download
memory/2704-8-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads