qakbot | 18ddf0fc108a1840296cf1ab684ecb9fac48354130746e2d8cd67e8313a25f46

Analysis

max time kernel
129s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
01/12/2020, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
26d24454af322d1d22b36518af719583.dll
Size 233KB
Sample201201-cysblenrhs
SHA256 18ddf0fc108a1840296cf1ab684ecb9fac48354130746e2d8cd67e8313a25f46
MD5 26d24454af322d1d22b36518af719583
SHA1 ce31d533625282273f0f8b310f35b72a58ba41f7
SHA512 5f68f027cc8ec92ad1e9bb9f4a386b64f19a4c3d961bbd6bae85e3c28ba6f22734a5fcecba476d4196b80f2f2128f7a4d2df3eaa65232611ca9b22512a9242c2
MD5 SHA1 SHA512

Score

10^/10

qakbot tr02 1606748059 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

tr02

Campaign

1606748059

197.45.110.165:995
86.99.134.235:2222
174.76.21.134:443
208.99.100.129:443
86.126.198.195:443
185.105.131.233:443
85.132.36.111:2222
105.198.236.101:443
2.49.219.254:22
217.165.2.92:995
67.6.54.180:443
5.193.115.251:2222
83.196.50.197:2222
89.3.198.238:443
94.141.3.242:443
73.239.229.107:995
217.165.15.245:2222
68.225.60.77:995
85.121.42.12:443
99.240.226.2:443
98.4.227.199:443
85.186.122.190:443
41.205.16.108:443
187.213.199.54:443
189.250.59.212:2222
106.51.52.111:443
2.88.53.159:995
208.93.202.41:443
151.27.89.199:443
92.137.138.52:2222
173.70.165.101:995
89.33.87.107:443
108.46.145.30:443
118.160.162.127:443
187.213.136.249:995
94.53.92.42:443
80.106.85.24:2222
197.161.154.132:443
172.87.134.226:443
79.129.121.81:995
217.133.54.140:32100
67.8.103.21:443
74.135.112.78:443
118.70.55.146:443
86.97.221.121:443
87.27.110.90:2222
72.240.200.181:2222
196.151.252.84:443
209.137.209.158:443
94.49.157.35:443
67.61.157.208:443
151.60.163.18:443
47.44.217.98:443
73.51.245.231:995
174.29.203.226:993
178.222.114.132:995
83.110.19.27:443
156.213.155.74:443
98.115.243.237:443
83.202.68.220:2222
86.162.13.35:2222
109.115.125.81:50000
189.150.40.192:2222
200.75.136.78:443
92.154.83.96:2222
72.183.129.56:443
78.182.229.145:20
80.11.5.65:2222
85.204.189.105:443
189.141.31.12:443
81.97.154.100:443
199.116.241.147:443
206.183.190.53:993
50.60.166.59:995
47.22.148.6:443
116.240.78.45:995
75.109.180.221:443
213.67.45.195:2222
73.166.10.38:995
144.202.38.185:2222
144.202.38.185:995
90.101.117.122:2222
75.136.26.147:443
120.150.218.241:995
24.55.66.125:443
80.14.22.234:2222
94.49.188.240:443
173.197.22.90:2222
76.181.122.120:443
166.62.183.139:2078
72.36.59.46:2222
108.160.123.244:443
95.77.144.238:443
79.115.171.106:2222
78.181.19.134:443
41.105.41.202:443
85.60.132.8:2087
71.126.139.251:443
80.227.5.70:443
197.86.204.38:443
172.114.116.226:995
96.20.108.17:2222
2.90.33.130:443
50.244.112.106:443
174.76.11.123:995
185.126.13.190:995
72.29.181.78:2078
86.96.87.59:2078
91.104.44.226:995
173.245.152.231:443
92.99.22.32:443
39.36.30.92:995
216.201.162.158:443
173.169.189.169:443
93.113.177.152:443
108.190.151.108:2222
188.26.243.119:443
24.201.61.153:2078
149.28.99.97:2222
45.77.193.83:443
149.28.99.97:443
81.133.234.36:2222
95.76.27.6:443
72.204.242.138:443
69.123.234.175:443
45.63.107.192:2222
45.63.107.192:995
149.28.98.196:2222
149.28.98.196:995
149.28.98.196:443
109.205.204.229:2222
47.146.39.147:443
85.105.29.218:443
50.244.112.10:995
71.182.142.63:443
50.244.112.90:443
144.139.47.206:443
92.154.83.96:1194
176.45.233.94:995
86.245.87.251:2222
73.55.254.225:443
41.228.34.92:443
2.50.2.216:443
77.27.174.49:995
72.28.255.159:995
105.96.27.117:443
24.27.82.216:2222
100.12.74.21:995
95.77.223.148:443
24.95.61.62:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

ServiceHost packer 4 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/860-9-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/860-8-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/860-10-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/860-11-0x0000000000000000-mapping.dmp	servicehost

Loads dropped DLL 1 IoCs

pid	Process
3984	regsvr32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1816	860	WerFault.exe	72
1764	3984	WerFault.exe	85

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2208	schtasks.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
860	regsvr32.exe
1816	WerFault.exe
1816	WerFault.exe
1816	WerFault.exe
1816	WerFault.exe
1816	WerFault.exe
1816	WerFault.exe
1816	WerFault.exe
1816	WerFault.exe
1816	WerFault.exe
1816	WerFault.exe
1816	WerFault.exe
1816	WerFault.exe
1816	WerFault.exe
1816	WerFault.exe
1816	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
860	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1816	WerFault.exe
Token: SeBackupPrivilege	1816	WerFault.exe
Token: SeDebugPrivilege	1816	WerFault.exe
Token: SeDebugPrivilege	1764	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 860	756	regsvr32.exe	72
PID 756 wrote to memory of 860	756	regsvr32.exe	72
PID 756 wrote to memory of 860	756	regsvr32.exe	72
PID 860 wrote to memory of 752	860	regsvr32.exe	78
PID 860 wrote to memory of 752	860	regsvr32.exe	78
PID 860 wrote to memory of 752	860	regsvr32.exe	78
PID 860 wrote to memory of 752	860	regsvr32.exe	78
PID 860 wrote to memory of 752	860	regsvr32.exe	78
PID 752 wrote to memory of 2208	752	explorer.exe	80
PID 752 wrote to memory of 2208	752	explorer.exe	80
PID 752 wrote to memory of 2208	752	explorer.exe	80
PID 732 wrote to memory of 3984	732	regsvr32.exe	85
PID 732 wrote to memory of 3984	732	regsvr32.exe	85
PID 732 wrote to memory of 3984	732	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\26d24454af322d1d22b36518af719583.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\26d24454af322d1d22b36518af719583.dll
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn amkldnbjzj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\26d24454af322d1d22b36518af719583.dll\"" /SC ONCE /Z /ST 15:58 /ET 16:10
      4⤵
      Creates scheduled task(s)
      PID:2208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 624
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1816

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\26d24454af322d1d22b36518af719583.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\26d24454af322d1d22b36518af719583.dll"
  2⤵
  - Loads dropped DLL
  PID:3984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 596
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-6-0x0000000002E00000-0x0000000002E20000-memory.dmp

Download

memory/860-3-0x0000000004B70000-0x0000000004B90000-memory.dmp

Download

memory/1764-16-0x00000000035E0000-0x00000000035E1000-memory.dmp

Download

memory/1764-18-0x0000000003D50000-0x0000000003D51000-memory.dmp

Download

memory/1816-7-0x00000000046B0000-0x00000000046B1000-memory.dmp

Download

memory/1816-12-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download