qakbot | e604d957f6bc4ee372e7a82b7e6efc013d7766fb34cd7fd1ef91725a39214ab3

General

Target

statistics-02.01.2021.doc
Size

75KB
MD5

d96fc74b09a71eee68373613f67da85b
SHA1

affa834fcdc0e67ebf0388b4d90505b9afcd0f96
SHA256

e604d957f6bc4ee372e7a82b7e6efc013d7766fb34cd7fd1ef91725a39214ab3
SHA512

5928d99190f4fe4f7dbd5842bcfbcc820304a13b706a69fc1b5f86059d2bac9762965f67faa400a315dccaa1af2766f5907b28021ec73099707f2a17ea7bef7f

Score

10^/10

qakbot krk01 1611569149 banker ransomware stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

krk01

Campaign

1611569149

C2

31.5.21.66:995

89.3.198.238:443

202.188.138.162:443

188.24.128.253:443

175.141.219.71:443

151.60.15.183:443

184.189.122.72:443

80.227.5.70:443

140.82.49.12:443

89.211.241.100:995

81.97.154.100:443

77.27.174.49:995

92.154.83.96:2078

42.3.8.54:443

71.187.170.235:443

46.153.36.53:995

71.182.142.63:443

105.186.102.16:443

50.244.112.106:443

78.63.226.32:443

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

explorer.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1288	616	explorer.exe	WINWORD.EXE

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

30 2128 mshta.exe
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3976 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

flow	pid	process
30	2128	mshta.exe

pid	process
3976	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies registry class 1 IoCs

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings explorer.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

616 WINWORD.EXE
616 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exe

pid process

3976 regsvr32.exe
3976 regsvr32.exe
3976 regsvr32.exe
3976 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

3976 regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	explorer.exe

pid	process
3976	regsvr32.exe
3976	regsvr32.exe
3976	regsvr32.exe
3976	regsvr32.exe

pid	process
3976	regsvr32.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

WINWORD.EXE

pid	process
616	WINWORD.EXE
616	WINWORD.EXE
616	WINWORD.EXE
616	WINWORD.EXE
616	WINWORD.EXE
616	WINWORD.EXE
616	WINWORD.EXE
616	WINWORD.EXE
616	WINWORD.EXE
616	WINWORD.EXE
616	WINWORD.EXE
616	WINWORD.EXE
616	WINWORD.EXE
616	WINWORD.EXE
616	WINWORD.EXE
616	WINWORD.EXE
616	WINWORD.EXE
616	WINWORD.EXE

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

WINWORD.EXEexplorer.exemshta.exeregsvr32.exe

description	pid	process	target process
PID 616 wrote to memory of 1288	616	WINWORD.EXE	explorer.exe
PID 616 wrote to memory of 1288	616	WINWORD.EXE	explorer.exe
PID 512 wrote to memory of 2128	512	explorer.exe	mshta.exe
PID 512 wrote to memory of 2128	512	explorer.exe	mshta.exe
PID 512 wrote to memory of 2128	512	explorer.exe	mshta.exe
PID 2128 wrote to memory of 3976	2128	mshta.exe	regsvr32.exe
PID 2128 wrote to memory of 3976	2128	mshta.exe	regsvr32.exe
PID 2128 wrote to memory of 3976	2128	mshta.exe	regsvr32.exe
PID 3976 wrote to memory of 3764	3976	regsvr32.exe	explorer.exe
PID 3976 wrote to memory of 3764	3976	regsvr32.exe	explorer.exe
PID 3976 wrote to memory of 3764	3976	regsvr32.exe	explorer.exe
PID 3976 wrote to memory of 3764	3976	regsvr32.exe	explorer.exe
PID 3976 wrote to memory of 3764	3976	regsvr32.exe	explorer.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\statistics-02.01.2021.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616

C:\Windows\explorer.exe
explorer c:\programdata\avYth.hta
2⤵
- Process spawned unexpected child process
PID:1288

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:512

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\avYth.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
2⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2128

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" c:\programdata\avYth.tmp
3⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3976

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
PID:3764

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

4

T1082

Query Registry

3

T1012

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\avYth.hta
MD5
a52fa7ed528fae4b53fc8ad923b7f861

SHA1
3a7d4104a52bceb9ab110039ab144ffe7faff301

SHA256
474446f37a896729676846ae4fdb8225dec3073e38454d2844e8b3d14ff4d9c6

SHA512
407d2453df83106c899f018edb4a3819c3ffc6d72b5a382696c7738497cacb2ca4bf31001b02fda86827649d9d45057d93f79f328f605217a814cdf8f1b27efd

Download Submit
\??\c:\programdata\avYth.tmp
MD5
591029c3d7c0a071eb4ae19b04123b2b

SHA1
3bffaeff65bb52989265e9d5c823b9e3dbb253fa

SHA256
4bca5c5799463f330312cbf943069ee228a4c55fe7db6b4232820b0d9b91e84e

SHA512
7c58d3bb296a8e5fc4e49cbb6c813501a45843db2a63a27c5ded937d95ab6f10a58a1061bb414f4e0663984be8ee572aff5548cd7783d6ffe2829f29f702d33b

Download Submit
\ProgramData\avYth.tmp
MD5
591029c3d7c0a071eb4ae19b04123b2b

SHA1
3bffaeff65bb52989265e9d5c823b9e3dbb253fa

SHA256
4bca5c5799463f330312cbf943069ee228a4c55fe7db6b4232820b0d9b91e84e

SHA512
7c58d3bb296a8e5fc4e49cbb6c813501a45843db2a63a27c5ded937d95ab6f10a58a1061bb414f4e0663984be8ee572aff5548cd7783d6ffe2829f29f702d33b

Download Submit
memory/616-3-0x00007FFE498B0000-0x00007FFE498C0000-memory.dmp

Filesize
64KB

Download
memory/616-4-0x00007FFE498B0000-0x00007FFE498C0000-memory.dmp

Filesize
64KB

Download
memory/616-5-0x00007FFE68CF0000-0x00007FFE69327000-memory.dmp

Filesize
6.2MB

Download
memory/616-6-0x00007FFE498B0000-0x00007FFE498C0000-memory.dmp

Filesize
64KB

Download
memory/616-7-0x000001E7F3370000-0x000001E7F3374000-memory.dmp

Filesize
16KB

Download
memory/616-2-0x00007FFE498B0000-0x00007FFE498C0000-memory.dmp

Filesize
64KB

Download
memory/1288-8-0x0000000000000000-mapping.dmp

Download
memory/2128-10-0x0000000000000000-mapping.dmp

Download
memory/3764-16-0x0000000000000000-mapping.dmp

Download
memory/3764-17-0x0000000000470000-0x00000000004A5000-memory.dmp

Filesize
212KB

Download
memory/3976-11-0x0000000000000000-mapping.dmp

Download
memory/3976-14-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/3976-15-0x0000000003620000-0x0000000003621000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads