qakbot | eb757faa0f6c3f2850e9b41180ed7074d2c16e06e90903e9d42ed84a9f4a2936

General

Target

deed contract-02.01.2021.doc
Size

75KB
MD5

05eaf3d398f1a3266d4c2dfce98701f7
SHA1

8f00ebdacde833f7521252c8870c9e6ecefedee7
SHA256

eb757faa0f6c3f2850e9b41180ed7074d2c16e06e90903e9d42ed84a9f4a2936
SHA512

1909dae408b01637cb59988aa8dccdbc559fd2d7cb1bcdc118259b990da049a8e145045f247fb2e49f0dc4a6cfb3f247817d8de5e24d7a9e096c21c1bd7b7e77

Score

10^/10

qakbot krk01 1611569149 banker ransomware stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

krk01

Campaign

1611569149

C2

31.5.21.66:995

89.3.198.238:443

202.188.138.162:443

188.24.128.253:443

175.141.219.71:443

151.60.15.183:443

184.189.122.72:443

80.227.5.70:443

140.82.49.12:443

89.211.241.100:995

81.97.154.100:443

77.27.174.49:995

92.154.83.96:2078

42.3.8.54:443

71.187.170.235:443

46.153.36.53:995

71.182.142.63:443

105.186.102.16:443

50.244.112.106:443

78.63.226.32:443

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

explorer.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3208	3116	explorer.exe	WINWORD.EXE

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

28 3612 mshta.exe
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3860 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

flow	pid	process
28	3612	mshta.exe

pid	process
3860	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies registry class 1 IoCs

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings explorer.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3116 WINWORD.EXE
3116 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exe

pid process

3860 regsvr32.exe
3860 regsvr32.exe
3860 regsvr32.exe
3860 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

3860 regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	explorer.exe

pid	process
3860	regsvr32.exe
3860	regsvr32.exe
3860	regsvr32.exe
3860	regsvr32.exe

pid	process
3860	regsvr32.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

WINWORD.EXE

pid	process
3116	WINWORD.EXE
3116	WINWORD.EXE
3116	WINWORD.EXE
3116	WINWORD.EXE
3116	WINWORD.EXE
3116	WINWORD.EXE
3116	WINWORD.EXE
3116	WINWORD.EXE
3116	WINWORD.EXE
3116	WINWORD.EXE
3116	WINWORD.EXE
3116	WINWORD.EXE
3116	WINWORD.EXE
3116	WINWORD.EXE
3116	WINWORD.EXE
3116	WINWORD.EXE
3116	WINWORD.EXE
3116	WINWORD.EXE

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

WINWORD.EXEexplorer.exemshta.exeregsvr32.exe

description	pid	process	target process
PID 3116 wrote to memory of 3208	3116	WINWORD.EXE	explorer.exe
PID 3116 wrote to memory of 3208	3116	WINWORD.EXE	explorer.exe
PID 928 wrote to memory of 3612	928	explorer.exe	mshta.exe
PID 928 wrote to memory of 3612	928	explorer.exe	mshta.exe
PID 928 wrote to memory of 3612	928	explorer.exe	mshta.exe
PID 3612 wrote to memory of 3860	3612	mshta.exe	regsvr32.exe
PID 3612 wrote to memory of 3860	3612	mshta.exe	regsvr32.exe
PID 3612 wrote to memory of 3860	3612	mshta.exe	regsvr32.exe
PID 3860 wrote to memory of 2888	3860	regsvr32.exe	explorer.exe
PID 3860 wrote to memory of 2888	3860	regsvr32.exe	explorer.exe
PID 3860 wrote to memory of 2888	3860	regsvr32.exe	explorer.exe
PID 3860 wrote to memory of 2888	3860	regsvr32.exe	explorer.exe
PID 3860 wrote to memory of 2888	3860	regsvr32.exe	explorer.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\deed contract-02.01.2021.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116

C:\Windows\explorer.exe
explorer c:\programdata\aGdS0r.hta
2⤵
- Process spawned unexpected child process
PID:3208

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:928

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\aGdS0r.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
2⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3612

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" c:\programdata\aGdS0r.tmp
3⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3860

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
PID:2888

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

4

T1082

Query Registry

3

T1012

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\aGdS0r.hta
MD5
138ed2bf6195afdbcbd1ff418204d7b7

SHA1
4c956fef23903d5ff2bd162e5aa9dcb1c9778565

SHA256
8b520adfbeb1349c7a4a32e3389b80d5678887e79821b6f8300953a5015ddee3

SHA512
a2e6b21af2e8a1b91ae03bd1d2f4716d78c40dbaacce06185bad277b652041ca78918d3498869b5e16de32317598c85b62f06b7ee25327cf045ed5aa6ff670e1

Download Submit
\??\c:\programdata\aGdS0r.tmp
MD5
769584aae5d42c2114859695579cd01f

SHA1
a2db2628bb08d028b1e27109fd3fc264c379ea17

SHA256
9e9dfd20659f10687d7324c87fd5ea8435df6c12c8532ab8e700e19aa4448e5b

SHA512
d069a7c1c6294c6911fde4e2a8d46daae0a6b8360ecc5f174d5b16812e99dd4f22801bc37a8823d6ee8f2cfdc18417a4e02b8f00a3497e8466a5d70e76923b78

Download Submit
\ProgramData\aGdS0r.tmp
MD5
769584aae5d42c2114859695579cd01f

SHA1
a2db2628bb08d028b1e27109fd3fc264c379ea17

SHA256
9e9dfd20659f10687d7324c87fd5ea8435df6c12c8532ab8e700e19aa4448e5b

SHA512
d069a7c1c6294c6911fde4e2a8d46daae0a6b8360ecc5f174d5b16812e99dd4f22801bc37a8823d6ee8f2cfdc18417a4e02b8f00a3497e8466a5d70e76923b78

Download Submit
memory/2888-16-0x0000000000000000-mapping.dmp

Download
memory/2888-17-0x0000000000E40000-0x0000000000E75000-memory.dmp

Filesize
212KB

Download
memory/3116-3-0x00007FF7FC7D0000-0x00007FF7FC7E0000-memory.dmp

Filesize
64KB

Download
memory/3116-4-0x00007FF7FC7D0000-0x00007FF7FC7E0000-memory.dmp

Filesize
64KB

Download
memory/3116-5-0x00007FF7FC7D0000-0x00007FF7FC7E0000-memory.dmp

Filesize
64KB

Download
memory/3116-6-0x00007FF81BD00000-0x00007FF81C337000-memory.dmp

Filesize
6.2MB

Download
memory/3116-8-0x000002BD32450000-0x000002BD32454000-memory.dmp

Filesize
16KB

Download
memory/3116-2-0x00007FF7FC7D0000-0x00007FF7FC7E0000-memory.dmp

Filesize
64KB

Download
memory/3208-7-0x0000000000000000-mapping.dmp

Download
memory/3612-10-0x0000000000000000-mapping.dmp

Download
memory/3860-15-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/3860-14-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/3860-11-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads