qakbot | b9228d88616a1afef3744410666e04a701180ca107f478d2718d43a195a708a6

General

Target

aZmqL.hta
Size

2KB
MD5

5050ab030cad77071b848d900adb1524
SHA1

64ae91d58e6a014f3a2b812d2ffd6e78725f7caf
SHA256

b9228d88616a1afef3744410666e04a701180ca107f478d2718d43a195a708a6
SHA512

e66e91f0823c0f15f5bf42ec778a6b05a9934439dc075f4fc594020251ebd4eaaf0c75812e18be262d1b9d7511a2a99b9df5ab91921348b4264584feeb874f5b

Score

10^/10

qakbot krk01 1611569149 banker ransomware stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

krk01

Campaign

1611569149

C2

31.5.21.66:995

89.3.198.238:443

202.188.138.162:443

188.24.128.253:443

175.141.219.71:443

151.60.15.183:443

184.189.122.72:443

80.227.5.70:443

140.82.49.12:443

89.211.241.100:995

81.97.154.100:443

77.27.174.49:995

92.154.83.96:2078

42.3.8.54:443

71.187.170.235:443

46.153.36.53:995

71.182.142.63:443

105.186.102.16:443

50.244.112.106:443

78.63.226.32:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

7 528 mshta.exe
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

112 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

112 regsvr32.exe
112 regsvr32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

regsvr32.exe

pid process

112 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

112 regsvr32.exe

flow	pid	process
7	528	mshta.exe

pid	process
112	regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

pid	process
112	regsvr32.exe
112	regsvr32.exe

pid	process
112	regsvr32.exe

pid	process
112	regsvr32.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

mshta.exeregsvr32.exe

description	pid	process	target process
PID 528 wrote to memory of 112	528	mshta.exe	regsvr32.exe
PID 528 wrote to memory of 112	528	mshta.exe	regsvr32.exe
PID 528 wrote to memory of 112	528	mshta.exe	regsvr32.exe
PID 528 wrote to memory of 112	528	mshta.exe	regsvr32.exe
PID 528 wrote to memory of 112	528	mshta.exe	regsvr32.exe
PID 528 wrote to memory of 112	528	mshta.exe	regsvr32.exe
PID 528 wrote to memory of 112	528	mshta.exe	regsvr32.exe
PID 112 wrote to memory of 940	112	regsvr32.exe	explorer.exe
PID 112 wrote to memory of 940	112	regsvr32.exe	explorer.exe
PID 112 wrote to memory of 940	112	regsvr32.exe	explorer.exe
PID 112 wrote to memory of 940	112	regsvr32.exe	explorer.exe
PID 112 wrote to memory of 940	112	regsvr32.exe	explorer.exe
PID 112 wrote to memory of 940	112	regsvr32.exe	explorer.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\aZmqL.hta"
1⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" c:\programdata\aZmqL.tmp
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:112

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\programdata\aZmqL.tmp
MD5
b379d2943f8effccbf1371e0af21a67d

SHA1
f103472c49a4a25a8409855f25d489b602c948a7

SHA256
9df8ad6621a1ab3cb989679a184954b19f940b1bf8d8b073418f192ce4595357

SHA512
5284db14039c99e62c529526cbeb2addd42f816a6356369709236ee3fa8e360c1b441cf095aed5b880a9e3d7047b4c6867544449bc39c6bb87e4ac7cd55c18f2

Download Submit
\ProgramData\aZmqL.tmp
MD5
b379d2943f8effccbf1371e0af21a67d

SHA1
f103472c49a4a25a8409855f25d489b602c948a7

SHA256
9df8ad6621a1ab3cb989679a184954b19f940b1bf8d8b073418f192ce4595357

SHA512
5284db14039c99e62c529526cbeb2addd42f816a6356369709236ee3fa8e360c1b441cf095aed5b880a9e3d7047b4c6867544449bc39c6bb87e4ac7cd55c18f2

Download Submit
memory/112-3-0x0000000000000000-mapping.dmp

Download
memory/112-4-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/112-7-0x0000000071C60000-0x0000000071C95000-memory.dmp

Filesize
212KB

Download
memory/112-8-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/112-13-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/940-9-0x0000000000000000-mapping.dmp

Download
memory/940-11-0x0000000071931000-0x0000000071933000-memory.dmp

Filesize
8KB

Download
memory/940-12-0x0000000000080000-0x00000000000B5000-memory.dmp

Filesize
212KB

Download
memory/2016-2-0x000007FEF7D40000-0x000007FEF7FBA000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing