qakbot | 53b9aaed11c3bff95b8baeef19467b11ab6ef362e2f8b550ee531babbddd9e0f

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

regsvr32.exeSystemSettings.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000	SystemSettings.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3632 schtasks.exe
Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

492 net.exe

pid	process
3632	schtasks.exe

pid	process
492	net.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

netstat.exeipconfig.exe

pid process

424 netstat.exe
4008 ipconfig.exe
Modifies Control Panel 1 IoCs
evasion

Processes:

SystemSettings.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors SystemSettings.exe
Runs net.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

2632 WINWORD.EXE
2632 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exeexplorer.exe

pid process

744 regsvr32.exe
744 regsvr32.exe
744 regsvr32.exe
744 regsvr32.exe
3780 explorer.exe
3780 explorer.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeexplorer.exe

pid process

744 regsvr32.exe
3780 explorer.exe

pid	process
424	netstat.exe
4008	ipconfig.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors	SystemSettings.exe

pid	process
744	regsvr32.exe
744	regsvr32.exe
744	regsvr32.exe
744	regsvr32.exe
3780	explorer.exe
3780	explorer.exe

pid	process
744	regsvr32.exe
3780	explorer.exe

Suspicious use of AdjustPrivilegeToken 79 IoCs

Processes:

xml.comSystemSettings.exewhoami.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1572	xml.com
Token: SeSecurityPrivilege	1572	xml.com
Token: SeTakeOwnershipPrivilege	1572	xml.com
Token: SeLoadDriverPrivilege	1572	xml.com
Token: SeSystemProfilePrivilege	1572	xml.com
Token: SeSystemtimePrivilege	1572	xml.com
Token: SeProfSingleProcessPrivilege	1572	xml.com
Token: SeIncBasePriorityPrivilege	1572	xml.com
Token: SeCreatePagefilePrivilege	1572	xml.com
Token: SeBackupPrivilege	1572	xml.com
Token: SeRestorePrivilege	1572	xml.com
Token: SeShutdownPrivilege	1572	xml.com
Token: SeDebugPrivilege	1572	xml.com
Token: SeSystemEnvironmentPrivilege	1572	xml.com
Token: SeRemoteShutdownPrivilege	1572	xml.com
Token: SeUndockPrivilege	1572	xml.com
Token: SeManageVolumePrivilege	1572	xml.com
Token: 33	1572	xml.com
Token: 34	1572	xml.com
Token: 35	1572	xml.com
Token: 36	1572	xml.com
Token: SeIncreaseQuotaPrivilege	1572	xml.com
Token: SeSecurityPrivilege	1572	xml.com
Token: SeTakeOwnershipPrivilege	1572	xml.com
Token: SeLoadDriverPrivilege	1572	xml.com
Token: SeSystemProfilePrivilege	1572	xml.com
Token: SeSystemtimePrivilege	1572	xml.com
Token: SeProfSingleProcessPrivilege	1572	xml.com
Token: SeIncBasePriorityPrivilege	1572	xml.com
Token: SeCreatePagefilePrivilege	1572	xml.com
Token: SeBackupPrivilege	1572	xml.com
Token: SeRestorePrivilege	1572	xml.com
Token: SeShutdownPrivilege	1572	xml.com
Token: SeDebugPrivilege	1572	xml.com
Token: SeSystemEnvironmentPrivilege	1572	xml.com
Token: SeRemoteShutdownPrivilege	1572	xml.com
Token: SeUndockPrivilege	1572	xml.com
Token: SeManageVolumePrivilege	1572	xml.com
Token: 33	1572	xml.com
Token: 34	1572	xml.com
Token: 35	1572	xml.com
Token: 36	1572	xml.com
Token: SeShutdownPrivilege	1664	SystemSettings.exe
Token: SeCreatePagefilePrivilege	1664	SystemSettings.exe
Token: SeShutdownPrivilege	1664	SystemSettings.exe
Token: SeCreatePagefilePrivilege	1664	SystemSettings.exe
Token: SeShutdownPrivilege	1664	SystemSettings.exe
Token: SeCreatePagefilePrivilege	1664	SystemSettings.exe
Token: SeShutdownPrivilege	1664	SystemSettings.exe
Token: SeCreatePagefilePrivilege	1664	SystemSettings.exe
Token: SeDebugPrivilege	956	whoami.exe
Token: SeDebugPrivilege	956	whoami.exe
Token: SeDebugPrivilege	956	whoami.exe
Token: SeDebugPrivilege	956	whoami.exe
Token: SeDebugPrivilege	956	whoami.exe
Token: SeDebugPrivilege	956	whoami.exe
Token: SeDebugPrivilege	956	whoami.exe
Token: SeDebugPrivilege	956	whoami.exe
Token: SeDebugPrivilege	956	whoami.exe
Token: SeDebugPrivilege	956	whoami.exe
Token: SeDebugPrivilege	956	whoami.exe
Token: SeDebugPrivilege	956	whoami.exe
Token: SeDebugPrivilege	956	whoami.exe
Token: SeDebugPrivilege	956	whoami.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

WINWORD.EXESystemSettings.exe

pid	process
2632	WINWORD.EXE
2632	WINWORD.EXE
2632	WINWORD.EXE
2632	WINWORD.EXE
2632	WINWORD.EXE
2632	WINWORD.EXE
2632	WINWORD.EXE
2632	WINWORD.EXE
2632	WINWORD.EXE
2632	WINWORD.EXE
2632	WINWORD.EXE
2632	WINWORD.EXE
2632	WINWORD.EXE
2632	WINWORD.EXE
2632	WINWORD.EXE
2632	WINWORD.EXE
2632	WINWORD.EXE
1664	SystemSettings.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

WINWORD.EXExml.comregsvr32.exeregsvr32.exeexplorer.exeregsvr32.exenet.exenet.exe

description	pid	process	target process
PID 2632 wrote to memory of 1572	2632	WINWORD.EXE	xml.com
PID 2632 wrote to memory of 1572	2632	WINWORD.EXE	xml.com
PID 1572 wrote to memory of 3012	1572	xml.com	regsvr32.exe
PID 1572 wrote to memory of 3012	1572	xml.com	regsvr32.exe
PID 3012 wrote to memory of 744	3012	regsvr32.exe	regsvr32.exe
PID 3012 wrote to memory of 744	3012	regsvr32.exe	regsvr32.exe
PID 3012 wrote to memory of 744	3012	regsvr32.exe	regsvr32.exe
PID 744 wrote to memory of 3780	744	regsvr32.exe	explorer.exe
PID 744 wrote to memory of 3780	744	regsvr32.exe	explorer.exe
PID 744 wrote to memory of 3780	744	regsvr32.exe	explorer.exe
PID 744 wrote to memory of 3780	744	regsvr32.exe	explorer.exe
PID 744 wrote to memory of 3780	744	regsvr32.exe	explorer.exe
PID 3780 wrote to memory of 3632	3780	explorer.exe	schtasks.exe
PID 3780 wrote to memory of 3632	3780	explorer.exe	schtasks.exe
PID 3780 wrote to memory of 3632	3780	explorer.exe	schtasks.exe
PID 3552 wrote to memory of 3732	3552	regsvr32.exe	regsvr32.exe
PID 3552 wrote to memory of 3732	3552	regsvr32.exe	regsvr32.exe
PID 3552 wrote to memory of 3732	3552	regsvr32.exe	regsvr32.exe
PID 3780 wrote to memory of 956	3780	explorer.exe	whoami.exe
PID 3780 wrote to memory of 956	3780	explorer.exe	whoami.exe
PID 3780 wrote to memory of 956	3780	explorer.exe	whoami.exe
PID 3780 wrote to memory of 1776	3780	explorer.exe	cmd.exe
PID 3780 wrote to memory of 1776	3780	explorer.exe	cmd.exe
PID 3780 wrote to memory of 1776	3780	explorer.exe	cmd.exe
PID 3780 wrote to memory of 1096	3780	explorer.exe	arp.exe
PID 3780 wrote to memory of 1096	3780	explorer.exe	arp.exe
PID 3780 wrote to memory of 1096	3780	explorer.exe	arp.exe
PID 3780 wrote to memory of 4008	3780	explorer.exe	ipconfig.exe
PID 3780 wrote to memory of 4008	3780	explorer.exe	ipconfig.exe
PID 3780 wrote to memory of 4008	3780	explorer.exe	ipconfig.exe
PID 3780 wrote to memory of 492	3780	explorer.exe	net.exe
PID 3780 wrote to memory of 492	3780	explorer.exe	net.exe
PID 3780 wrote to memory of 492	3780	explorer.exe	net.exe
PID 3780 wrote to memory of 848	3780	explorer.exe	nslookup.exe
PID 3780 wrote to memory of 848	3780	explorer.exe	nslookup.exe
PID 3780 wrote to memory of 848	3780	explorer.exe	nslookup.exe
PID 3780 wrote to memory of 1264	3780	explorer.exe	net.exe
PID 3780 wrote to memory of 1264	3780	explorer.exe	net.exe
PID 3780 wrote to memory of 1264	3780	explorer.exe	net.exe
PID 1264 wrote to memory of 1388	1264	net.exe	net1.exe
PID 1264 wrote to memory of 1388	1264	net.exe	net1.exe
PID 1264 wrote to memory of 1388	1264	net.exe	net1.exe
PID 3780 wrote to memory of 2964	3780	explorer.exe	route.exe
PID 3780 wrote to memory of 2964	3780	explorer.exe	route.exe
PID 3780 wrote to memory of 2964	3780	explorer.exe	route.exe
PID 3780 wrote to memory of 424	3780	explorer.exe	netstat.exe
PID 3780 wrote to memory of 424	3780	explorer.exe	netstat.exe
PID 3780 wrote to memory of 424	3780	explorer.exe	netstat.exe
PID 3780 wrote to memory of 852	3780	explorer.exe	net.exe
PID 3780 wrote to memory of 852	3780	explorer.exe	net.exe
PID 3780 wrote to memory of 852	3780	explorer.exe	net.exe
PID 852 wrote to memory of 2180	852	net.exe	net1.exe
PID 852 wrote to memory of 2180	852	net.exe	net1.exe
PID 852 wrote to memory of 2180	852	net.exe	net1.exe
PID 3780 wrote to memory of 1984	3780	explorer.exe	explorer.exe
PID 3780 wrote to memory of 1984	3780	explorer.exe	explorer.exe
PID 3780 wrote to memory of 1984	3780	explorer.exe	explorer.exe
PID 3780 wrote to memory of 1984	3780	explorer.exe	explorer.exe
PID 3780 wrote to memory of 1984	3780	explorer.exe	explorer.exe
PID 3780 wrote to memory of 1984	3780	explorer.exe	explorer.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\bid,02.21.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632

C:\programdata\xml.com
"C:\programdata\xml.com" process list /format : "c:\programdata\i.xsl"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\SYSTEM32\regsvr32.exe
regsvr32 c:\programdata\1271.jpg
3⤵
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\SysWOW64\regsvr32.exe
c:\programdata\1271.jpg
4⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3780

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rxnrcabmk /tr "regsvr32.exe -s \"c:\programdata\1271.jpg\"" /SC ONCE /Z /ST 19:30 /ET 19:42
6⤵
- Creates scheduled task(s)
PID:3632

C:\Windows\SysWOW64\whoami.exe
whoami /all
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\SysWOW64\cmd.exe
cmd /c set
6⤵
PID:1776

C:\Windows\SysWOW64\arp.exe
arp -a
6⤵
PID:1096

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
6⤵
- Gathers network information
PID:4008

C:\Windows\SysWOW64\net.exe
net view /all
6⤵
- Discovers systems in the same network
PID:492

C:\Windows\SysWOW64\nslookup.exe
nslookup -querytype=ALL -timeout=10 _ldap._tcp.dc._msdcs.WORKGROUP
6⤵
PID:848

C:\Windows\SysWOW64\net.exe
net share
6⤵
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 share
7⤵
PID:1388

C:\Windows\SysWOW64\route.exe
route print
6⤵
PID:2964

C:\Windows\SysWOW64\netstat.exe
netstat -nao
6⤵
- Gathers network information
PID:424

C:\Windows\SysWOW64\net.exe
net localgroup
6⤵
- Suspicious use of WriteProcessMemory
PID:852

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup
7⤵
PID:2180

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
6⤵
PID:1984

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "c:\programdata\1271.jpg"
1⤵
- Suspicious use of WriteProcessMemory
PID:3552

C:\Windows\SysWOW64\regsvr32.exe
-s "c:\programdata\1271.jpg"
2⤵
- Loads dropped DLL
PID:3732

C:\Windows\ImmersiveControlPanel\SystemSettings.exe
"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
1⤵
- Checks SCSI registry key(s)
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1664

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:60

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Command-Line Interface

T1059

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

3

Peripheral Device Discovery

T1120

System Information Discovery

4

Remote System Discovery