qakbot | 5e524e155e3d8bf274580082a7ae8f691008bf14fbcf1fab155c1900ba539fde

General

Target

details-02.05.2021.doc
Size

78KB
MD5

138ec6bb028ed5b3780703fed7cdf3f4
SHA1

e70e2c2bf2de8b41378f033d7fcf9663a30ba539
SHA256

5e524e155e3d8bf274580082a7ae8f691008bf14fbcf1fab155c1900ba539fde
SHA512

7de7a0702c803eaea97540d90604e4bc714453bc8ab99a886c96540d39c59dd9c6fb3c5d950a53c26fe6bfd5ede4b23bf05b0aacbf53d6286eb68107d1666951

Score

10^/10

qakbot krk01 1611569149 banker ransomware stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

krk01

Campaign

1611569149

C2

31.5.21.66:995

89.3.198.238:443

202.188.138.162:443

188.24.128.253:443

175.141.219.71:443

151.60.15.183:443

184.189.122.72:443

80.227.5.70:443

140.82.49.12:443

89.211.241.100:995

81.97.154.100:443

77.27.174.49:995

92.154.83.96:2078

42.3.8.54:443

71.187.170.235:443

46.153.36.53:995

71.182.142.63:443

105.186.102.16:443

50.244.112.106:443

78.63.226.32:443

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

explorer.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	2524	3576	explorer.exe	WINWORD.EXE

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

29 1572 mshta.exe
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3672 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

flow	pid	process
29	1572	mshta.exe

pid	process
3672	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings explorer.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3576 WINWORD.EXE
3576 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exe

pid process

3672 regsvr32.exe
3672 regsvr32.exe
3672 regsvr32.exe
3672 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

3672 regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	explorer.exe

pid	process
3672	regsvr32.exe
3672	regsvr32.exe
3672	regsvr32.exe
3672	regsvr32.exe

pid	process
3672	regsvr32.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

WINWORD.EXE

pid	process
3576	WINWORD.EXE
3576	WINWORD.EXE
3576	WINWORD.EXE
3576	WINWORD.EXE
3576	WINWORD.EXE
3576	WINWORD.EXE
3576	WINWORD.EXE
3576	WINWORD.EXE
3576	WINWORD.EXE
3576	WINWORD.EXE
3576	WINWORD.EXE
3576	WINWORD.EXE
3576	WINWORD.EXE
3576	WINWORD.EXE
3576	WINWORD.EXE
3576	WINWORD.EXE
3576	WINWORD.EXE
3576	WINWORD.EXE

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

WINWORD.EXEexplorer.exemshta.exeregsvr32.exe

description	pid	process	target process
PID 3576 wrote to memory of 2524	3576	WINWORD.EXE	explorer.exe
PID 3576 wrote to memory of 2524	3576	WINWORD.EXE	explorer.exe
PID 3540 wrote to memory of 1572	3540	explorer.exe	mshta.exe
PID 3540 wrote to memory of 1572	3540	explorer.exe	mshta.exe
PID 3540 wrote to memory of 1572	3540	explorer.exe	mshta.exe
PID 1572 wrote to memory of 3672	1572	mshta.exe	regsvr32.exe
PID 1572 wrote to memory of 3672	1572	mshta.exe	regsvr32.exe
PID 1572 wrote to memory of 3672	1572	mshta.exe	regsvr32.exe
PID 3672 wrote to memory of 964	3672	regsvr32.exe	explorer.exe
PID 3672 wrote to memory of 964	3672	regsvr32.exe	explorer.exe
PID 3672 wrote to memory of 964	3672	regsvr32.exe	explorer.exe
PID 3672 wrote to memory of 964	3672	regsvr32.exe	explorer.exe
PID 3672 wrote to memory of 964	3672	regsvr32.exe	explorer.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\details-02.05.2021.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3576

C:\Windows\explorer.exe
C:\Windows\explorer.exe c:\programdata\aT3ir.hta
2⤵
- Process spawned unexpected child process
PID:2524

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3540

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\aT3ir.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
2⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" c:\programdata\aT3ir.tmp
3⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3672

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
PID:964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

4

T1082

Query Registry

3

T1012

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\aT3ir.hta
MD5
b0a1f9ad4dc5a8068c2cef64e0613c79

SHA1
a3f39c6f37c72c58109647ce2613924aeb7b6e65

SHA256
67ced01610a57c8f7c3b4ec521917c972a7e0a3401c5a9706b485c9f9f569d42

SHA512
afe9b65728f36f2a745154719fecd1d4a7ba0985a50d9a27aa790779f9ad66758b0fd48ee23cf14f3e511495b8314108c573d1cd0b05109b60890020b8272d34

Download Submit
\??\c:\programdata\aT3ir.tmp
MD5
c0c2b3a054b406defe0cdcb44666a713

SHA1
c34e94e2eafc8dc048cd0e55e3ca2fa2f5da7934

SHA256
5349e038d15a0128fa66d7cb1eb1c555d932b3fe28e7d2c1c3317b7973aaf102

SHA512
b33cd9264d88d6dc7814b53bf3dd0926e621a02f578a8c81fd0d17773294927c028ce9c3c0b93df968511b0a3c7d410c1a36f59079138c2a29fb4189be2af6e7

Download Submit
\ProgramData\aT3ir.tmp
MD5
c0c2b3a054b406defe0cdcb44666a713

SHA1
c34e94e2eafc8dc048cd0e55e3ca2fa2f5da7934

SHA256
5349e038d15a0128fa66d7cb1eb1c555d932b3fe28e7d2c1c3317b7973aaf102

SHA512
b33cd9264d88d6dc7814b53bf3dd0926e621a02f578a8c81fd0d17773294927c028ce9c3c0b93df968511b0a3c7d410c1a36f59079138c2a29fb4189be2af6e7

Download Submit
memory/964-17-0x00000000006A0000-0x00000000006D5000-memory.dmp

Filesize
212KB

Download
memory/964-16-0x0000000000000000-mapping.dmp

Download
memory/1572-10-0x0000000000000000-mapping.dmp

Download
memory/2524-7-0x0000000000000000-mapping.dmp

Download
memory/3576-6-0x00007FF987130000-0x00007FF987767000-memory.dmp

Filesize
6.2MB

Download
memory/3576-8-0x0000012E23860000-0x0000012E23864000-memory.dmp

Filesize
16KB

Download
memory/3576-2-0x00007FF967810000-0x00007FF967820000-memory.dmp

Filesize
64KB

Download
memory/3576-5-0x00007FF967810000-0x00007FF967820000-memory.dmp

Filesize
64KB

Download
memory/3576-4-0x00007FF967810000-0x00007FF967820000-memory.dmp

Filesize
64KB

Download
memory/3576-3-0x00007FF967810000-0x00007FF967820000-memory.dmp

Filesize
64KB

Download
memory/3672-11-0x0000000000000000-mapping.dmp

Download
memory/3672-14-0x0000000071BB0000-0x0000000071BE5000-memory.dmp

Filesize
212KB

Download
memory/3672-15-0x0000000003120000-0x0000000003121000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads