qakbot | 750dc3b930616e3132b5b83fc4136b196299569652e3e6674186697a5a6ca8f1

General

Target

Claim_Letter#340840(13Sep2022).html
Size

532KB
MD5

1f834c0ef4f1ad023bf8274519b63310
SHA1

4e18f9308eea49be2361a3e260b005502efd7e1a
SHA256

750dc3b930616e3132b5b83fc4136b196299569652e3e6674186697a5a6ca8f1
SHA512

c01087b31f81b7280077152bf9d4b8ac58b2ada9777089a50fdb707b6ac96e56ad1043f3267de7a5c8bbd1e33df9336ab4eb2037c0a7dda0de6f1a332437ba51
SSDEEP

6144:bmG04xlIE4w2SJrjY82oULCyIK9lVLMf/3vVelb3qj309t0G42m3J1Ub5bO3+Hd/:zeVL68ukJ1+JKbY3+HNmTq

Score

10^/10

qakbot obama202 1663062752 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.858

Botnet

obama202

Campaign

1663062752

C2

99.232.140.205:2222

41.69.118.117:995

179.111.111.88:32101

37.210.148.30:995

47.146.182.110:443

191.97.234.238:995

64.207.215.69:443

88.233.194.154:2222

81.131.161.131:2078

86.98.156.176:993

200.161.62.126:32101

88.244.84.195:443

78.100.254.17:2222

85.114.99.34:443

113.170.216.154:443

194.49.79.231:443

193.3.19.37:443

84.38.133.191:443

175.110.231.67:443

191.84.204.214:995

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

WScript.execmd.exe

description ioc process

File opened (read-only) \??\E: WScript.exe
File opened (read-only) \??\E: cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4104 2232 WerFault.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe

description	ioc	process
File opened (read-only)	\??\E:	WScript.exe
File opened (read-only)	\??\E:	cmd.exe

pid	pid_target	process	target process
4104	2232	WerFault.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 39384a26b9aed801	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2536947877"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2536947877"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2556324549"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a1000000000020000000000106600000001000020000000f8787407fe643202e97ba390d315174f0c26879f47e1c6727a4621f892f65527000000000e80000000020000200000007fdc261370ecc3279e37dbcbe97465dc58825bc2bd6344d79094a088bea0764d2000000073dc43fbd8bb2914b29cdb9560b400491c83dbac33f87faa91ff51907f03703940000000f7b89fba7d6f70aa6a02e7977a3e12ec9cca0b7359af63b8cbb4c34565c585dc19aab46de5e8f1aaaba4d9507f43c5064d4e6cbc3028e99f2de7aec426483f57	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{FC3C09CC-9D32-408A-ABC0-3A2908738EE9}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0edc399cec9d801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0bcb599cec9d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30984654"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30984654"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C28CB18F-35C1-11ED-89AC-5A10AEE59B4B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30984654"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a1000000000020000000000106600000001000020000000adb0b29eee866313bca20772fec0d151676b3b24e968f5da607af5e01d36762e000000000e80000000020000200000006ddb4cad643606559187cace7ddc779f6f55db8d19bd7843d6afe528b12576ca200000001fd72fe9871726665c11bad924118cd98deafa4feeb3b2218db6e726655a39da40000000806ceb798612be8d7d529da091957ff76d25e8e48433c8ea4d71fedc633a67ece803dd23d65e1a499a655b81c4fcc0b91374fe32d3014c4aba6bc840c635e13a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370099159"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies registry class 1 IoCs

Processes:

iexplore.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings iexplore.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2064 regsvr32.exe
2064 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

2064 regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	iexplore.exe

pid	process
2064	regsvr32.exe
2064	regsvr32.exe

pid	process
2064	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7zG.exe

description	pid	process
Token: SeRestorePrivilege	2040	7zG.exe
Token: 35	2040	7zG.exe
Token: SeSecurityPrivilege	2040	7zG.exe
Token: SeSecurityPrivilege	2040	7zG.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exe7zG.exe

pid process

1864 iexplore.exe
1864 iexplore.exe
2040 7zG.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1864 iexplore.exe
1864 iexplore.exe
1316 IEXPLORE.EXE
1316 IEXPLORE.EXE
1316 IEXPLORE.EXE
1316 IEXPLORE.EXE

pid	process
1864	iexplore.exe
1864	iexplore.exe
2040	7zG.exe

pid	process
1864	iexplore.exe
1864	iexplore.exe
1316	IEXPLORE.EXE
1316	IEXPLORE.EXE
1316	IEXPLORE.EXE
1316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

iexplore.exeWScript.execmd.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1864 wrote to memory of 1316	1864	iexplore.exe	IEXPLORE.EXE
PID 1864 wrote to memory of 1316	1864	iexplore.exe	IEXPLORE.EXE
PID 1864 wrote to memory of 1316	1864	iexplore.exe	IEXPLORE.EXE
PID 3596 wrote to memory of 900	3596	WScript.exe	cmd.exe
PID 3596 wrote to memory of 900	3596	WScript.exe	cmd.exe
PID 900 wrote to memory of 4764	900	cmd.exe	regsvr32.exe
PID 900 wrote to memory of 4764	900	cmd.exe	regsvr32.exe
PID 4764 wrote to memory of 2064	4764	regsvr32.exe	regsvr32.exe
PID 4764 wrote to memory of 2064	4764	regsvr32.exe	regsvr32.exe
PID 4764 wrote to memory of 2064	4764	regsvr32.exe	regsvr32.exe
PID 2064 wrote to memory of 4376	2064	regsvr32.exe	explorer.exe
PID 2064 wrote to memory of 4376	2064	regsvr32.exe	explorer.exe
PID 2064 wrote to memory of 4376	2064	regsvr32.exe	explorer.exe
PID 2064 wrote to memory of 4376	2064	regsvr32.exe	explorer.exe
PID 2064 wrote to memory of 4376	2064	regsvr32.exe	explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Claim_Letter#340840(13Sep2022).html
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1316

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5072

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 412 -p 2232 -ip 2232
1⤵
PID:2196

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2232 -s 768
1⤵
- Program crash
PID:4104

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Claim_Letter#340840(13Sep2022)~\" -spe -an -ai#7zMap22329:114:7zEvent23993
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2040

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "E:\about\likeNot.js"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""E:\about\otherAbout.bat" reg svr"
  2⤵
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\system32\regsvr32.exe
    regsvr32 about/outTell.db
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\SysWOW64\regsvr32.exe
      about/outTell.db
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2064
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        
        PID:4376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
0708e559410e8dc68f3dd1a7622ccf08

SHA1
ab4cfa91b39bd11461edbf133d889f04789afa1e

SHA256
ab31d03e4e5401bd3df1c339982d79631980777a9d7d4d49c694ee6385a5b30c

SHA512
76f45998ef092b990edca0b010c37f213571eeed419393055bb8fbbfe11818b45b2de1719436a6236e0b8a2bcec1bcb8b1cfa621b74e7e6088db2219afa66b78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
72237a0b4ac6246877d796b6ef25fa55

SHA1
9e7cf5030b1768a42f686cb4f39aa98ca5840e61

SHA256
8043bc923ed934cebc54e9ebd8f61893bd9bc511a03741000244feaa0132ba3c

SHA512
7cdeb9cea9a863cca8bcecf415d7adb4a4fbba4b427c94b6c9e333baa7db168b9a277f3f03ddc8a0c47dd65273c7c2e7473546c82ad22b3a9807b486b3b5c5e0

Download Submit
C:\Users\Admin\Downloads\Claim_Letter#340840(13Sep2022).4or99fy.partial

Filesize
232KB

MD5
962655850b8772db2943d241a94c65d4

SHA1
e131054d03ffaf7e280fd65f8d3cccd2dd8f8521

SHA256
186d88c8f0636e7e48e06b86dc45bc6ca3d478d9c079b40b596bd0bd028ad73e

SHA512
51a8b3ff4cb76b5cf615811170cc7982451d4d355ed44c5b6616d7b9cdcc810c370e0f48a80f95aa56069ef8df7de6ac7870853159903170ae7820616af92b98

Download Submit
memory/900-135-0x0000000000000000-mapping.dmp

Download
memory/2064-137-0x0000000000000000-mapping.dmp

Download
memory/2064-138-0x0000000000D20000-0x0000000000D42000-memory.dmp

Filesize
136KB

Download
memory/2064-141-0x0000000000D20000-0x0000000000D42000-memory.dmp

Filesize
136KB

Download
memory/4376-139-0x0000000000000000-mapping.dmp

Download
memory/4376-140-0x0000000001030000-0x0000000001052000-memory.dmp

Filesize
136KB

Download
memory/4376-142-0x0000000001030000-0x0000000001052000-memory.dmp

Filesize
136KB

Download
memory/4764-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads