qakbot | 967af76e6be779d060174f3e3231bd8e3f88b3af26043952bcf67146ca750756

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CO.lnk
Size 1KB
Sample221101-brdvgafgfl
SHA256 5df2756a7d76d95678704d977c845838e8e3d9829303cbacf6862992824de4bc
MD5 bb0fe0507c4f04d2c3d98579671a1754
SHA1 44a7064bec374a3092999123fda8abb3624738f7
SHA512 98deac66c986684f29a95da42942a3946036a7b60a3d94a6cf642db02cb34953a423f7b69f569195788714f3b71c08a12e16244e32896603e7347d2e609e96c5
MD5 SHA1 SHA512

Score

10^/10

qakbot bb05 1667208557 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.14

Botnet

BB05

Campaign

1667208557

174.77.209.5:443
187.0.1.74:23795
24.206.27.39:443
1.156.220.169:30723
156.216.39.119:995
58.186.75.42:443
1.156.197.160:30467
187.1.1.190:4844
186.18.210.16:443
1.181.56.171:771
90.165.109.4:2222
187.0.1.186:39742
87.57.13.215:443
187.0.1.207:52344
227.26.3.227:1
98.207.190.55:443
187.0.1.197:7017
188.49.56.189:443
102.156.160.115:443
187.0.1.24:17751
70.51.139.148:2222
187.0.1.109:34115
14.164.18.210:443
187.0.1.97:30597
205.161.22.189:443
187.0.1.151:54711
196.217.63.248:443
187.0.1.160:45243
66.37.239.222:443
24.207.97.40:443
187.0.1.59:24056
68.62.199.70:443
45.230.169.132:993

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Executes dropped EXE 1 IoCs

pid	Process
1788	infertilityRevelry.com

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2200	regsvr32.exe
2200	regsvr32.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe
3884	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2200	regsvr32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 4888	3016	cmd.exe	80
PID 3016 wrote to memory of 4888	3016	cmd.exe	80
PID 4888 wrote to memory of 1788	4888	cmd.exe	81
PID 4888 wrote to memory of 1788	4888	cmd.exe	81
PID 1788 wrote to memory of 2200	1788	infertilityRevelry.com	82
PID 1788 wrote to memory of 2200	1788	infertilityRevelry.com	82
PID 1788 wrote to memory of 2200	1788	infertilityRevelry.com	82
PID 2200 wrote to memory of 3884	2200	regsvr32.exe	83
PID 2200 wrote to memory of 3884	2200	regsvr32.exe	83
PID 2200 wrote to memory of 3884	2200	regsvr32.exe	83
PID 2200 wrote to memory of 3884	2200	regsvr32.exe	83
PID 2200 wrote to memory of 3884	2200	regsvr32.exe	83

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CO.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c judicature\unfurled.cmd reg
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Users\Admin\AppData\Local\Temp\infertilityRevelry.com
    C:\Users\Admin\AppData\Local\Temp\\infertilityRevelry.com judicature\stereotypes.dat
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\SysWOW64\regsvr32.exe
      judicature\stereotypes.dat
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2200
    - - C:\Windows\SysWOW64\wermgr.exe
        
        C:\Windows\SysWOW64\wermgr.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

infertilityRevelry.com

Path C:\Users\Admin\AppData\Local\Temp\infertilityRevelry.com
Size 24KB
SHA256 022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b7
MD5 b0c2fa35d14a9fad919e99d9d75e1b9e
SHA1 8d7c2fd354363daee63e8f591ec52fa5d0e23f6f
SHA512 a6155e42b605425914d1bf745d9b2b5ed57976e161384731c6821a1f8fa2bc3207a863ae45d6ad371ac82733b72bb024204498baa4fb38ad46c6d7bc52e5a022
SSDEEP 384:n5Y3wBQ8l/m60z+G7XU9I6ExBOMDl16AvcX9dp/Ql7YQCrA2WrcLHW:n5Yg3l/mTRXU9FeGpX9dp/47tCnL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2200-136-0x00000000030A0000-0x00000000030CA000-memory.dmp

Download

memory/2200-137-0x0000000002960000-0x000000000298A000-memory.dmp

Download

memory/2200-138-0x00000000030A0000-0x00000000030CA000-memory.dmp

Download

memory/2200-140-0x00000000030A0000-0x00000000030CA000-memory.dmp

Download

memory/3884-141-0x0000000000750000-0x000000000077A000-memory.dmp

Download

memory/3884-142-0x0000000000750000-0x000000000077A000-memory.dmp

Download