qakbot | ea64bba77296ccdd5522c8c70186b962425239c98b77dc1bcbb7f66530ba9703

General

Target

CV.vbs
Size

9KB
MD5

9fce32684f6693aa2215a587cb7e98a8
SHA1

e761a29b3f36da8b629a4f2f3f9fced8443f6b93
SHA256

3cbd7b0f45e7247334f8f4076aba571cbc4f364cbf336721dc60fef9e8814eef
SHA512

fd11b0ba3b3b827dd03465a78c468896d1294a1023292a1f1731103e33d2b4bc43cd78eee9b0d3377d8a46c0e69928bc123eadf0d5c9f0be78053848f795de47
SSDEEP

192:mEWHeSjzZaUgrcl/E4rowaD/OCMhiEe1C7p11G0vdzgWF0fkbsgTbpQa:HZ41ajrcpE4rocCMhidGpPGmX0jWbX

Score

10^/10

qakbot bb06 1668492308 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.27

Botnet

BB06

Campaign

1668492308

C2

49.175.72.56:443

81.229.117.95:2222

47.41.154.250:443

69.133.162.35:443

84.35.26.14:995

68.47.128.161:443

156.217.219.147:995

87.65.160.87:995

174.101.111.4:443

82.127.174.33:2222

91.169.12.198:32100

24.28.121.122:443

157.231.42.190:995

90.89.95.158:2222

74.33.84.227:443

24.64.114.59:2222

80.13.179.151:2222

64.207.237.118:443

24.206.27.39:443

170.253.25.35:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exewermgr.exe

pid	process
888	regsvr32.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe
1684	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

888 regsvr32.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

WScript.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1900 wrote to memory of 1620	1900	WScript.exe	regsvr32.exe
PID 1900 wrote to memory of 1620	1900	WScript.exe	regsvr32.exe
PID 1900 wrote to memory of 1620	1900	WScript.exe	regsvr32.exe
PID 1900 wrote to memory of 1620	1900	WScript.exe	regsvr32.exe
PID 1900 wrote to memory of 1620	1900	WScript.exe	regsvr32.exe
PID 1620 wrote to memory of 888	1620	regsvr32.exe	regsvr32.exe
PID 1620 wrote to memory of 888	1620	regsvr32.exe	regsvr32.exe
PID 1620 wrote to memory of 888	1620	regsvr32.exe	regsvr32.exe
PID 1620 wrote to memory of 888	1620	regsvr32.exe	regsvr32.exe
PID 1620 wrote to memory of 888	1620	regsvr32.exe	regsvr32.exe
PID 1620 wrote to memory of 888	1620	regsvr32.exe	regsvr32.exe
PID 1620 wrote to memory of 888	1620	regsvr32.exe	regsvr32.exe
PID 888 wrote to memory of 1684	888	regsvr32.exe	wermgr.exe
PID 888 wrote to memory of 1684	888	regsvr32.exe	wermgr.exe
PID 888 wrote to memory of 1684	888	regsvr32.exe	wermgr.exe
PID 888 wrote to memory of 1684	888	regsvr32.exe	wermgr.exe
PID 888 wrote to memory of 1684	888	regsvr32.exe	wermgr.exe
PID 888 wrote to memory of 1684	888	regsvr32.exe	wermgr.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\CV.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" inducted\\dialectician.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\regsvr32.exe
    inducted\\dialectician.tmp
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\Windows\SysWOW64\wermgr.exe
      C:\Windows\SysWOW64\wermgr.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/888-57-0x0000000000000000-mapping.dmp

Download
memory/888-58-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/888-59-0x0000000000390000-0x00000000003BA000-memory.dmp

Filesize
168KB

Download
memory/888-60-0x0000000000390000-0x00000000003BA000-memory.dmp

Filesize
168KB

Download
memory/888-61-0x00000000002B0000-0x00000000002DE000-memory.dmp

Filesize
184KB

Download
memory/888-62-0x0000000000390000-0x0000000000410000-memory.dmp

Filesize
512KB

Download
memory/888-65-0x0000000000390000-0x00000000003BA000-memory.dmp

Filesize
168KB

Download
memory/1620-55-0x0000000000000000-mapping.dmp

Download
memory/1684-63-0x0000000000000000-mapping.dmp

Download
memory/1684-66-0x00000000000C0000-0x00000000000EA000-memory.dmp

Filesize
168KB

Download
memory/1684-67-0x00000000000C0000-0x00000000000EA000-memory.dmp

Filesize
168KB

Download
memory/1900-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing