qakbot | 4153a179adec63180997585a07dcd08b374781ca73c3b649173976d3d0078b96

General

Target

SK.js
Size

9KB
MD5

78c2da9c44463c07818c0988ee2577af
SHA1

609cfa708ba1c7a814a66c551d9ea33b9064f90d
SHA256

f17e6e6b3d207b58aff019871da14eb52aec46eaa7ca1a0409fb5b1f834d5c81
SHA512

d66d58b2ad84c7849ddb58933b9a9f200b368d7c642b760c84527b35cbc68ba891e03b5203fc893cc3b90ff2b5d53185fa0784527661caa4c792f530569ccc87
SSDEEP

192:cPSLj50Tavgx685UIhpHKbP2KTMhS0OGYm9lWVjAvNzAWM5Evk7MgG+r5AJ:752k785UIhp/KTMhSeYmn2jiu5EjP+rs

Score

10^/10

qakbot bb06 1668752705 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668752705

C2

98.147.155.235:443

49.175.72.56:443

82.31.37.241:443

73.36.196.11:443

2.84.98.228:2222

188.54.79.88:995

184.153.132.82:443

74.66.134.24:443

172.117.139.142:995

12.172.173.82:990

24.64.114.59:3389

12.172.173.82:2087

78.92.133.215:443

24.64.114.59:2222

50.68.204.71:995

105.184.161.242:443

12.172.173.82:22

221.161.103.6:443

98.145.23.67:443

73.161.176.218:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Extracted

Family

qakbot

Attributes

salt
~�w%��N$��0��U��J��m�/

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

836 net.exe
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exenetstat.exe

pid process

1628 ipconfig.exe
1240 netstat.exe
Runs net.exe

pid	process
836	net.exe

pid	process
1628	ipconfig.exe
1240	netstat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exewermgr.exe

pid	process
784	regsvr32.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe
1880	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

784 regsvr32.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

Processes:

netstat.exewhoami.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1240	netstat.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeDebugPrivilege	1836	whoami.exe
Token: SeRestorePrivilege	1888	msiexec.exe
Token: SeTakeOwnershipPrivilege	1888	msiexec.exe
Token: SeSecurityPrivilege	1888	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

wscript.exeregsvr32.exeregsvr32.exewermgr.exenet.exenet.exe

description	pid	process	target process
PID 1184 wrote to memory of 1756	1184	wscript.exe	regsvr32.exe
PID 1184 wrote to memory of 1756	1184	wscript.exe	regsvr32.exe
PID 1184 wrote to memory of 1756	1184	wscript.exe	regsvr32.exe
PID 1184 wrote to memory of 1756	1184	wscript.exe	regsvr32.exe
PID 1184 wrote to memory of 1756	1184	wscript.exe	regsvr32.exe
PID 1756 wrote to memory of 784	1756	regsvr32.exe	regsvr32.exe
PID 1756 wrote to memory of 784	1756	regsvr32.exe	regsvr32.exe
PID 1756 wrote to memory of 784	1756	regsvr32.exe	regsvr32.exe
PID 1756 wrote to memory of 784	1756	regsvr32.exe	regsvr32.exe
PID 1756 wrote to memory of 784	1756	regsvr32.exe	regsvr32.exe
PID 1756 wrote to memory of 784	1756	regsvr32.exe	regsvr32.exe
PID 1756 wrote to memory of 784	1756	regsvr32.exe	regsvr32.exe
PID 784 wrote to memory of 1880	784	regsvr32.exe	wermgr.exe
PID 784 wrote to memory of 1880	784	regsvr32.exe	wermgr.exe
PID 784 wrote to memory of 1880	784	regsvr32.exe	wermgr.exe
PID 784 wrote to memory of 1880	784	regsvr32.exe	wermgr.exe
PID 784 wrote to memory of 1880	784	regsvr32.exe	wermgr.exe
PID 784 wrote to memory of 1880	784	regsvr32.exe	wermgr.exe
PID 1880 wrote to memory of 836	1880	wermgr.exe	net.exe
PID 1880 wrote to memory of 836	1880	wermgr.exe	net.exe
PID 1880 wrote to memory of 836	1880	wermgr.exe	net.exe
PID 1880 wrote to memory of 836	1880	wermgr.exe	net.exe
PID 1880 wrote to memory of 1720	1880	wermgr.exe	cmd.exe
PID 1880 wrote to memory of 1720	1880	wermgr.exe	cmd.exe
PID 1880 wrote to memory of 1720	1880	wermgr.exe	cmd.exe
PID 1880 wrote to memory of 1720	1880	wermgr.exe	cmd.exe
PID 1880 wrote to memory of 948	1880	wermgr.exe	arp.exe
PID 1880 wrote to memory of 948	1880	wermgr.exe	arp.exe
PID 1880 wrote to memory of 948	1880	wermgr.exe	arp.exe
PID 1880 wrote to memory of 948	1880	wermgr.exe	arp.exe
PID 1880 wrote to memory of 1628	1880	wermgr.exe	ipconfig.exe
PID 1880 wrote to memory of 1628	1880	wermgr.exe	ipconfig.exe
PID 1880 wrote to memory of 1628	1880	wermgr.exe	ipconfig.exe
PID 1880 wrote to memory of 1628	1880	wermgr.exe	ipconfig.exe
PID 1880 wrote to memory of 320	1880	wermgr.exe	nslookup.exe
PID 1880 wrote to memory of 320	1880	wermgr.exe	nslookup.exe
PID 1880 wrote to memory of 320	1880	wermgr.exe	nslookup.exe
PID 1880 wrote to memory of 320	1880	wermgr.exe	nslookup.exe
PID 1880 wrote to memory of 864	1880	wermgr.exe	net.exe
PID 1880 wrote to memory of 864	1880	wermgr.exe	net.exe
PID 1880 wrote to memory of 864	1880	wermgr.exe	net.exe
PID 1880 wrote to memory of 864	1880	wermgr.exe	net.exe
PID 864 wrote to memory of 1756	864	net.exe	net1.exe
PID 864 wrote to memory of 1756	864	net.exe	net1.exe
PID 864 wrote to memory of 1756	864	net.exe	net1.exe
PID 864 wrote to memory of 1756	864	net.exe	net1.exe
PID 1880 wrote to memory of 984	1880	wermgr.exe	route.exe
PID 1880 wrote to memory of 984	1880	wermgr.exe	route.exe
PID 1880 wrote to memory of 984	1880	wermgr.exe	route.exe
PID 1880 wrote to memory of 984	1880	wermgr.exe	route.exe
PID 1880 wrote to memory of 1240	1880	wermgr.exe	netstat.exe
PID 1880 wrote to memory of 1240	1880	wermgr.exe	netstat.exe
PID 1880 wrote to memory of 1240	1880	wermgr.exe	netstat.exe
PID 1880 wrote to memory of 1240	1880	wermgr.exe	netstat.exe
PID 1880 wrote to memory of 1180	1880	wermgr.exe	net.exe
PID 1880 wrote to memory of 1180	1880	wermgr.exe	net.exe
PID 1880 wrote to memory of 1180	1880	wermgr.exe	net.exe
PID 1880 wrote to memory of 1180	1880	wermgr.exe	net.exe
PID 1180 wrote to memory of 1340	1180	net.exe	net1.exe
PID 1180 wrote to memory of 1340	1180	net.exe	net1.exe
PID 1180 wrote to memory of 1340	1180	net.exe	net1.exe
PID 1180 wrote to memory of 1340	1180	net.exe	net1.exe
PID 1880 wrote to memory of 1836	1880	wermgr.exe	whoami.exe
PID 1880 wrote to memory of 1836	1880	wermgr.exe	whoami.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\SK.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" manacle\wined.temp
2⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\regsvr32.exe
manacle\wined.temp
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\SysWOW64\net.exe
net view
5⤵
- Discovers systems in the same network
PID:836

C:\Windows\SysWOW64\cmd.exe
cmd /c set
5⤵
PID:1720

C:\Windows\SysWOW64\arp.exe
arp -a
5⤵
PID:948

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
5⤵
- Gathers network information
PID:1628

C:\Windows\SysWOW64\nslookup.exe
nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.WORKGROUP
5⤵
PID:320

C:\Windows\SysWOW64\net.exe
net share
5⤵
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 share
6⤵
PID:1756

C:\Windows\SysWOW64\route.exe
route print
5⤵
PID:984

C:\Windows\SysWOW64\netstat.exe
netstat -nao
5⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Windows\SysWOW64\net.exe
net localgroup
5⤵
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup
6⤵
PID:1340

C:\Windows\SysWOW64\whoami.exe
whoami /all
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-73-0x0000000000000000-mapping.dmp

Download
memory/784-63-0x0000000000190000-0x0000000000210000-memory.dmp

Filesize
512KB

Download
memory/784-57-0x0000000000000000-mapping.dmp

Download
memory/784-58-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/784-60-0x00000000001C0000-0x00000000001EA000-memory.dmp

Filesize
168KB

Download
memory/784-59-0x00000000001C0000-0x00000000001EA000-memory.dmp

Filesize
168KB

Download
memory/784-61-0x0000000000190000-0x0000000000210000-memory.dmp

Filesize
512KB

Download
memory/784-62-0x0000000000190000-0x0000000000210000-memory.dmp

Filesize
512KB

Download
memory/836-68-0x0000000000000000-mapping.dmp

Download
memory/864-74-0x0000000000000000-mapping.dmp

Download
memory/948-70-0x0000000000000000-mapping.dmp

Download
memory/984-76-0x0000000000000000-mapping.dmp

Download
memory/1180-78-0x0000000000000000-mapping.dmp

Download
memory/1184-54-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Filesize
8KB

Download
memory/1240-77-0x0000000000000000-mapping.dmp

Download
memory/1340-79-0x0000000000000000-mapping.dmp

Download
memory/1628-71-0x0000000000000000-mapping.dmp

Download
memory/1720-69-0x0000000000000000-mapping.dmp

Download
memory/1756-55-0x0000000000000000-mapping.dmp

Download
memory/1756-75-0x0000000000000000-mapping.dmp

Download
memory/1836-80-0x0000000000000000-mapping.dmp

Download
memory/1880-64-0x0000000000000000-mapping.dmp

Download
memory/1880-67-0x00000000000D0000-0x00000000000FA000-memory.dmp

Filesize
168KB

Download
memory/1880-66-0x00000000000D0000-0x00000000000FA000-memory.dmp

Filesize
168KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads