qakbot | 4153a179adec63180997585a07dcd08b374781ca73c3b649173976d3d0078b96

General

Target

SK.js
Size

9KB
MD5

78c2da9c44463c07818c0988ee2577af
SHA1

609cfa708ba1c7a814a66c551d9ea33b9064f90d
SHA256

f17e6e6b3d207b58aff019871da14eb52aec46eaa7ca1a0409fb5b1f834d5c81
SHA512

d66d58b2ad84c7849ddb58933b9a9f200b368d7c642b760c84527b35cbc68ba891e03b5203fc893cc3b90ff2b5d53185fa0784527661caa4c792f530569ccc87
SSDEEP

192:cPSLj50Tavgx685UIhpHKbP2KTMhS0OGYm9lWVjAvNzAWM5Evk7MgG+r5AJ:752k785UIhp/KTMhSeYmn2jiu5EjP+rs

Score

10^/10

qakbot bb06 1668752705 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668752705

C2

98.147.155.235:443

49.175.72.56:443

82.31.37.241:443

73.36.196.11:443

2.84.98.228:2222

188.54.79.88:995

184.153.132.82:443

74.66.134.24:443

172.117.139.142:995

12.172.173.82:990

24.64.114.59:3389

12.172.173.82:2087

78.92.133.215:443

24.64.114.59:2222

50.68.204.71:995

105.184.161.242:443

12.172.173.82:22

221.161.103.6:443

98.145.23.67:443

73.161.176.218:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

1888 net.exe
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exenetstat.exe

pid process

3880 ipconfig.exe
2220 netstat.exe
Runs net.exe

pid	process
1888	net.exe

pid	process
3880	ipconfig.exe
2220	netstat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exewermgr.exe

pid	process
3200	regsvr32.exe
3200	regsvr32.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe
2188	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

3200 regsvr32.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes:

netstat.exewhoami.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	2220	netstat.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeDebugPrivilege	3280	whoami.exe
Token: SeSecurityPrivilege	4116	msiexec.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

wscript.exeregsvr32.exeregsvr32.exewermgr.exenet.exenet.exe

description	pid	process	target process
PID 4864 wrote to memory of 4256	4864	wscript.exe	regsvr32.exe
PID 4864 wrote to memory of 4256	4864	wscript.exe	regsvr32.exe
PID 4256 wrote to memory of 3200	4256	regsvr32.exe	regsvr32.exe
PID 4256 wrote to memory of 3200	4256	regsvr32.exe	regsvr32.exe
PID 4256 wrote to memory of 3200	4256	regsvr32.exe	regsvr32.exe
PID 3200 wrote to memory of 2188	3200	regsvr32.exe	wermgr.exe
PID 3200 wrote to memory of 2188	3200	regsvr32.exe	wermgr.exe
PID 3200 wrote to memory of 2188	3200	regsvr32.exe	wermgr.exe
PID 3200 wrote to memory of 2188	3200	regsvr32.exe	wermgr.exe
PID 3200 wrote to memory of 2188	3200	regsvr32.exe	wermgr.exe
PID 2188 wrote to memory of 1888	2188	wermgr.exe	net.exe
PID 2188 wrote to memory of 1888	2188	wermgr.exe	net.exe
PID 2188 wrote to memory of 1888	2188	wermgr.exe	net.exe
PID 2188 wrote to memory of 2216	2188	wermgr.exe	cmd.exe
PID 2188 wrote to memory of 2216	2188	wermgr.exe	cmd.exe
PID 2188 wrote to memory of 2216	2188	wermgr.exe	cmd.exe
PID 2188 wrote to memory of 1260	2188	wermgr.exe	arp.exe
PID 2188 wrote to memory of 1260	2188	wermgr.exe	arp.exe
PID 2188 wrote to memory of 1260	2188	wermgr.exe	arp.exe
PID 2188 wrote to memory of 3880	2188	wermgr.exe	ipconfig.exe
PID 2188 wrote to memory of 3880	2188	wermgr.exe	ipconfig.exe
PID 2188 wrote to memory of 3880	2188	wermgr.exe	ipconfig.exe
PID 2188 wrote to memory of 3432	2188	wermgr.exe	nslookup.exe
PID 2188 wrote to memory of 3432	2188	wermgr.exe	nslookup.exe
PID 2188 wrote to memory of 3432	2188	wermgr.exe	nslookup.exe
PID 2188 wrote to memory of 1268	2188	wermgr.exe	net.exe
PID 2188 wrote to memory of 1268	2188	wermgr.exe	net.exe
PID 2188 wrote to memory of 1268	2188	wermgr.exe	net.exe
PID 1268 wrote to memory of 3080	1268	net.exe	net1.exe
PID 1268 wrote to memory of 3080	1268	net.exe	net1.exe
PID 1268 wrote to memory of 3080	1268	net.exe	net1.exe
PID 2188 wrote to memory of 4360	2188	wermgr.exe	route.exe
PID 2188 wrote to memory of 4360	2188	wermgr.exe	route.exe
PID 2188 wrote to memory of 4360	2188	wermgr.exe	route.exe
PID 2188 wrote to memory of 2220	2188	wermgr.exe	netstat.exe
PID 2188 wrote to memory of 2220	2188	wermgr.exe	netstat.exe
PID 2188 wrote to memory of 2220	2188	wermgr.exe	netstat.exe
PID 2188 wrote to memory of 1404	2188	wermgr.exe	net.exe
PID 2188 wrote to memory of 1404	2188	wermgr.exe	net.exe
PID 2188 wrote to memory of 1404	2188	wermgr.exe	net.exe
PID 1404 wrote to memory of 2436	1404	net.exe	net1.exe
PID 1404 wrote to memory of 2436	1404	net.exe	net1.exe
PID 1404 wrote to memory of 2436	1404	net.exe	net1.exe
PID 2188 wrote to memory of 3280	2188	wermgr.exe	whoami.exe
PID 2188 wrote to memory of 3280	2188	wermgr.exe	whoami.exe
PID 2188 wrote to memory of 3280	2188	wermgr.exe	whoami.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\SK.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" manacle\wined.temp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\SysWOW64\regsvr32.exe
    manacle\wined.temp
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Windows\SysWOW64\wermgr.exe
      C:\Windows\SysWOW64\wermgr.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2188
    - - C:\Windows\SysWOW64\net.exe
        
        net view
        5⤵
        Discovers systems in the same network
        
        PID:1888
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set
        5⤵
        
        PID:2216
    - - C:\Windows\SysWOW64\arp.exe
        
        arp -a
        5⤵
        
        PID:1260
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /all
        5⤵
        Gathers network information
        
        PID:3880
    - - C:\Windows\SysWOW64\nslookup.exe
        
        nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.WORKGROUP
        5⤵
        
        PID:3432
    - - C:\Windows\SysWOW64\net.exe
        
        net share
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1268
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share
        6⤵
        
        PID:3080
    - - C:\Windows\SysWOW64\route.exe
        
        route print
        5⤵
        
        PID:4360
    - - C:\Windows\SysWOW64\netstat.exe
        
        netstat -nao
        5⤵
        Gathers network information
        Suspicious use of AdjustPrivilegeToken
        
        PID:2220
    - - C:\Windows\SysWOW64\net.exe
        
        net localgroup
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1404
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup
        6⤵
        
        PID:2436
    - - C:\Windows\SysWOW64\whoami.exe
        
        whoami /all
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3280

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-142-0x0000000000000000-mapping.dmp

Download
memory/1268-145-0x0000000000000000-mapping.dmp

Download
memory/1404-149-0x0000000000000000-mapping.dmp

Download
memory/1888-140-0x0000000000000000-mapping.dmp

Download
memory/2188-136-0x0000000000000000-mapping.dmp

Download
memory/2188-138-0x0000000000910000-0x000000000093A000-memory.dmp

Filesize
168KB

Download
memory/2188-139-0x0000000000910000-0x000000000093A000-memory.dmp

Filesize
168KB

Download
memory/2216-141-0x0000000000000000-mapping.dmp

Download
memory/2220-148-0x0000000000000000-mapping.dmp

Download
memory/2436-150-0x0000000000000000-mapping.dmp

Download
memory/3080-146-0x0000000000000000-mapping.dmp

Download
memory/3200-137-0x0000000000780000-0x00000000007AA000-memory.dmp

Filesize
168KB

Download
memory/3200-135-0x0000000000780000-0x00000000007AA000-memory.dmp

Filesize
168KB

Download
memory/3200-134-0x0000000000750000-0x000000000077E000-memory.dmp

Filesize
184KB

Download
memory/3200-133-0x0000000000000000-mapping.dmp

Download
memory/3280-151-0x0000000000000000-mapping.dmp

Download
memory/3432-144-0x0000000000000000-mapping.dmp

Download
memory/3880-143-0x0000000000000000-mapping.dmp

Download
memory/4256-132-0x0000000000000000-mapping.dmp

Download
memory/4360-147-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads