qakbot | 1821daab4216388a07240299c9d93478a49874b5c776e297e27fc4d7553229fa

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2022, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ContractCopy.js
Size 9KB
Sample221119-g7k7dagg25
SHA256 fbe4408e0c0a528f331fc002f785eff7ad16f45ae3ea3ab94eb8b3cbf0c6f00f
MD5 599ff2df10ec1a8497d760784e493885
SHA1 0b6342b8c43c76fbde2e714c2a7cda2bd1260d05
SHA512 08e93e1117220b0edc589505e5d3bba99c408deb5d9ce197df864cecf838a815850d9b3a0d5c6fef9ab86396bf5af230c9b1f58f3fdbfeb7db339f97bbc15dd5
SSDEEP 192:GSLjDJq0Tavgx685UIroAKbP2KTMhS0OGYm5llWVjAvNzAWMuEvk7MgG+r5A6:BVq2k785UIro8KTMhSeYm5P2jiuuEjP4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot obama222 1668692319 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

obama222

Campaign

1668692319

105.184.161.242:443
73.36.196.11:443
82.31.37.241:443
24.116.45.121:443
213.67.255.57:2222
200.93.14.206:2222
188.54.79.88:995
87.220.205.14:2222
72.88.245.71:443
92.137.74.174:2222
91.68.227.219:443
184.153.132.82:443
74.66.134.24:443
47.16.73.77:2222
41.97.183.39:443
177.205.92.100:2222
24.64.114.59:3389
105.111.45.51:995
86.180.222.237:2222
76.184.95.190:993
142.119.40.220:2222
92.27.86.48:2222
180.156.240.239:995
73.230.28.7:443
176.151.15.101:443
24.64.114.59:2222
86.165.15.180:2222
66.191.69.18:995
64.121.161.102:443
50.90.249.161:443
70.115.104.126:995
99.238.106.45:443
72.140.137.221:443
174.77.209.5:443
174.104.184.149:443
2.84.98.228:2222
76.127.192.23:443
50.68.204.71:443
109.11.175.42:2222
199.83.165.233:443
85.59.61.52:2222
85.139.176.42:2222
157.231.42.190:443
85.74.158.150:2222
12.172.173.82:2087
109.152.70.207:50000
12.172.173.82:22
50.68.204.71:995
45.248.169.101:443
76.20.42.45:443
2.8.39.175:2222
81.250.33.243:2222
213.91.235.146:443
136.35.241.159:443
82.121.73.56:2222
173.239.94.212:443
184.20.10.236:443
187.199.224.16:32103
183.82.100.110:2222
102.156.113.77:443
75.99.125.238:2222
82.121.237.106:2222
79.37.204.67:443
85.241.180.94:443
217.128.91.196:2222
12.172.173.82:443
91.180.68.95:2222
98.187.21.2:443
82.9.210.36:443
181.118.183.116:443
174.45.15.123:443
2.83.62.105:443
84.113.121.103:443
77.126.81.208:443
92.106.70.62:2222
12.172.173.82:993
212.251.122.147:995
102.157.69.217:995
69.119.123.159:2222
47.176.30.75:443
87.223.80.45:443
174.60.47.98:443
173.32.181.236:443
41.228.223.122:995
82.36.36.76:443
154.247.94.160:32103
12.172.173.82:50001
12.172.173.82:995
172.90.139.138:2222
86.175.128.143:443
75.143.236.149:443
75.98.154.19:443
81.156.198.115:2222
80.121.8.212:995
103.55.67.180:443
89.152.120.181:443
83.79.150.24:2222
74.92.243.113:50000
87.220.68.51:2222
69.133.162.35:443
80.103.77.44:2222
61.92.123.169:443
74.33.84.227:443
86.225.214.138:2222
80.189.213.49:2222
188.92.64.68:443
109.145.27.139:443
121.122.99.151:995
47.185.141.97:443
81.229.117.95:2222
84.35.26.14:995
68.47.128.161:443
71.31.101.183:443
75.191.246.70:443
41.35.196.18:995
87.65.160.87:995
88.126.94.4:50000
102.158.230.141:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2664	regsvr32.exe
2664	regsvr32.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe
3424	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2664	regsvr32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2784	1200	wscript.exe	79
PID 1200 wrote to memory of 2784	1200	wscript.exe	79
PID 2784 wrote to memory of 2664	2784	regsvr32.exe	80
PID 2784 wrote to memory of 2664	2784	regsvr32.exe	80
PID 2784 wrote to memory of 2664	2784	regsvr32.exe	80
PID 2664 wrote to memory of 3424	2664	regsvr32.exe	88
PID 2664 wrote to memory of 3424	2664	regsvr32.exe	88
PID 2664 wrote to memory of 3424	2664	regsvr32.exe	88
PID 2664 wrote to memory of 3424	2664	regsvr32.exe	88
PID 2664 wrote to memory of 3424	2664	regsvr32.exe	88

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ContractCopy.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" addled\soloists.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\regsvr32.exe
    addled\soloists.tmp
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\SysWOW64\wermgr.exe
      C:\Windows\SysWOW64\wermgr.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-134-0x00000000756A0000-0x0000000075767000-memory.dmp

Download

memory/2664-135-0x00000000756A0000-0x0000000075767000-memory.dmp

Download

memory/2664-136-0x00000000034B0000-0x0000000003523000-memory.dmp

Download

memory/2664-137-0x0000000003560000-0x000000000358A000-memory.dmp

Download

memory/2664-139-0x00000000756A0000-0x0000000075767000-memory.dmp

Download

memory/2664-140-0x0000000003560000-0x000000000358A000-memory.dmp

Download

memory/3424-141-0x0000000000D80000-0x0000000000DAA000-memory.dmp

Download

memory/3424-142-0x0000000000D80000-0x0000000000DAA000-memory.dmp

Download