qakbot | f90681a3c5525abdc8c0c0ec190f001ac79786c72fc23d5cf2b6ba8e6579a538

General

Target

XS.vbs
Size

9KB
MD5

9eff66dd9b4af8d717b391f2480f0685
SHA1

73300cf7a616a05e175ae4be611595f07a59a98f
SHA256

38cc60d96d146e02f46fe3102ecc61111b2e06258c0a1d8a44989d19e71be06b
SHA512

d234f09606ac2bb4758749dff5167d558e32ac539963e0de75c0e66b0306c3d1fdbb922de0f6efcc6c2a15f18c392ab56b9853e4ed009887fb3b3a2e084bef80
SSDEEP

192:NeSjpUorcl/E4hp3aD/OCMhiEe1mUS1G0vdzgW20fkbsgTbpQt:A4pnrcpE4hpPCMhidmnGm80jWb4

Score

10^/10

qakbot bb07 1669024152 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB07

Campaign

1669024152

C2

69.119.123.159:2222

197.148.17.17:2078

174.104.184.149:443

12.172.173.82:995

91.68.227.219:443

85.241.180.94:443

83.7.53.150:443

213.22.188.57:2222

71.46.234.170:443

190.75.150.58:2222

86.98.15.100:995

89.115.196.99:443

83.31.254.67:2222

46.162.109.183:443

2.84.98.228:2222

78.69.251.252:2222

12.172.173.82:465

75.143.236.149:443

47.229.96.60:443

80.121.8.212:995

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exewermgr.exe

pid	process
1532	regsvr32.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe
1208	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1532 regsvr32.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

WScript.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 916 wrote to memory of 1436	916	WScript.exe	regsvr32.exe
PID 916 wrote to memory of 1436	916	WScript.exe	regsvr32.exe
PID 916 wrote to memory of 1436	916	WScript.exe	regsvr32.exe
PID 916 wrote to memory of 1436	916	WScript.exe	regsvr32.exe
PID 916 wrote to memory of 1436	916	WScript.exe	regsvr32.exe
PID 1436 wrote to memory of 1532	1436	regsvr32.exe	regsvr32.exe
PID 1436 wrote to memory of 1532	1436	regsvr32.exe	regsvr32.exe
PID 1436 wrote to memory of 1532	1436	regsvr32.exe	regsvr32.exe
PID 1436 wrote to memory of 1532	1436	regsvr32.exe	regsvr32.exe
PID 1436 wrote to memory of 1532	1436	regsvr32.exe	regsvr32.exe
PID 1436 wrote to memory of 1532	1436	regsvr32.exe	regsvr32.exe
PID 1436 wrote to memory of 1532	1436	regsvr32.exe	regsvr32.exe
PID 1532 wrote to memory of 1208	1532	regsvr32.exe	wermgr.exe
PID 1532 wrote to memory of 1208	1532	regsvr32.exe	wermgr.exe
PID 1532 wrote to memory of 1208	1532	regsvr32.exe	wermgr.exe
PID 1532 wrote to memory of 1208	1532	regsvr32.exe	wermgr.exe
PID 1532 wrote to memory of 1208	1532	regsvr32.exe	wermgr.exe
PID 1532 wrote to memory of 1208	1532	regsvr32.exe	wermgr.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\XS.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" gray\\hindmost.temp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\SysWOW64\regsvr32.exe
    gray\\hindmost.temp
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\SysWOW64\wermgr.exe
      C:\Windows\SysWOW64\wermgr.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-54-0x000007FEFBCA1000-0x000007FEFBCA3000-memory.dmp

Filesize
8KB

Download
memory/1208-61-0x0000000000000000-mapping.dmp

Download
memory/1208-64-0x00000000000C0000-0x00000000000EA000-memory.dmp

Filesize
168KB

Download
memory/1208-65-0x00000000000C0000-0x00000000000EA000-memory.dmp

Filesize
168KB

Download
memory/1436-55-0x0000000000000000-mapping.dmp

Download
memory/1532-57-0x0000000000000000-mapping.dmp

Download
memory/1532-58-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/1532-59-0x0000000000AA0000-0x0000000000BFC000-memory.dmp

Filesize
1.4MB

Download
memory/1532-60-0x00000000006E0000-0x000000000070A000-memory.dmp

Filesize
168KB

Download
memory/1532-63-0x00000000006E0000-0x000000000070A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing