qakbot | 078d03f798ce2c658d0fc1267ba141e836ca618e136c8f01b778f1e8bfb3721b

General

Target

AS.js
Size

143B
MD5

7249f0cf1e44e8e7a3642e2bbb0c0b1f
SHA1

49d2212ddc7444087928b7a4a2e2adb72febca85
SHA256

02049dd1dce83d87edaa23656c4327af83be55f67f793afac7203ac4c12a76e9
SHA512

b5b72aedc217c69ec6385f63575b8e0b77e35334ff673cf8a107b64f517bf762e8464da5c749c160576c26fa6b7198e62266dfd40d497daab3d535b7cee19296

Score

10^/10

qakbot bb08 1669628564 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

BB08

Campaign

1669628564

C2

98.147.155.235:443

85.52.73.34:2222

75.158.15.211:443

2.91.184.252:995

92.106.70.62:2222

85.152.152.46:443

86.159.48.25:2222

217.128.91.196:2222

92.11.189.236:2222

83.92.85.93:443

2.83.62.105:443

93.24.192.142:20

76.20.42.45:443

24.64.114.59:2078

73.36.196.11:443

130.43.99.103:995

172.117.139.142:995

100.16.107.117:443

12.172.173.82:22

176.151.15.101:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1148 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

1556 net.exe
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

netstat.exeipconfig.exe

pid process

1932 netstat.exe
1652 ipconfig.exe
Runs net.exe

pid	process
1148	rundll32.exe

pid	process
1556	net.exe

pid	process
1932	netstat.exe
1652	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exerundll32.exewermgr.exe

pid	process
564	powershell.exe
564	powershell.exe
1148	rundll32.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe
1628	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1148 rundll32.exe

pid	process
1148	rundll32.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

Processes:

powershell.exenetstat.exewhoami.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	564	powershell.exe
Token: SeDebugPrivilege	1932	netstat.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeDebugPrivilege	320	whoami.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeSecurityPrivilege	1444	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

wscript.exepowershell.exerundll32.exerundll32.exewermgr.exenet.exenet.exe

description	pid	process	target process
PID 1792 wrote to memory of 564	1792	wscript.exe	powershell.exe
PID 1792 wrote to memory of 564	1792	wscript.exe	powershell.exe
PID 1792 wrote to memory of 564	1792	wscript.exe	powershell.exe
PID 564 wrote to memory of 540	564	powershell.exe	rundll32.exe
PID 564 wrote to memory of 540	564	powershell.exe	rundll32.exe
PID 564 wrote to memory of 540	564	powershell.exe	rundll32.exe
PID 540 wrote to memory of 1148	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 1148	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 1148	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 1148	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 1148	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 1148	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 1148	540	rundll32.exe	rundll32.exe
PID 1148 wrote to memory of 1628	1148	rundll32.exe	wermgr.exe
PID 1148 wrote to memory of 1628	1148	rundll32.exe	wermgr.exe
PID 1148 wrote to memory of 1628	1148	rundll32.exe	wermgr.exe
PID 1148 wrote to memory of 1628	1148	rundll32.exe	wermgr.exe
PID 1148 wrote to memory of 1628	1148	rundll32.exe	wermgr.exe
PID 1148 wrote to memory of 1628	1148	rundll32.exe	wermgr.exe
PID 1628 wrote to memory of 1556	1628	wermgr.exe	net.exe
PID 1628 wrote to memory of 1556	1628	wermgr.exe	net.exe
PID 1628 wrote to memory of 1556	1628	wermgr.exe	net.exe
PID 1628 wrote to memory of 1556	1628	wermgr.exe	net.exe
PID 1628 wrote to memory of 1976	1628	wermgr.exe	cmd.exe
PID 1628 wrote to memory of 1976	1628	wermgr.exe	cmd.exe
PID 1628 wrote to memory of 1976	1628	wermgr.exe	cmd.exe
PID 1628 wrote to memory of 1976	1628	wermgr.exe	cmd.exe
PID 1628 wrote to memory of 1964	1628	wermgr.exe	arp.exe
PID 1628 wrote to memory of 1964	1628	wermgr.exe	arp.exe
PID 1628 wrote to memory of 1964	1628	wermgr.exe	arp.exe
PID 1628 wrote to memory of 1964	1628	wermgr.exe	arp.exe
PID 1628 wrote to memory of 1652	1628	wermgr.exe	ipconfig.exe
PID 1628 wrote to memory of 1652	1628	wermgr.exe	ipconfig.exe
PID 1628 wrote to memory of 1652	1628	wermgr.exe	ipconfig.exe
PID 1628 wrote to memory of 1652	1628	wermgr.exe	ipconfig.exe
PID 1628 wrote to memory of 936	1628	wermgr.exe	nslookup.exe
PID 1628 wrote to memory of 936	1628	wermgr.exe	nslookup.exe
PID 1628 wrote to memory of 936	1628	wermgr.exe	nslookup.exe
PID 1628 wrote to memory of 936	1628	wermgr.exe	nslookup.exe
PID 1628 wrote to memory of 840	1628	wermgr.exe	net.exe
PID 1628 wrote to memory of 840	1628	wermgr.exe	net.exe
PID 1628 wrote to memory of 840	1628	wermgr.exe	net.exe
PID 1628 wrote to memory of 840	1628	wermgr.exe	net.exe
PID 840 wrote to memory of 1040	840	net.exe	net1.exe
PID 840 wrote to memory of 1040	840	net.exe	net1.exe
PID 840 wrote to memory of 1040	840	net.exe	net1.exe
PID 840 wrote to memory of 1040	840	net.exe	net1.exe
PID 1628 wrote to memory of 1780	1628	wermgr.exe	route.exe
PID 1628 wrote to memory of 1780	1628	wermgr.exe	route.exe
PID 1628 wrote to memory of 1780	1628	wermgr.exe	route.exe
PID 1628 wrote to memory of 1780	1628	wermgr.exe	route.exe
PID 1628 wrote to memory of 1932	1628	wermgr.exe	netstat.exe
PID 1628 wrote to memory of 1932	1628	wermgr.exe	netstat.exe
PID 1628 wrote to memory of 1932	1628	wermgr.exe	netstat.exe
PID 1628 wrote to memory of 1932	1628	wermgr.exe	netstat.exe
PID 1628 wrote to memory of 1924	1628	wermgr.exe	net.exe
PID 1628 wrote to memory of 1924	1628	wermgr.exe	net.exe
PID 1628 wrote to memory of 1924	1628	wermgr.exe	net.exe
PID 1628 wrote to memory of 1924	1628	wermgr.exe	net.exe
PID 1924 wrote to memory of 1116	1924	net.exe	net1.exe
PID 1924 wrote to memory of 1116	1924	net.exe	net1.exe
PID 1924 wrote to memory of 1116	1924	net.exe	net1.exe
PID 1924 wrote to memory of 1116	1924	net.exe	net1.exe
PID 1628 wrote to memory of 320	1628	wermgr.exe	whoami.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\AS.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass fix\hypersensitiveness.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\users\public\pickedKnelled.jpg DrawThemeIcon
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:540
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\users\public\pickedKnelled.jpg DrawThemeIcon
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1148
    - - C:\Windows\SysWOW64\wermgr.exe
        
        C:\Windows\SysWOW64\wermgr.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1628
      - C:\Windows\SysWOW64\net.exe
        
        net view
        6⤵
        Discovers systems in the same network
        
        PID:1556
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c set
        6⤵
        
        PID:1976
      - C:\Windows\SysWOW64\arp.exe
        
        arp -a
        6⤵
        
        PID:1964
      - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /all
        6⤵
        Gathers network information
        
        PID:1652
      - C:\Windows\SysWOW64\nslookup.exe
        
        nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.WORKGROUP
        6⤵
        
        PID:936
      - C:\Windows\SysWOW64\net.exe
        
        net share
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:840
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share
        7⤵
        
        PID:1040
      - C:\Windows\SysWOW64\route.exe
        
        route print
        6⤵
        
        PID:1780
      - C:\Windows\SysWOW64\netstat.exe
        
        netstat -nao
        6⤵
        Gathers network information
        Suspicious use of AdjustPrivilegeToken
        
        PID:1932
      - C:\Windows\SysWOW64\net.exe
        
        net localgroup
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1924
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup
        7⤵
        
        PID:1116
      - C:\Windows\SysWOW64\whoami.exe
        
        whoami /all
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:320

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\users\public\pickedKnelled.jpg

Filesize
472KB

MD5
4d3ca6ea1b0f9010a53a870f475c40ab

SHA1
59f1755050abcec7f5a3e4a217aeaaa7487ce32b

SHA256
2bbe82d038bd24cc3e5e579f8a90e4229c6dff6a17fe0609caddfa045e18d36a

SHA512
62a10a6f700e23167f9a34cde909b061d170d90aee159ba3f06de916290ccc7012060881ce68c7058878578a1ead5d14d1248a14800007eacc4e580648f1c19a

Download Submit
\??\PIPE\samr

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Public\pickedKnelled.jpg

Filesize
472KB

MD5
4d3ca6ea1b0f9010a53a870f475c40ab

SHA1
59f1755050abcec7f5a3e4a217aeaaa7487ce32b

SHA256
2bbe82d038bd24cc3e5e579f8a90e4229c6dff6a17fe0609caddfa045e18d36a

SHA512
62a10a6f700e23167f9a34cde909b061d170d90aee159ba3f06de916290ccc7012060881ce68c7058878578a1ead5d14d1248a14800007eacc4e580648f1c19a

Download Submit
memory/320-93-0x0000000000000000-mapping.dmp

Download
memory/540-63-0x0000000000000000-mapping.dmp

Download
memory/564-55-0x0000000000000000-mapping.dmp

Download
memory/564-61-0x000000000285B000-0x000000000287A000-memory.dmp

Filesize
124KB

Download
memory/564-62-0x0000000002854000-0x0000000002857000-memory.dmp

Filesize
12KB

Download
memory/564-65-0x000000000285B000-0x000000000287A000-memory.dmp

Filesize
124KB

Download
memory/564-64-0x0000000002854000-0x0000000002857000-memory.dmp

Filesize
12KB

Download
memory/564-59-0x0000000002854000-0x0000000002857000-memory.dmp

Filesize
12KB

Download
memory/564-58-0x000007FEF2DE0000-0x000007FEF393D000-memory.dmp

Filesize
11.4MB

Download
memory/564-57-0x000007FEF3940000-0x000007FEF4363000-memory.dmp

Filesize
10.1MB

Download
memory/564-60-0x000000001B710000-0x000000001BA0F000-memory.dmp

Filesize
3.0MB

Download
memory/840-86-0x0000000000000000-mapping.dmp

Download
memory/936-85-0x0000000000000000-mapping.dmp

Download
memory/1040-87-0x0000000000000000-mapping.dmp

Download
memory/1116-91-0x0000000000000000-mapping.dmp

Download
memory/1148-73-0x00000000001A0000-0x00000000001CA000-memory.dmp

Filesize
168KB

Download
memory/1148-71-0x00000000001A0000-0x00000000001CA000-memory.dmp

Filesize
168KB

Download
memory/1148-77-0x00000000001A0000-0x00000000001CA000-memory.dmp

Filesize
168KB

Download
memory/1148-67-0x0000000000000000-mapping.dmp

Download
memory/1148-68-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download
memory/1148-74-0x00000000001A0000-0x00000000001CA000-memory.dmp

Filesize
168KB

Download
memory/1148-70-0x00000000001A0000-0x00000000001CA000-memory.dmp

Filesize
168KB

Download
memory/1148-72-0x0000000000170000-0x000000000019A000-memory.dmp

Filesize
168KB

Download
memory/1556-80-0x0000000000000000-mapping.dmp

Download
memory/1628-75-0x0000000000000000-mapping.dmp

Download
memory/1628-78-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/1628-79-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/1652-83-0x0000000000000000-mapping.dmp

Download
memory/1780-88-0x0000000000000000-mapping.dmp

Download
memory/1792-54-0x000007FEFBCA1000-0x000007FEFBCA3000-memory.dmp

Filesize
8KB

Download
memory/1924-90-0x0000000000000000-mapping.dmp

Download
memory/1932-89-0x0000000000000000-mapping.dmp

Download
memory/1964-82-0x0000000000000000-mapping.dmp

Download
memory/1976-81-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads