qakbot | 078d03f798ce2c658d0fc1267ba141e836ca618e136c8f01b778f1e8bfb3721b

General

Target

AS.js
Size

143B
MD5

7249f0cf1e44e8e7a3642e2bbb0c0b1f
SHA1

49d2212ddc7444087928b7a4a2e2adb72febca85
SHA256

02049dd1dce83d87edaa23656c4327af83be55f67f793afac7203ac4c12a76e9
SHA512

b5b72aedc217c69ec6385f63575b8e0b77e35334ff673cf8a107b64f517bf762e8464da5c749c160576c26fa6b7198e62266dfd40d497daab3d535b7cee19296

Score

10^/10

qakbot bb08 1669628564 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

BB08

Campaign

1669628564

C2

98.147.155.235:443

85.52.73.34:2222

75.158.15.211:443

2.91.184.252:995

92.106.70.62:2222

85.152.152.46:443

86.159.48.25:2222

217.128.91.196:2222

92.11.189.236:2222

83.92.85.93:443

2.83.62.105:443

93.24.192.142:20

76.20.42.45:443

24.64.114.59:2078

73.36.196.11:443

130.43.99.103:995

172.117.139.142:995

100.16.107.117:443

12.172.173.82:22

176.151.15.101:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2668 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

2072 net.exe
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exenetstat.exe

pid process

2200 ipconfig.exe
2524 netstat.exe
Runs net.exe

pid	process
2668	rundll32.exe

pid	process
2072	net.exe

pid	process
2200	ipconfig.exe
2524	netstat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exerundll32.exewermgr.exe

pid	process
1484	powershell.exe
1484	powershell.exe
2668	rundll32.exe
2668	rundll32.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe
4680	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2668 rundll32.exe

pid	process
2668	rundll32.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

Processes:

powershell.exenetstat.exewhoami.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	2524	netstat.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeDebugPrivilege	1328	whoami.exe
Token: SeSecurityPrivilege	4328	msiexec.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

wscript.exepowershell.exerundll32.exerundll32.exewermgr.exenet.exenet.exe

description	pid	process	target process
PID 2836 wrote to memory of 1484	2836	wscript.exe	powershell.exe
PID 2836 wrote to memory of 1484	2836	wscript.exe	powershell.exe
PID 1484 wrote to memory of 2004	1484	powershell.exe	rundll32.exe
PID 1484 wrote to memory of 2004	1484	powershell.exe	rundll32.exe
PID 2004 wrote to memory of 2668	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2668	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2668	2004	rundll32.exe	rundll32.exe
PID 2668 wrote to memory of 4680	2668	rundll32.exe	wermgr.exe
PID 2668 wrote to memory of 4680	2668	rundll32.exe	wermgr.exe
PID 2668 wrote to memory of 4680	2668	rundll32.exe	wermgr.exe
PID 2668 wrote to memory of 4680	2668	rundll32.exe	wermgr.exe
PID 2668 wrote to memory of 4680	2668	rundll32.exe	wermgr.exe
PID 4680 wrote to memory of 2072	4680	wermgr.exe	net.exe
PID 4680 wrote to memory of 2072	4680	wermgr.exe	net.exe
PID 4680 wrote to memory of 2072	4680	wermgr.exe	net.exe
PID 4680 wrote to memory of 2232	4680	wermgr.exe	cmd.exe
PID 4680 wrote to memory of 2232	4680	wermgr.exe	cmd.exe
PID 4680 wrote to memory of 2232	4680	wermgr.exe	cmd.exe
PID 4680 wrote to memory of 4976	4680	wermgr.exe	arp.exe
PID 4680 wrote to memory of 4976	4680	wermgr.exe	arp.exe
PID 4680 wrote to memory of 4976	4680	wermgr.exe	arp.exe
PID 4680 wrote to memory of 2200	4680	wermgr.exe	ipconfig.exe
PID 4680 wrote to memory of 2200	4680	wermgr.exe	ipconfig.exe
PID 4680 wrote to memory of 2200	4680	wermgr.exe	ipconfig.exe
PID 4680 wrote to memory of 3624	4680	wermgr.exe	nslookup.exe
PID 4680 wrote to memory of 3624	4680	wermgr.exe	nslookup.exe
PID 4680 wrote to memory of 3624	4680	wermgr.exe	nslookup.exe
PID 4680 wrote to memory of 1516	4680	wermgr.exe	net.exe
PID 4680 wrote to memory of 1516	4680	wermgr.exe	net.exe
PID 4680 wrote to memory of 1516	4680	wermgr.exe	net.exe
PID 1516 wrote to memory of 1688	1516	net.exe	net1.exe
PID 1516 wrote to memory of 1688	1516	net.exe	net1.exe
PID 1516 wrote to memory of 1688	1516	net.exe	net1.exe
PID 4680 wrote to memory of 2672	4680	wermgr.exe	route.exe
PID 4680 wrote to memory of 2672	4680	wermgr.exe	route.exe
PID 4680 wrote to memory of 2672	4680	wermgr.exe	route.exe
PID 4680 wrote to memory of 2524	4680	wermgr.exe	netstat.exe
PID 4680 wrote to memory of 2524	4680	wermgr.exe	netstat.exe
PID 4680 wrote to memory of 2524	4680	wermgr.exe	netstat.exe
PID 4680 wrote to memory of 4992	4680	wermgr.exe	net.exe
PID 4680 wrote to memory of 4992	4680	wermgr.exe	net.exe
PID 4680 wrote to memory of 4992	4680	wermgr.exe	net.exe
PID 4992 wrote to memory of 2964	4992	net.exe	net1.exe
PID 4992 wrote to memory of 2964	4992	net.exe	net1.exe
PID 4992 wrote to memory of 2964	4992	net.exe	net1.exe
PID 4680 wrote to memory of 1328	4680	wermgr.exe	whoami.exe
PID 4680 wrote to memory of 1328	4680	wermgr.exe	whoami.exe
PID 4680 wrote to memory of 1328	4680	wermgr.exe	whoami.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\AS.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2836

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass fix\hypersensitiveness.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\pickedKnelled.jpg DrawThemeIcon
3⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\pickedKnelled.jpg DrawThemeIcon
4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4680

C:\Windows\SysWOW64\net.exe
net view
6⤵
- Discovers systems in the same network
PID:2072

C:\Windows\SysWOW64\cmd.exe
cmd /c set
6⤵
PID:2232

C:\Windows\SysWOW64\arp.exe
arp -a
6⤵
PID:4976

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
6⤵
- Gathers network information
PID:2200

C:\Windows\SysWOW64\nslookup.exe
nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.WORKGROUP
6⤵
PID:3624

C:\Windows\SysWOW64\net.exe
net share
6⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 share
7⤵
PID:1688

C:\Windows\SysWOW64\route.exe
route print
6⤵
PID:2672

C:\Windows\SysWOW64\netstat.exe
netstat -nao
6⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Windows\SysWOW64\net.exe
net localgroup
6⤵
- Suspicious use of WriteProcessMemory
PID:4992

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup
7⤵
PID:2964

C:\Windows\SysWOW64\whoami.exe
whoami /all
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\pickedKnelled.jpg
Filesize
472KB

MD5
4d3ca6ea1b0f9010a53a870f475c40ab

SHA1
59f1755050abcec7f5a3e4a217aeaaa7487ce32b

SHA256
2bbe82d038bd24cc3e5e579f8a90e4229c6dff6a17fe0609caddfa045e18d36a

SHA512
62a10a6f700e23167f9a34cde909b061d170d90aee159ba3f06de916290ccc7012060881ce68c7058878578a1ead5d14d1248a14800007eacc4e580648f1c19a

Download Submit
C:\users\public\pickedKnelled.jpg
Filesize
472KB

MD5
4d3ca6ea1b0f9010a53a870f475c40ab

SHA1
59f1755050abcec7f5a3e4a217aeaaa7487ce32b

SHA256
2bbe82d038bd24cc3e5e579f8a90e4229c6dff6a17fe0609caddfa045e18d36a

SHA512
62a10a6f700e23167f9a34cde909b061d170d90aee159ba3f06de916290ccc7012060881ce68c7058878578a1ead5d14d1248a14800007eacc4e580648f1c19a

Download Submit
memory/1328-157-0x0000000000000000-mapping.dmp

Download
memory/1484-133-0x000001B3F6BF0000-0x000001B3F6C12000-memory.dmp

Filesize
136KB

Download
memory/1484-134-0x00007FFAB1DA0000-0x00007FFAB2861000-memory.dmp

Filesize
10.8MB

Download
memory/1484-138-0x00007FFAB1DA0000-0x00007FFAB2861000-memory.dmp

Filesize
10.8MB

Download
memory/1484-132-0x0000000000000000-mapping.dmp

Download
memory/1516-151-0x0000000000000000-mapping.dmp

Download
memory/1688-152-0x0000000000000000-mapping.dmp

Download
memory/2004-135-0x0000000000000000-mapping.dmp

Download
memory/2072-146-0x0000000000000000-mapping.dmp

Download
memory/2200-149-0x0000000000000000-mapping.dmp

Download
memory/2232-147-0x0000000000000000-mapping.dmp

Download
memory/2524-154-0x0000000000000000-mapping.dmp

Download
memory/2668-143-0x0000000002C00000-0x0000000002C2A000-memory.dmp

Filesize
168KB

Download
memory/2668-141-0x0000000002C00000-0x0000000002C2A000-memory.dmp

Filesize
168KB

Download
memory/2668-140-0x0000000002BD0000-0x0000000002BFA000-memory.dmp

Filesize
168KB

Download
memory/2668-137-0x0000000000000000-mapping.dmp

Download
memory/2672-153-0x0000000000000000-mapping.dmp

Download
memory/2964-156-0x0000000000000000-mapping.dmp

Download
memory/3624-150-0x0000000000000000-mapping.dmp

Download
memory/4680-145-0x0000000000680000-0x00000000006AA000-memory.dmp

Filesize
168KB

Download
memory/4680-144-0x0000000000680000-0x00000000006AA000-memory.dmp

Filesize
168KB

Download
memory/4680-142-0x0000000000000000-mapping.dmp

Download
memory/4976-148-0x0000000000000000-mapping.dmp

Download
memory/4992-155-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads