qakbot | 501e90d690942737a5c6756efd9553e8c553455681a448a12483e6227073aa9d

Analysis

max time kernel
150s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 06:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AS.js
Size 138B
Sample221129-gva6mscd35
SHA256 a1abe2c6dbccaaa6a04fbbc903043d2e2bb14e1534204ccbaf6b059ee754a2b0
MD5 eea6049b9b99e426d7cec90efad09b2a
SHA1 7431fd7b9ceff2ca3ccd6d57c4ddbd6072d97788
SHA512 2002bc44d80d8c38e6fd1cd6daeb550a0ebe502163cab58648473f68e30e2a976c5e12948fd7da074b01999f6c3aa463b9088e29d63a631c2ce4fd790b9c4208
MD5 SHA1 SHA512

Score

10^/10

qakbot bb08 1669628564 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

BB08

Campaign

1669628564

98.147.155.235:443
85.52.73.34:2222
75.158.15.211:443
2.91.184.252:995
92.106.70.62:2222
85.152.152.46:443
86.159.48.25:2222
217.128.91.196:2222
92.11.189.236:2222
83.92.85.93:443
2.83.62.105:443
93.24.192.142:20
76.20.42.45:443
24.64.114.59:2078
73.36.196.11:443
130.43.99.103:995
172.117.139.142:995
100.16.107.117:443
12.172.173.82:22
176.151.15.101:443
50.68.204.71:443
58.162.223.233:443
50.68.204.71:993
108.162.6.34:995
24.142.218.202:443
174.112.25.29:2078
190.207.253.41:2222
66.191.69.18:995
85.241.180.94:443
149.126.159.106:443
75.141.227.169:443
31.167.227.31:443
173.18.126.3:443
184.153.132.82:443
176.142.207.63:443
82.9.210.36:443
87.221.197.110:2222
174.104.184.149:443
98.145.23.67:443
12.172.173.82:993
24.64.114.59:2222
116.75.63.225:443
136.232.184.134:995
77.126.81.208:443
62.31.130.138:465
75.99.125.235:2222
173.239.94.212:443
92.186.69.229:2222
92.24.200.226:995
109.218.104.206:2222
87.223.85.4:443
24.206.27.39:443
69.119.123.159:2222
64.121.161.102:443
91.169.12.198:32100
58.247.115.126:995
187.199.224.16:32103
123.3.240.16:995
122.178.197.139:995
102.156.232.220:443
12.172.173.82:995
92.98.228.28:2222
86.98.182.30:2222
90.116.219.167:2222
92.27.86.48:2222
93.156.103.241:443
85.7.61.22:2222
105.109.140.201:32103
86.225.214.138:2222
76.100.159.250:443
93.147.235.8:443
75.143.236.149:443
94.63.65.146:443
74.92.243.113:50000
75.98.154.19:443
216.196.245.102:2222
83.110.223.247:443
121.122.99.223:995
70.120.228.205:2083
47.229.96.60:443
86.171.75.63:443
89.129.109.27:2222
136.244.25.165:443
92.137.74.174:2222
78.69.251.252:2222
175.205.2.54:443
12.172.173.82:465
92.185.204.18:2078
58.186.75.42:443
76.80.180.154:995
84.35.26.14:995
190.18.236.175:443
47.41.154.250:443
190.11.198.66:443
81.229.117.95:2222
190.39.199.51:443
197.3.64.204:995
213.67.255.57:2222
86.195.32.149:2222
70.115.104.126:995
24.64.114.59:3389
216.196.245.102:2083
108.162.6.34:443
50.90.249.161:443
170.253.25.35:443
103.144.201.62:2078
24.64.114.59:50010
23.240.47.58:995
45.248.169.101:443
92.239.81.124:443
83.21.138.251:2222
80.13.179.151:2222
184.155.91.69:443
193.154.207.221:443
90.104.22.28:2222
71.247.10.63:50003
108.6.249.139:443
184.176.154.83:995
174.77.209.5:443
100.8.168.108:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Loads dropped DLL 1 IoCs

pid	Process
552	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1972	powershell.exe
1972	powershell.exe
552	rundll32.exe
108	wermgr.exe
108	wermgr.exe
108	wermgr.exe
108	wermgr.exe
108	wermgr.exe
108	wermgr.exe
108	wermgr.exe
108	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
552	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1972	1248	wscript.exe	26
PID 1248 wrote to memory of 1972	1248	wscript.exe	26
PID 1248 wrote to memory of 1972	1248	wscript.exe	26
PID 1972 wrote to memory of 1752	1972	powershell.exe	28
PID 1972 wrote to memory of 1752	1972	powershell.exe	28
PID 1972 wrote to memory of 1752	1972	powershell.exe	28
PID 1752 wrote to memory of 552	1752	rundll32.exe	29
PID 1752 wrote to memory of 552	1752	rundll32.exe	29
PID 1752 wrote to memory of 552	1752	rundll32.exe	29
PID 1752 wrote to memory of 552	1752	rundll32.exe	29
PID 1752 wrote to memory of 552	1752	rundll32.exe	29
PID 1752 wrote to memory of 552	1752	rundll32.exe	29
PID 1752 wrote to memory of 552	1752	rundll32.exe	29
PID 552 wrote to memory of 108	552	rundll32.exe	30
PID 552 wrote to memory of 108	552	rundll32.exe	30
PID 552 wrote to memory of 108	552	rundll32.exe	30
PID 552 wrote to memory of 108	552	rundll32.exe	30
PID 552 wrote to memory of 108	552	rundll32.exe	30
PID 552 wrote to memory of 108	552	rundll32.exe	30

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\AS.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass fix\unwatermarked.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\users\public\agreeBrood.jpg DrawThemeIcon
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\users\public\agreeBrood.jpg DrawThemeIcon
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:552
    - - C:\Windows\SysWOW64\wermgr.exe
        
        C:\Windows\SysWOW64\wermgr.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agreeBrood.jpg

Path C:\users\public\agreeBrood.jpg
Size 472KB
SHA256 2bbe82d038bd24cc3e5e579f8a90e4229c6dff6a17fe0609caddfa045e18d36a
MD5 4d3ca6ea1b0f9010a53a870f475c40ab
SHA1 59f1755050abcec7f5a3e4a217aeaaa7487ce32b
SHA512 62a10a6f700e23167f9a34cde909b061d170d90aee159ba3f06de916290ccc7012060881ce68c7058878578a1ead5d14d1248a14800007eacc4e580648f1c19a
SSDEEP 12288:7qySufCtDw28YQdAmXZWwqkULcuKKlZ0998g1Kt:7GufMV8XIw6Rlja98gEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

agreeBrood.jpg

Path \Users\Public\agreeBrood.jpg
Size 472KB
SHA256 2bbe82d038bd24cc3e5e579f8a90e4229c6dff6a17fe0609caddfa045e18d36a
MD5 4d3ca6ea1b0f9010a53a870f475c40ab
SHA1 59f1755050abcec7f5a3e4a217aeaaa7487ce32b
SHA512 62a10a6f700e23167f9a34cde909b061d170d90aee159ba3f06de916290ccc7012060881ce68c7058878578a1ead5d14d1248a14800007eacc4e580648f1c19a
SSDEEP 12288:7qySufCtDw28YQdAmXZWwqkULcuKKlZ0998g1Kt:7GufMV8XIw6Rlja98gEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/108-78-0x0000000000080000-0x00000000000AA000-memory.dmp

Download

memory/552-73-0x0000000000160000-0x000000000018A000-memory.dmp

Download

memory/552-71-0x0000000000190000-0x00000000001BA000-memory.dmp

Download

memory/552-72-0x0000000000190000-0x00000000001BA000-memory.dmp

Download

memory/552-74-0x0000000000190000-0x00000000001BA000-memory.dmp

Download

memory/552-69-0x0000000075351000-0x0000000075353000-memory.dmp

Download

memory/552-77-0x0000000000190000-0x00000000001BA000-memory.dmp

Download

memory/1248-54-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmp

Download

memory/1972-60-0x000000001B790000-0x000000001BA8F000-memory.dmp

Download

memory/1972-66-0x00000000024DB000-0x00000000024FA000-memory.dmp

Download

memory/1972-65-0x00000000024D4000-0x00000000024D7000-memory.dmp

Download

memory/1972-63-0x00000000024DB000-0x00000000024FA000-memory.dmp

Download

memory/1972-62-0x00000000024D4000-0x00000000024D7000-memory.dmp

Download

memory/1972-61-0x00000000024DB000-0x00000000024FA000-memory.dmp

Download

memory/1972-59-0x00000000024D4000-0x00000000024D7000-memory.dmp

Download

memory/1972-58-0x000007FEF2DE0000-0x000007FEF393D000-memory.dmp

Download

memory/1972-57-0x000007FEF3940000-0x000007FEF4363000-memory.dmp

Download