qakbot | 8a947b74dc7aa05f98851a8a62e71e983cee37d32d18a7ba1e1e5cb357e830c2

General

Target

BF.vbs
Size

177B
MD5

6b6fa4280d86225a89bc9baa003a793c
SHA1

d58ad4335a1c039a772abd605775f5407ff9d7dd
SHA256

54f762962f24619272d95f2ba0c9692ca14755f2484f903a9b6f28cccc285314
SHA512

7347c304150243fe56782503a2496dbb1e6362e3dbdb6f1aa6cb122a2ad13905862352d2a7330892809e9f94bdcf2c0adac82c7e51fdbb54faaf055fff81ac33

Score

10^/10

qakbot bb08 1669628564 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

BB08

Campaign

1669628564

C2

98.147.155.235:443

85.52.73.34:2222

75.158.15.211:443

2.91.184.252:995

92.106.70.62:2222

85.152.152.46:443

86.159.48.25:2222

217.128.91.196:2222

92.11.189.236:2222

83.92.85.93:443

2.83.62.105:443

93.24.192.142:20

76.20.42.45:443

24.64.114.59:2078

73.36.196.11:443

130.43.99.103:995

172.117.139.142:995

100.16.107.117:443

12.172.173.82:22

176.151.15.101:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4940 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
4940	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exerundll32.exewermgr.exe

pid	process
3104	powershell.exe
3104	powershell.exe
4940	rundll32.exe
4940	rundll32.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe
2332	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

4940 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3104 powershell.exe

pid	process
4940	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	3104	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

WScript.exepowershell.exerundll32.exe

description	pid	process	target process
PID 4904 wrote to memory of 3104	4904	WScript.exe	powershell.exe
PID 4904 wrote to memory of 3104	4904	WScript.exe	powershell.exe
PID 4904 wrote to memory of 3104	4904	WScript.exe	powershell.exe
PID 3104 wrote to memory of 4940	3104	powershell.exe	rundll32.exe
PID 3104 wrote to memory of 4940	3104	powershell.exe	rundll32.exe
PID 3104 wrote to memory of 4940	3104	powershell.exe	rundll32.exe
PID 4940 wrote to memory of 2332	4940	rundll32.exe	wermgr.exe
PID 4940 wrote to memory of 2332	4940	rundll32.exe	wermgr.exe
PID 4940 wrote to memory of 2332	4940	rundll32.exe	wermgr.exe
PID 4940 wrote to memory of 2332	4940	rundll32.exe	wermgr.exe
PID 4940 wrote to memory of 2332	4940	rundll32.exe	wermgr.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\BF.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4904

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass teased\\mammary.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\marqueesInvariance.txt DrawThemeIcon
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4940

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2332

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\marqueesInvariance.txt
Filesize
725KB

MD5
de11547c4bae2a69045dd143898f0a09

SHA1
bb93f325a7e3be5cc27e1724a971c6fb657a73e6

SHA256
4f32a538b49152fdd1741443f133287412ebcbcdb4727a861bc8fce2a2b98f77

SHA512
5255a14682e784bb288901ee25fb64da3e7fc78d40c4319df4e99e1fdbd202b03220e62935ddc9b2cdbe84329734aaba0e556f69007cdfed63e9a3e3a3a554c5

Download Submit
C:\users\public\marqueesInvariance.txt
Filesize
725KB

MD5
de11547c4bae2a69045dd143898f0a09

SHA1
bb93f325a7e3be5cc27e1724a971c6fb657a73e6

SHA256
4f32a538b49152fdd1741443f133287412ebcbcdb4727a861bc8fce2a2b98f77

SHA512
5255a14682e784bb288901ee25fb64da3e7fc78d40c4319df4e99e1fdbd202b03220e62935ddc9b2cdbe84329734aaba0e556f69007cdfed63e9a3e3a3a554c5

Download Submit
memory/2332-151-0x0000000000E40000-0x0000000000E6A000-memory.dmp

Filesize
168KB

Download
memory/2332-150-0x0000000000E40000-0x0000000000E6A000-memory.dmp

Filesize
168KB

Download
memory/2332-148-0x0000000000000000-mapping.dmp

Download
memory/3104-142-0x0000000007830000-0x0000000007DD4000-memory.dmp

Filesize
5.6MB

Download
memory/3104-137-0x0000000005260000-0x00000000052C6000-memory.dmp

Filesize
408KB

Download
memory/3104-139-0x0000000007090000-0x0000000007126000-memory.dmp

Filesize
600KB

Download
memory/3104-140-0x00000000065C0000-0x00000000065DA000-memory.dmp

Filesize
104KB

Download
memory/3104-141-0x0000000006610000-0x0000000006632000-memory.dmp

Filesize
136KB

Download
memory/3104-132-0x0000000000000000-mapping.dmp

Download
memory/3104-133-0x00000000026D0000-0x0000000002706000-memory.dmp

Filesize
216KB

Download
memory/3104-138-0x00000000060B0000-0x00000000060CE000-memory.dmp

Filesize
120KB

Download
memory/3104-136-0x0000000005180000-0x00000000051E6000-memory.dmp

Filesize
408KB

Download
memory/3104-134-0x0000000005390000-0x00000000059B8000-memory.dmp

Filesize
6.2MB

Download
memory/3104-135-0x00000000050E0000-0x0000000005102000-memory.dmp

Filesize
136KB

Download
memory/4940-147-0x0000000002B30000-0x0000000002B5A000-memory.dmp

Filesize
168KB

Download
memory/4940-149-0x0000000002B30000-0x0000000002B5A000-memory.dmp

Filesize
168KB

Download
memory/4940-146-0x0000000002720000-0x0000000002793000-memory.dmp

Filesize
460KB

Download
memory/4940-143-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads