qakbot | f6c5d0064568344d3c56561bcc3e6b843a1bba496a4c372f451fe5831d3cce8f

General

Target

BF.vbs
Size

180B
MD5

2cd1f8dc755fe95803f559eb2fafd426
SHA1

0f10bdd9fee72736f9edacb687164d6f48a410be
SHA256

4f20d3df38ca5be59c5e550ee96ddc3e2331ec497872c335e1f3b071bf96ea15
SHA512

8d1cbd47d51afd56633708d3b872f924b78c28f5d074fa9a9340b4d487dc3d624b37d9651c09586bca3fc8f24169490e14f910a0731eeeb1e647710ec52cbe93

Score

10^/10

qakbot bb08 1669628564 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

BB08

Campaign

1669628564

C2

98.147.155.235:443

85.52.73.34:2222

75.158.15.211:443

2.91.184.252:995

92.106.70.62:2222

85.152.152.46:443

86.159.48.25:2222

217.128.91.196:2222

92.11.189.236:2222

83.92.85.93:443

2.83.62.105:443

93.24.192.142:20

76.20.42.45:443

24.64.114.59:2078

73.36.196.11:443

130.43.99.103:995

172.117.139.142:995

100.16.107.117:443

12.172.173.82:22

176.151.15.101:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3680 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe

pid	process
3680	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exerundll32.exewermgr.exe

pid	process
3716	powershell.exe
3716	powershell.exe
3680	rundll32.exe
3680	rundll32.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe
4976	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

3680 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3716 powershell.exe

pid	process
3680	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	3716	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

WScript.exepowershell.exerundll32.exe

description	pid	process	target process
PID 4792 wrote to memory of 3716	4792	WScript.exe	powershell.exe
PID 4792 wrote to memory of 3716	4792	WScript.exe	powershell.exe
PID 4792 wrote to memory of 3716	4792	WScript.exe	powershell.exe
PID 3716 wrote to memory of 3680	3716	powershell.exe	rundll32.exe
PID 3716 wrote to memory of 3680	3716	powershell.exe	rundll32.exe
PID 3716 wrote to memory of 3680	3716	powershell.exe	rundll32.exe
PID 3680 wrote to memory of 4976	3680	rundll32.exe	wermgr.exe
PID 3680 wrote to memory of 4976	3680	rundll32.exe	wermgr.exe
PID 3680 wrote to memory of 4976	3680	rundll32.exe	wermgr.exe
PID 3680 wrote to memory of 4976	3680	rundll32.exe	wermgr.exe
PID 3680 wrote to memory of 4976	3680	rundll32.exe	wermgr.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\BF.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass teased\\vehemently.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\users\public\confidingNewscast.txt DrawThemeIcon
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3680
  - - C:\Windows\SysWOW64\wermgr.exe
      C:\Windows\SysWOW64\wermgr.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\confidingNewscast.txt

Filesize
725KB

MD5
4f1d7370011456826a662f30d5739dd7

SHA1
b8bb65120416571ee8f8c5ef3a593189202aea7f

SHA256
cce553862f78286f732b0297e4a24e5c1312943d1bc1d91a1887cc2ccdb4b980

SHA512
32436390c62880fee1318ea0c239edb2bd181c8a00e58907ea5493234f5a398104df70d6eebd9c7e8c6ef4fe90d530bfb6313bae9413d2aa5d43e0b6ffa26363

Download Submit
C:\users\public\confidingNewscast.txt

Filesize
725KB

MD5
4f1d7370011456826a662f30d5739dd7

SHA1
b8bb65120416571ee8f8c5ef3a593189202aea7f

SHA256
cce553862f78286f732b0297e4a24e5c1312943d1bc1d91a1887cc2ccdb4b980

SHA512
32436390c62880fee1318ea0c239edb2bd181c8a00e58907ea5493234f5a398104df70d6eebd9c7e8c6ef4fe90d530bfb6313bae9413d2aa5d43e0b6ffa26363

Download Submit
memory/3680-143-0x0000000000000000-mapping.dmp

Download
memory/3680-149-0x0000000000990000-0x00000000009BA000-memory.dmp

Filesize
168KB

Download
memory/3680-147-0x0000000000990000-0x00000000009BA000-memory.dmp

Filesize
168KB

Download
memory/3680-146-0x0000000002190000-0x0000000002203000-memory.dmp

Filesize
460KB

Download
memory/3716-137-0x0000000006000000-0x0000000006066000-memory.dmp

Filesize
408KB

Download
memory/3716-136-0x0000000005EE0000-0x0000000005F46000-memory.dmp

Filesize
408KB

Download
memory/3716-140-0x0000000006B40000-0x0000000006B5A000-memory.dmp

Filesize
104KB

Download
memory/3716-141-0x0000000006B90000-0x0000000006BB2000-memory.dmp

Filesize
136KB

Download
memory/3716-142-0x0000000007E80000-0x0000000008424000-memory.dmp

Filesize
5.6MB

Download
memory/3716-138-0x0000000006690000-0x00000000066AE000-memory.dmp

Filesize
120KB

Download
memory/3716-132-0x0000000000000000-mapping.dmp

Download
memory/3716-139-0x0000000006BC0000-0x0000000006C56000-memory.dmp

Filesize
600KB

Download
memory/3716-135-0x0000000005DC0000-0x0000000005DE2000-memory.dmp

Filesize
136KB

Download
memory/3716-134-0x0000000005690000-0x0000000005CB8000-memory.dmp

Filesize
6.2MB

Download
memory/3716-133-0x0000000004FD0000-0x0000000005006000-memory.dmp

Filesize
216KB

Download
memory/4976-148-0x0000000000000000-mapping.dmp

Download
memory/4976-150-0x0000000000E50000-0x0000000000E7A000-memory.dmp

Filesize
168KB

Download
memory/4976-151-0x0000000000E50000-0x0000000000E7A000-memory.dmp

Filesize
168KB

Download

Resubmissions

Analysis

Sharing