qakbot | eeda820f8ee27fc483d338b59a5122e369c1749f0be8c1b1cd2276588471a175

Resubmissions

09-12-2022 21:26

221209-z981bshc2x 10

01-12-2022 07:02

221201-hvaqjseb89 10

Analysis

max time kernel
619s
max time network
624s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2022 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BF.vbs
Size

180B
MD5

fcf6c65b599aaad756e0c32e688ec9db
SHA1

28e5e0be32ec5d837dcbbf8bbe5be9a44e14750b
SHA256

dc9c38ba168c5fd0c78917e9cd8f1ddf7119c59a80ef5e097705091a157a3cb0
SHA512

e25f419e1b489e7f23259395ed39bca2b964ef5a963efdaa102415928f7e5370823a128c5510f5417617c50b200f2588257716d45a8c742e3cca364daa44e37b

Score

10^/10

qakbot bb08 1669628564 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

BB08

Campaign

1669628564

98.147.155.235:443

85.52.73.34:2222

75.158.15.211:443

2.91.184.252:995

92.106.70.62:2222

85.152.152.46:443

86.159.48.25:2222

217.128.91.196:2222

92.11.189.236:2222

83.92.85.93:443

2.83.62.105:443

93.24.192.142:20

76.20.42.45:443

24.64.114.59:2078

73.36.196.11:443

130.43.99.103:995

172.117.139.142:995

100.16.107.117:443

12.172.173.82:22

176.151.15.101:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1300 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1300	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exerundll32.exewermgr.exe

pid	process
816	powershell.exe
816	powershell.exe
1300	rundll32.exe
1300	rundll32.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe
4204	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1300 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 816 powershell.exe

pid	process
1300	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	816	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

WScript.exepowershell.exerundll32.exe

description	pid	process	target process
PID 424 wrote to memory of 816	424	WScript.exe	powershell.exe
PID 424 wrote to memory of 816	424	WScript.exe	powershell.exe
PID 424 wrote to memory of 816	424	WScript.exe	powershell.exe
PID 816 wrote to memory of 1300	816	powershell.exe	rundll32.exe
PID 816 wrote to memory of 1300	816	powershell.exe	rundll32.exe
PID 816 wrote to memory of 1300	816	powershell.exe	rundll32.exe
PID 1300 wrote to memory of 4204	1300	rundll32.exe	wermgr.exe
PID 1300 wrote to memory of 4204	1300	rundll32.exe	wermgr.exe
PID 1300 wrote to memory of 4204	1300	rundll32.exe	wermgr.exe
PID 1300 wrote to memory of 4204	1300	rundll32.exe	wermgr.exe
PID 1300 wrote to memory of 4204	1300	rundll32.exe	wermgr.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\BF.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:424

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass teased\\brainwaves.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:816

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\extroversionRadiantly.txt DrawThemeIcon
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\extroversionRadiantly.txt
Filesize
725KB

MD5
ed77586a14e95e3480d26c85219ae795

SHA1
bc15afb8b4aec58f7c3ce38f780ce4c5f8444b1d

SHA256
e978b0c77018e382ef87f6cee623b5b8b436a331449f8e2edca65b1c045aacc7

SHA512
03fee67cc0dda7b9518e5cb7934e0a18d872d40c357b70454d2353f91ac763eabeec5c9f2ca62cdcb510dff09f11e1acd47caaf7a96651c4010a5402c45ec857

Download Submit
C:\users\public\extroversionRadiantly.txt
Filesize
725KB

MD5
ed77586a14e95e3480d26c85219ae795

SHA1
bc15afb8b4aec58f7c3ce38f780ce4c5f8444b1d

SHA256
e978b0c77018e382ef87f6cee623b5b8b436a331449f8e2edca65b1c045aacc7

SHA512
03fee67cc0dda7b9518e5cb7934e0a18d872d40c357b70454d2353f91ac763eabeec5c9f2ca62cdcb510dff09f11e1acd47caaf7a96651c4010a5402c45ec857

Download Submit
memory/816-142-0x00000000078D0000-0x0000000007E74000-memory.dmp

Filesize
5.6MB

Download
memory/816-133-0x0000000002730000-0x0000000002766000-memory.dmp

Filesize
216KB

Download
memory/816-136-0x0000000005890000-0x00000000058F6000-memory.dmp

Filesize
408KB

Download
memory/816-137-0x00000000059F0000-0x0000000005A56000-memory.dmp

Filesize
408KB

Download
memory/816-138-0x0000000006030000-0x000000000604E000-memory.dmp

Filesize
120KB

Download
memory/816-139-0x0000000007280000-0x0000000007316000-memory.dmp

Filesize
600KB

Download
memory/816-140-0x0000000006560000-0x000000000657A000-memory.dmp

Filesize
104KB

Download
memory/816-141-0x00000000065D0000-0x00000000065F2000-memory.dmp

Filesize
136KB

Download
memory/816-132-0x0000000000000000-mapping.dmp

Download
memory/816-135-0x0000000005170000-0x0000000005192000-memory.dmp

Filesize
136KB

Download
memory/816-134-0x00000000051F0000-0x0000000005818000-memory.dmp

Filesize
6.2MB

Download
memory/1300-143-0x0000000000000000-mapping.dmp

Download
memory/1300-146-0x0000000000CE0000-0x0000000000D53000-memory.dmp

Filesize
460KB

Download
memory/1300-147-0x0000000000ED0000-0x0000000000EFA000-memory.dmp

Filesize
168KB

Download
memory/1300-149-0x0000000000ED0000-0x0000000000EFA000-memory.dmp

Filesize
168KB

Download
memory/4204-148-0x0000000000000000-mapping.dmp

Download
memory/4204-150-0x0000000000130000-0x000000000015A000-memory.dmp

Filesize
168KB

Download
memory/4204-151-0x0000000000130000-0x000000000015A000-memory.dmp

Filesize
168KB

Download