qakbot | 51e596bf543ed0b470a38dc087e4f6c05369dbcdff8a57560c59345ff854ec48

General

Target

SCANS_SA9050.iso
Size

1022KB
MD5

e4416680b14ae49d09e1bcc014c3d3c3
SHA1

13d20796c29e07a459581407785411c74b857cd8
SHA256

51e596bf543ed0b470a38dc087e4f6c05369dbcdff8a57560c59345ff854ec48
SHA512

afd083a302559d9d1ea7aac2ab9b2de1ec9ad1c69ea178e0ea13f57fdc2156b99164c4c07af169f7f0eaa09340660bd94524688989869749c29985a52c274e04
SSDEEP

6144:uK/s0aJWn8hdwefY5RAOgiLKefBv3n2JjiCk5c51kltCYEPxPTHmtkYoc0RVfs:xtMwuyJmkupiZiegLxLMKRVfs

Score

10^/10

qakbot azd 1670515354 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

azd

Campaign

1670515354

C2

136.35.241.159:443

73.36.196.11:443

12.172.173.82:50001

190.24.45.24:995

193.253.100.236:2222

109.11.175.42:2222

92.8.190.211:2222

50.90.249.161:443

66.180.226.117:2222

201.208.139.250:2222

12.172.173.82:22

75.98.154.19:443

24.142.218.202:443

70.77.116.233:443

90.4.193.117:2222

24.69.87.61:443

98.147.155.235:443

83.213.192.136:443

176.133.4.230:995

71.31.101.183:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

File opened (read-only) \??\E: cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings cmd.exe

description	ioc	process
File opened (read-only)	\??\E:	cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exewermgr.exe

pid	process
4100	regsvr32.exe
4100	regsvr32.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe
1756	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

4100 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cmd.exe

description pid process

Token: SeManageVolumePrivilege 3656 cmd.exe
Token: SeManageVolumePrivilege 3656 cmd.exe

description	pid	process
Token: SeManageVolumePrivilege	3656	cmd.exe
Token: SeManageVolumePrivilege	3656	cmd.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

cmd.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4660 wrote to memory of 1988	4660	cmd.exe	regsvr32.exe
PID 4660 wrote to memory of 1988	4660	cmd.exe	regsvr32.exe
PID 1988 wrote to memory of 4100	1988	regsvr32.exe	regsvr32.exe
PID 1988 wrote to memory of 4100	1988	regsvr32.exe	regsvr32.exe
PID 1988 wrote to memory of 4100	1988	regsvr32.exe	regsvr32.exe
PID 4100 wrote to memory of 1756	4100	regsvr32.exe	wermgr.exe
PID 4100 wrote to memory of 1756	4100	regsvr32.exe	wermgr.exe
PID 4100 wrote to memory of 1756	4100	regsvr32.exe	wermgr.exe
PID 4100 wrote to memory of 1756	4100	regsvr32.exe	wermgr.exe
PID 4100 wrote to memory of 1756	4100	regsvr32.exe	wermgr.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SCANS_SA9050.iso
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ContractChanges\LastUpdates.cmd A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:4660

C:\Windows\system32\regsvr32.exe
regsvr32 /s pays.bin
2⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\regsvr32.exe
/s pays.bin
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4100

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-135-0x0000000000000000-mapping.dmp

Download
memory/1756-137-0x0000000000160000-0x000000000018A000-memory.dmp

Filesize
168KB

Download
memory/1756-138-0x0000000000160000-0x000000000018A000-memory.dmp

Filesize
168KB

Download
memory/1988-132-0x0000000000000000-mapping.dmp

Download
memory/4100-133-0x0000000000000000-mapping.dmp

Download
memory/4100-134-0x00000000005C0000-0x00000000005EA000-memory.dmp

Filesize
168KB

Download
memory/4100-136-0x00000000005C0000-0x00000000005EA000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing