qakbot | b3dfb683f9518e45a2d0a7e2d3907e977eafb57156e261e0f9e4078f7154dbeb

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
23/06/2023, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BSN-50158390.js
Size 342KB
Sample230623-ajwvmsca4s
SHA256 b3dfb683f9518e45a2d0a7e2d3907e977eafb57156e261e0f9e4078f7154dbeb
MD5 199965002e642b40151d4e71e7f99472
SHA1 88d360f136afcf278bb58aec131c80c59c1b81e1
SHA512 b6a352be05ec66dba477c3f89fb99d22669381d936fe90cbdb7a868fcc5bebafca82ad12ab85c7b0e1295d4a583a5f6c8dd10c033ba3696865cd98566de1ac81
SSDEEP 6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593O:fIS1xba
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot obama271 1687438904 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.1405

Botnet

obama271

Campaign

1687438904

70.28.50.223:2083
103.141.50.79:995
184.182.66.109:443
122.184.143.82:443
91.254.145.252:443
37.14.229.220:2222
64.229.117.208:2222
77.126.99.230:443
87.252.106.235:995
12.172.173.82:32101
95.230.110.222:995
88.169.33.180:2222
70.28.50.223:1194
72.80.94.230:443
191.191.1.254:995
209.171.160.69:995
45.62.67.129:443
24.234.80.122:995
81.150.169.174:2222
121.121.100.202:995
92.148.54.239:2222
105.184.83.153:995
70.51.132.7:2222
190.249.245.224:443
208.180.17.32:2222
78.192.109.105:2222
72.205.104.134:443
86.248.228.57:2078
41.129.104.142:443
70.51.247.250:2222
87.220.204.58:2222
24.234.220.88:995
66.35.127.23:2222
201.244.108.183:995
70.28.50.223:2222
98.187.21.2:443
70.28.50.223:2078
142.127.25.253:2222
92.27.86.48:2222
12.172.173.82:2087
86.128.15.251:2222
62.35.230.21:995
150.195.117.207:443
47.16.77.99:2222
198.255.148.59:443
136.35.241.159:443
109.220.83.213:2222
69.159.156.197:2222
103.123.223.131:443
86.160.253.50:443
92.188.241.102:443
172.115.17.50:443
89.181.227.42:2222
41.98.253.136:443
187.199.128.160:32103
2.82.8.80:443
184.82.237.226:443
89.152.20.11:2222
47.21.51.138:443
65.95.192.151:2222
197.83.246.187:443
217.165.255.105:443
12.172.173.82:22
67.71.53.228:2222
79.168.224.165:2222
119.82.91.203:2078
116.75.63.242:443
110.159.115.244:443
45.62.75.217:443
142.154.58.207:443
88.171.156.150:50000
86.178.33.59:2222
73.29.92.128:443
72.134.124.16:443
104.35.24.154:443
71.31.9.226:995
171.96.205.23:443
113.11.92.30:443
89.79.229.50:443
90.63.198.45:995
27.99.32.26:2222
173.178.151.233:443
181.171.231.230:443
151.69.32.238:443
2.49.63.237:2222
178.175.187.254:443
68.186.65.132:443
103.139.243.205:443
113.193.95.38:443
184.176.35.223:2222
24.198.114.130:995
96.87.28.170:2222
41.227.190.59:443
151.3.191.5:443
89.158.150.253:443
86.178.238.140:50000
103.144.201.52:2078
190.133.135.49:995
12.172.173.82:995
93.163.74.91:443
142.79.110.85:443
151.62.193.97:443
147.147.30.126:2222
124.149.132.112:2222
70.49.205.191:2222
162.248.14.107:443
27.0.48.233:443
77.86.98.236:443
67.87.119.216:2078
70.28.50.223:32100
86.222.103.217:2222
12.172.173.82:20
98.4.43.111:443
84.215.202.8:443
102.157.134.72:443
85.95.113.17:995
103.153.180.55:995
201.171.159.196:443
92.20.199.185:2222
85.61.165.153:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Blocklisted process makes network request 4 IoCs

flow	pid	Process
3	1484	wscript.exe
5	1484	wscript.exe
9	1484	wscript.exe
11	1484	wscript.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
5072	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5072	rundll32.exe
5072	rundll32.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe
3696	wermgr.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 2548	1484	wscript.exe	80
PID 1484 wrote to memory of 2548	1484	wscript.exe	80
PID 1484 wrote to memory of 2540	1484	wscript.exe	82
PID 1484 wrote to memory of 2540	1484	wscript.exe	82
PID 2540 wrote to memory of 5072	2540	rundll32.exe	83
PID 2540 wrote to memory of 5072	2540	rundll32.exe	83
PID 2540 wrote to memory of 5072	2540	rundll32.exe	83
PID 5072 wrote to memory of 3696	5072	rundll32.exe	84
PID 5072 wrote to memory of 3696	5072	rundll32.exe	84
PID 5072 wrote to memory of 3696	5072	rundll32.exe	84
PID 5072 wrote to memory of 3696	5072	rundll32.exe	84
PID 5072 wrote to memory of 3696	5072	rundll32.exe	84
PID 5072 wrote to memory of 3696	5072	rundll32.exe	84

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\BSN-50158390.js
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\VPNStors\Krosters
  2⤵
  PID:2548
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\VPNStors\Krosters\Spote.OCCXX,zertc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\VPNStors\Krosters\Spote.OCCXX,zertc
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Windows\SysWOW64\wermgr.exe
      C:\Windows\SysWOW64\wermgr.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Spote.OCCXX

Path C:\VPNStors\Krosters\Spote.OCCXX
Size 1.3MB
SHA256 20825bb2d73a25eef1377a2fbe69755c7ebf514f108ed61030ab7faeb9e9fb55
MD5 c918f05608a37c2c4637c7a880d4f3c0
SHA1 d30753b2b4ec5fe7bec9c998284d2ec61d85e676
SHA512 050e05d98d11a3fcb49997a17e4d293abda61c92d381492bc7b973061db8604674de30789d102bb12bc8bdb100661d2410616dda97991971bf043da5d14d0cdb
SSDEEP 24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4y/Q:QbkS7XB1EsOSNPSp0EAt2bUeM4y/Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spote.OCCXX

Path C:\VPNStors\Krosters\Spote.OCCXX
Size 1.3MB
SHA256 20825bb2d73a25eef1377a2fbe69755c7ebf514f108ed61030ab7faeb9e9fb55
MD5 c918f05608a37c2c4637c7a880d4f3c0
SHA1 d30753b2b4ec5fe7bec9c998284d2ec61d85e676
SHA512 050e05d98d11a3fcb49997a17e4d293abda61c92d381492bc7b973061db8604674de30789d102bb12bc8bdb100661d2410616dda97991971bf043da5d14d0cdb
SSDEEP 24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4y/Q:QbkS7XB1EsOSNPSp0EAt2bUeM4y/Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3696-148-0x0000000000B00000-0x0000000000B02000-memory.dmp

Download

memory/3696-149-0x0000000000AD0000-0x0000000000AF4000-memory.dmp

Download

memory/3696-155-0x0000000000AD0000-0x0000000000AF4000-memory.dmp

Download

memory/3696-157-0x0000000000AD0000-0x0000000000AF4000-memory.dmp

Download

memory/3696-158-0x0000000000AD0000-0x0000000000AF4000-memory.dmp

Download

memory/3696-159-0x0000000000AD0000-0x0000000000AF4000-memory.dmp

Download

memory/3696-160-0x0000000000AD0000-0x0000000000AF4000-memory.dmp

Download

memory/5072-142-0x0000000000AF0000-0x0000000000AF3000-memory.dmp

Download

memory/5072-143-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/5072-156-0x0000000068DC0000-0x0000000068EEC000-memory.dmp

Download