qakbot | e7c797dfae57a694228afadcb50c8364dad97ff988528ff88f5042c4ccebfd76

General

Target

VV.lnk
Size

1KB
MD5

dd78eaba9cfff2ef3c12209ec96799d9
SHA1

11ceaf7dd36ada07a949d7d1ce7329225bb57eda
SHA256

025995aaf8dfe40a74123f41cde7bedb4294786421fc49fc34e83c77c2202b3e
SHA512

0a3b93f2aca82ae83e3125514f42d42ccd95387f73a2b659250b0699c86cc547cc48cd7bd79601d6127f402e49fedb8cdc689bfcaa0dcd0f58d63907b8276f2f

Score

10^/10

qakbot bb04 1666690935 banker discovery stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

BB04

Campaign

1666690935

C2

181.164.194.228:443

24.116.45.121:443

190.74.248.136:443

24.206.27.39:443

27.110.134.202:995

2.88.206.121:443

71.199.168.185:443

200.233.108.153:995

198.2.51.242:993

172.117.139.142:995

70.115.104.126:443

144.202.15.58:443

190.24.45.24:995

24.9.220.167:443

58.247.115.126:995

193.3.19.137:443

45.230.169.132:995

68.62.199.70:443

43.241.159.238:443

113.162.196.232:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Executes dropped EXE 1 IoCs

pid	Process
1104	ghostlyEvolutionists.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
760	regsvr32.exe
760	regsvr32.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe
3100	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
760	regsvr32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 564	2252	cmd.exe	78
PID 2252 wrote to memory of 564	2252	cmd.exe	78
PID 564 wrote to memory of 1104	564	cmd.exe	79
PID 564 wrote to memory of 1104	564	cmd.exe	79
PID 1104 wrote to memory of 760	1104	ghostlyEvolutionists.com	80
PID 1104 wrote to memory of 760	1104	ghostlyEvolutionists.com	80
PID 1104 wrote to memory of 760	1104	ghostlyEvolutionists.com	80
PID 760 wrote to memory of 3100	760	regsvr32.exe	81
PID 760 wrote to memory of 3100	760	regsvr32.exe	81
PID 760 wrote to memory of 3100	760	regsvr32.exe	81
PID 760 wrote to memory of 3100	760	regsvr32.exe	81
PID 760 wrote to memory of 3100	760	regsvr32.exe	81

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\VV.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c transitoriness\staccatos.cmd regs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Users\Admin\AppData\Local\Temp\ghostlyEvolutionists.com
    C:\Users\Admin\AppData\Local\Temp\\ghostlyEvolutionists.com transitoriness\undried.dat
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\SysWOW64\regsvr32.exe
      transitoriness\undried.dat
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:760
    - - C:\Windows\SysWOW64\wermgr.exe
        
        C:\Windows\SysWOW64\wermgr.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ghostlyEvolutionists.com

Filesize
44KB

MD5
0c9318bbe9a07725154ace027acf7655

SHA1
d0117cd590b83ffdf9971c9826314aaacaca7a0f

SHA256
dab97346901ae36ddc4553255da518c4128efd426613cbb66b242daba210c97b

SHA512
400fe720db42ea714b872caae40bff95a391ffcd906e44f195f88a571b0709c872b3d8f3e26e29d6ad705bf24679e0e1fedcad8652be3a09a96a18bb812ce29f

Download Submit
memory/760-11-0x0000000002600000-0x0000000002671000-memory.dmp

Filesize
452KB

Download
memory/760-4-0x0000000075180000-0x000000007520D000-memory.dmp

Filesize
564KB

Download
memory/760-7-0x0000000002680000-0x00000000026A9000-memory.dmp

Filesize
164KB

Download
memory/760-6-0x0000000002680000-0x00000000026A9000-memory.dmp

Filesize
164KB

Download
memory/760-10-0x0000000075180000-0x000000007520D000-memory.dmp

Filesize
564KB

Download
memory/760-9-0x0000000002680000-0x00000000026A9000-memory.dmp

Filesize
164KB

Download
memory/760-5-0x0000000002600000-0x0000000002671000-memory.dmp

Filesize
452KB

Download
memory/3100-13-0x0000000000AF0000-0x0000000000B19000-memory.dmp

Filesize
164KB

Download
memory/3100-8-0x0000000000AF0000-0x0000000000B19000-memory.dmp

Filesize
164KB

Download
memory/3100-18-0x0000000000AF0000-0x0000000000B19000-memory.dmp

Filesize
164KB

Download
memory/3100-22-0x0000000000AF0000-0x0000000000B19000-memory.dmp

Filesize
164KB

Download
memory/3100-21-0x0000000000AF0000-0x0000000000B19000-memory.dmp

Filesize
164KB

Download
memory/3100-20-0x0000000000AF0000-0x0000000000B19000-memory.dmp

Filesize
164KB

Download
memory/3100-19-0x0000000000AF0000-0x0000000000B19000-memory.dmp

Filesize
164KB

Download
memory/3100-23-0x0000000000AF0000-0x0000000000B19000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing