qakbot | 7a61ffa2b2824eb796fd2090ac9530bc0c44aa5f5b671198969bf9ce8e4d1958

General

Target

F12.wsf
Size

102.2MB
MD5

71dc49c8604801a97f6c2650fecc7905
SHA1

4c686cb740384db18febff3a9e230935cc71451e
SHA256

eca4870cb095914b3ea2e75bf4362ef7ada9d207995ae850e67d52cda0b5aff5
SHA512

b1f47d228af3fd83af27162c1d7cae3407893531379862ea4d099d9def200fc3e13d49a0792c4ba8d8f1ef1c3c40e635702cac9137ad1729aabe3cc00dffc3be
SSDEEP

24576:Q4PRw+wFwJGwgwsZicphuWJmknFM+9zKhGCN0sigLe:zPRw+wFwJGwgwz

Score

10^/10

qakbot bb11 1671725928 banker discovery stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.66

Botnet

BB11

Campaign

1671725928

C2

27.109.19.90:2078

50.68.204.71:995

217.43.16.149:443

181.118.206.65:995

152.171.41.171:443

98.187.21.2:443

121.121.100.148:995

87.252.106.197:995

172.90.139.138:2222

172.248.42.122:443

24.142.218.202:443

76.100.159.250:443

92.8.187.85:2222

69.133.162.35:443

50.86.217.209:443

78.18.42.55:443

92.27.86.48:2222

185.13.180.250:443

50.26.197.236:993

24.69.84.237:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Loads dropped DLL 1 IoCs

pid	Process
4580	regsvr32.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4580	regsvr32.exe
4580	regsvr32.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe
3700	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4580	regsvr32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2416	1896	WScript.exe	82
PID 1896 wrote to memory of 2416	1896	WScript.exe	82
PID 2416 wrote to memory of 4580	2416	regsvr32.exe	83
PID 2416 wrote to memory of 4580	2416	regsvr32.exe	83
PID 2416 wrote to memory of 4580	2416	regsvr32.exe	83
PID 4580 wrote to memory of 3700	4580	regsvr32.exe	84
PID 4580 wrote to memory of 3700	4580	regsvr32.exe	84
PID 4580 wrote to memory of 3700	4580	regsvr32.exe	84
PID 4580 wrote to memory of 3700	4580	regsvr32.exe	84
PID 4580 wrote to memory of 3700	4580	regsvr32.exe	84

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\F12.wsf"
1⤵
PID:3504

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1124

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "E:\F12.wsf"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" C:\Users\Admin\me.txt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Users\Admin\me.txt
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Windows\SysWOW64\wermgr.exe
      C:\Windows\SysWOW64\wermgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\me.txt

Filesize
733KB

MD5
388130763a39816b5de645a0db65fe8e

SHA1
0daf7bf5fd13a9b4d29591bebfc4a21793cce0ff

SHA256
b319b04368220e6e7379586ed5576a6bfed90c0f975fa0012011d7b702e2b959

SHA512
4e38e8c048465796a9cb735eec80abf0e83eb7fe07327a72daee3e03ee1f000dda5c58597c5051d54a236d18a78962db7141a549cb7c0a283ec905ffece90bdc

Download Submit
memory/3700-8-0x0000000000680000-0x00000000006AA000-memory.dmp

Filesize
168KB

Download
memory/3700-9-0x0000000000680000-0x00000000006AA000-memory.dmp

Filesize
168KB

Download
memory/3700-10-0x0000000000680000-0x00000000006AA000-memory.dmp

Filesize
168KB

Download
memory/3700-12-0x0000000000680000-0x00000000006AA000-memory.dmp

Filesize
168KB

Download
memory/3700-11-0x0000000000680000-0x00000000006AA000-memory.dmp

Filesize
168KB

Download
memory/3700-13-0x0000000000680000-0x00000000006AA000-memory.dmp

Filesize
168KB

Download
memory/4580-3-0x0000000074FA0000-0x000000007505A000-memory.dmp

Filesize
744KB

Download
memory/4580-4-0x0000000002C50000-0x0000000002C7A000-memory.dmp

Filesize
168KB

Download
memory/4580-5-0x0000000002C50000-0x0000000002C7A000-memory.dmp

Filesize
168KB

Download
memory/4580-6-0x0000000074FA0000-0x000000007505A000-memory.dmp

Filesize
744KB

Download

Analysis

Sharing