qakbot | 4bd9bde3970fb7ae3fefb0c70d36a4e1da7ef94b4fb0cb7b867835bbc7373d98

General

Target

Darlehensvertrag_237886470423_19052020.vbs
Size

36.3MB
MD5

a6eb9d904fc5eddda76ad4f9cf678e03
SHA1

c370a3c9e108ae2452dfdedc91a2aa04634c7002
SHA256

dfacae17a54e54e9b25d77399619859ed6b196318bd06341c22c7a8b4a090254
SHA512

c00ac4ecaf2623ac4eb4d47191b3b0608d80bd3da552310652a2ccbc306b408f8c0d6d9e3f35208e2ad93b0c7a872ff8c055db7f2a3ecbb259ae639b55d780fb

Score

10^/10

trojan banker stealer qakbot

Malware Config

Extracted

Family

qakbot

Botnet

spx123

Campaign

1589977350

C2

71.77.252.14:2222

174.130.225.61:443

76.187.97.98:2222

187.19.151.218:995

82.127.193.151:2222

72.204.242.138:993

66.208.105.6:443

24.183.39.93:443

98.243.187.85:443

68.49.120.179:443

72.204.242.138:995

72.29.181.77:2078

72.204.242.138:443

24.136.33.120:2222

96.56.237.174:990

107.2.148.99:443

216.201.162.158:443

71.213.29.14:995

84.247.55.190:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
608	schtasks.exe

Blacklisted process makes network request 1 IoCs

flow	pid	Process
4	272	WScript.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 272 wrote to memory of 268	272	WScript.exe	27
PID 272 wrote to memory of 268	272	WScript.exe	27
PID 272 wrote to memory of 268	272	WScript.exe	27
PID 272 wrote to memory of 268	272	WScript.exe	27
PID 268 wrote to memory of 1196	268	PicturesViewer.exe	28
PID 268 wrote to memory of 1196	268	PicturesViewer.exe	28
PID 268 wrote to memory of 1196	268	PicturesViewer.exe	28
PID 268 wrote to memory of 1196	268	PicturesViewer.exe	28
PID 268 wrote to memory of 1140	268	PicturesViewer.exe	29
PID 268 wrote to memory of 1140	268	PicturesViewer.exe	29
PID 268 wrote to memory of 1140	268	PicturesViewer.exe	29
PID 268 wrote to memory of 1140	268	PicturesViewer.exe	29
PID 268 wrote to memory of 608	268	PicturesViewer.exe	30
PID 268 wrote to memory of 608	268	PicturesViewer.exe	30
PID 268 wrote to memory of 608	268	PicturesViewer.exe	30
PID 268 wrote to memory of 608	268	PicturesViewer.exe	30
PID 1140 wrote to memory of 1600	1140	ppajeu.exe	32
PID 1140 wrote to memory of 1600	1140	ppajeu.exe	32
PID 1140 wrote to memory of 1600	1140	ppajeu.exe	32
PID 1140 wrote to memory of 1600	1140	ppajeu.exe	32
PID 1140 wrote to memory of 1644	1140	ppajeu.exe	33
PID 1140 wrote to memory of 1644	1140	ppajeu.exe	33
PID 1140 wrote to memory of 1644	1140	ppajeu.exe	33
PID 1140 wrote to memory of 1644	1140	ppajeu.exe	33
PID 1140 wrote to memory of 1644	1140	ppajeu.exe	33

Executes dropped EXE 4 IoCs

pid	Process
268	PicturesViewer.exe
1196	PicturesViewer.exe
1140	ppajeu.exe
1600	ppajeu.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
268	PicturesViewer.exe
1196	PicturesViewer.exe
1196	PicturesViewer.exe
1140	ppajeu.exe
1600	ppajeu.exe
1600	ppajeu.exe
1644	explorer.exe
1644	explorer.exe

Loads dropped DLL 3 IoCs

pid	Process
268	PicturesViewer.exe
268	PicturesViewer.exe
268	PicturesViewer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1140	ppajeu.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Darlehensvertrag_237886470423_19052020.vbs"
1⤵
- Blacklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:272
- C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
  C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Loads dropped DLL
  PID:268
- - C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
    C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe /C
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1196
- - C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1140
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe /C
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1600
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1644
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dbfwkuui /tr "\"C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe\" /I dbfwkuui" /SC ONCE /Z /ST 17:18 /ET 17:30
    3⤵
    - Creates scheduled task(s)
    PID:608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/272-1-0x0000000002F10000-0x0000000002F14000-memory.dmp

Filesize
16KB

Download
memory/1140-12-0x0000000000300000-0x000000000033A000-memory.dmp

Filesize
232KB

Download
memory/1196-5-0x0000000002270000-0x0000000002281000-memory.dmp

Filesize
68KB

Download
memory/1600-11-0x00000000024F0000-0x0000000002501000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads