qakbot | d92c94030dca29964cb4e5cd8a31c6fc73ce0b0e01734450aed7e3327f132e78 | Triage

Submit
Reports

Overview

overview

Static

static

8

Document_3...py.xls

windows7_x64

Document_3...py.xls

windows10_x64

Sharing

General

Target

Document_314379760-Copy.xls
Size

59KB
Sample

201216-jkdgls5s8n
MD5

24e2b1dc895e185efb45e60cda15abbf
SHA1

6e49f02ddab975d859f401d4ea59fb6fec37ce7f
SHA256

d92c94030dca29964cb4e5cd8a31c6fc73ce0b0e01734450aed7e3327f132e78
SHA512

93b0f7cb2c948123b7bd13db860b891686522a0bbc16890a6cbfcff1a4b0c91475f56d2b079612bd75daec415cf42688f82d202509533b3512cd4c80b7911b3e

Score

10^/10

qakbot abc110 1607524278 banker macro stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

Document_314379760-Copy.xls

Resource

win7v20201028

qakbot abc110 1607524278 banker stealer trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

Document_314379760-Copy.xls

Resource

win10v20201028

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

qakbot

Botnet

abc110

Campaign

1607524278

C2

78.63.226.32:443

72.252.201.69:443

68.190.152.98:443

72.240.200.181:2222

216.137.142.200:2222

87.27.110.90:2222

94.69.242.254:2222

189.183.209.211:443

94.26.119.221:443

186.189.208.238:443

161.199.180.159:443

197.45.110.165:995

83.110.221.218:443

105.198.236.99:443

83.110.158.22:2222

24.37.178.158:443

185.105.131.233:443

79.101.206.250:995

92.154.83.96:2078

83.202.68.220:2222

217.39.74.146:2222

78.97.110.47:443

202.184.106.235:443

85.122.141.42:995

5.15.54.40:443

98.16.204.189:995

193.248.154.174:2222

67.82.244.199:2222

98.240.24.57:443

78.96.199.79:443

67.6.54.180:443

92.59.35.196:2083

109.205.204.229:2222

149.28.101.90:2222

2.89.122.180:995

71.182.142.63:443

108.160.123.244:443

37.106.117.51:443

80.14.22.234:2222

2.7.202.106:2222

46.124.106.217:6881

96.19.117.140:443

80.227.5.70:443

47.44.217.98:443

197.210.96.222:995

216.215.77.18:2222

77.27.174.49:995

78.189.29.95:443

72.66.116.178:995

108.190.151.108:2222

2.89.122.180:993

108.30.125.94:443

41.176.34.7:995

65.48.179.252:443

190.67.214.66:443

78.187.125.116:2222

174.76.21.134:443

47.22.148.6:995

24.229.150.54:995

91.104.235.91:995

81.97.154.100:443

155.186.9.160:443

197.51.82.115:995

197.161.154.132:443

86.121.3.80:443

85.132.36.111:2222

197.86.204.201:443

74.124.191.6:443

184.21.136.237:995

93.148.241.179:2222

92.154.83.96:1194

93.113.177.152:443

160.3.184.253:443

2.49.219.254:22

80.195.103.146:2222

151.75.23.92:443

217.128.117.218:2222

174.62.13.151:443

78.97.207.104:443

186.29.96.147:443

74.137.189.78:443

95.77.223.148:443

83.110.151.105:443

5.12.254.113:443

174.55.197.4:443

5.193.177.247:2078

78.181.19.134:443

95.76.27.6:443

219.74.176.225:443

85.105.29.218:443

120.150.218.241:443

2.50.47.61:2078

149.28.101.90:8443

78.162.70.119:443

50.244.112.10:995

125.63.101.62:443

103.102.100.78:2222

86.121.194.157:443

156.213.147.56:443

41.39.134.183:443

47.22.148.6:443

74.128.121.17:443

79.129.252.62:2222

77.132.113.187:2222

78.101.158.1:61201

24.201.61.153:2078

2.50.2.216:443

216.201.162.158:443

94.59.236.155:995

208.93.202.41:443

62.38.114.12:2222

172.87.157.235:3389

151.61.107.248:2222

50.244.112.90:443

87.218.53.206:2222

75.136.40.155:443

81.133.234.36:2222

197.135.87.55:443

96.225.88.23:443

41.239.137.134:993

176.181.247.197:443

102.185.13.89:443

83.196.50.197:2222

212.70.107.59:995

79.166.96.86:2222

81.214.126.173:2222

185.163.221.77:2222

2.51.240.250:995

59.89.129.103:443

83.114.243.80:2222

37.116.152.122:2078

80.106.85.24:2222

2.50.56.81:443

47.21.192.182:2222

74.195.52.3:443

184.98.97.227:995

81.150.181.168:2222

217.165.3.30:443

77.211.30.202:995

93.146.133.102:2222

35.134.202.234:443

96.21.251.127:2222

102.187.19.171:443

92.154.83.96:2087

37.211.93.46:443

84.117.176.32:443

58.179.21.147:995

98.124.76.187:443

24.139.72.117:443

2.50.159.196:2222

Targets

- Target
  
  Document_314379760-Copy.xls
- Size
  
  59KB
- MD5
  
  24e2b1dc895e185efb45e60cda15abbf
- SHA1
  
  6e49f02ddab975d859f401d4ea59fb6fec37ce7f
- SHA256
  
  d92c94030dca29964cb4e5cd8a31c6fc73ce0b0e01734450aed7e3327f132e78
- SHA512
  
  93b0f7cb2c948123b7bd13db860b891686522a0bbc16890a6cbfcff1a4b0c91475f56d2b079612bd75daec415cf42688f82d202509533b3512cd4c80b7911b3e
Score

10^/10

qakbot abc110 1607524278 banker stealer trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Suspicious use of NtCreateProcessExOtherParentProcess
- ServiceHost packer
  Detects ServiceHost packer used for .NET malware
- Loads dropped DLL
- Process spawned suspicious child process
  This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

qakbotabc1101607524278bankerstealertrojan

behavioral2

© 2018-2024

Terms | Privacy