qakbot | 1419ea24a80726cf8a5ff762f57be4cad2c8adc1711ea4868370b65fd191c80c

Analysis

max time kernel
124s
max time network
126s
platform
windows7_x64
resource
win7v20210410
submitted
07-05-2021 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8edc802c274f3fd64be9aa5557b7ca79.exe
Size

3.0MB
MD5

8edc802c274f3fd64be9aa5557b7ca79
SHA1

6fe3ee6c2c0c43064bb53417bcee828845bf46f3
SHA256

412abe96cbbd685e888126581ae6485aa2038a31578fb122e38a2387400aba0e
SHA512

26305e1aa9fd6d7dc95d71fb79cf585ddf0c8c1c3537994ee48bf4d66dc31a24301918253b820b6703fa5ce7526bb980c0364de85a047275ce5f7069a8f0078b

Score

10^/10

qakbot domain01 1597161528 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

domain01

Campaign

1597161528

96.227.127.13:443

197.37.252.37:993

95.221.48.169:2222

72.190.101.70:443

47.39.76.74:443

207.255.18.67:443

108.46.145.30:443

142.117.109.129:2222

176.205.255.97:443

2.89.74.34:995

98.219.77.197:443

75.110.250.89:995

47.28.131.209:443

47.18.252.135:2222

66.30.92.147:443

188.51.3.210:995

83.110.92.29:443

68.225.56.31:443

189.183.72.138:995

98.121.187.78:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

8edc802c274f3fd64be9aa5557b7ca79.exe8edc802c274f3fd64be9aa5557b7ca79.exe

pid process

1088 8edc802c274f3fd64be9aa5557b7ca79.exe
1424 8edc802c274f3fd64be9aa5557b7ca79.exe
1424 8edc802c274f3fd64be9aa5557b7ca79.exe

pid	process
1088	8edc802c274f3fd64be9aa5557b7ca79.exe
1424	8edc802c274f3fd64be9aa5557b7ca79.exe
1424	8edc802c274f3fd64be9aa5557b7ca79.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8edc802c274f3fd64be9aa5557b7ca79.exe

description	pid	process	target process
PID 1088 wrote to memory of 1424	1088	8edc802c274f3fd64be9aa5557b7ca79.exe	8edc802c274f3fd64be9aa5557b7ca79.exe
PID 1088 wrote to memory of 1424	1088	8edc802c274f3fd64be9aa5557b7ca79.exe	8edc802c274f3fd64be9aa5557b7ca79.exe
PID 1088 wrote to memory of 1424	1088	8edc802c274f3fd64be9aa5557b7ca79.exe	8edc802c274f3fd64be9aa5557b7ca79.exe
PID 1088 wrote to memory of 1424	1088	8edc802c274f3fd64be9aa5557b7ca79.exe	8edc802c274f3fd64be9aa5557b7ca79.exe

C:\Users\Admin\AppData\Local\Temp\8edc802c274f3fd64be9aa5557b7ca79.exe
"C:\Users\Admin\AppData\Local\Temp\8edc802c274f3fd64be9aa5557b7ca79.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1088

C:\Users\Admin\AppData\Local\Temp\8edc802c274f3fd64be9aa5557b7ca79.exe
C:\Users\Admin\AppData\Local\Temp\8edc802c274f3fd64be9aa5557b7ca79.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1424

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-60-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/1088-61-0x00000000002D0000-0x0000000000304000-memory.dmp

Filesize
208KB

Download
memory/1088-62-0x0000000000400000-0x00000000006FB000-memory.dmp

Filesize
3.0MB

Download
memory/1424-63-0x0000000000000000-mapping.dmp

Download