qakbot | 1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74

General

Target

1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe
Size

2.3MB
MD5

5456ec2fa2f4a0c63df8111e41cf3462
SHA1

d9784a94b622e7d481f2787605ca3c569eb73b31
SHA256

1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74
SHA512

ab6b22e74a51b747ab93192e6af985c025b03be3283e49a676d76ddc6fd17d5ed079707744627a1954c46ab2d4e0fc9355750c6f437c0016be296d99662ae801

Score

10^/10

qakbot spx96 1586873043 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

324.127

Botnet

spx96

Campaign

1586873043

C2

72.209.191.27:443

173.22.120.11:2222

108.227.161.27:995

172.87.134.226:443

181.197.195.138:995

98.21.52.194:443

76.180.69.236:443

68.98.142.248:443

68.52.164.175:443

39.59.63.142:995

35.142.126.181:443

96.35.170.82:2222

75.111.145.5:443

47.214.144.253:443

74.105.139.160:443

67.8.103.21:443

50.108.212.180:443

83.25.7.201:2222

188.25.237.208:443

184.167.2.251:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

984 PING.EXE

pid	process
984	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe

pid	process
784	1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe
2036	1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe
2036	1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.execmd.exe

description	pid	process	target process
PID 784 wrote to memory of 2036	784	1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe	1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe
PID 784 wrote to memory of 2036	784	1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe	1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe
PID 784 wrote to memory of 2036	784	1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe	1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe
PID 784 wrote to memory of 2036	784	1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe	1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe
PID 784 wrote to memory of 268	784	1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe	cmd.exe
PID 784 wrote to memory of 268	784	1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe	cmd.exe
PID 784 wrote to memory of 268	784	1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe	cmd.exe
PID 784 wrote to memory of 268	784	1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe	cmd.exe
PID 268 wrote to memory of 984	268	cmd.exe	PING.EXE
PID 268 wrote to memory of 984	268	cmd.exe	PING.EXE
PID 268 wrote to memory of 984	268	cmd.exe	PING.EXE
PID 268 wrote to memory of 984	268	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe
"C:\Users\Admin\AppData\Local\Temp\1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:784

C:\Users\Admin\AppData\Local\Temp\1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe
C:\Users\Admin\AppData\Local\Temp\1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\1442744d1980ad214b64c152b482c9f82e869cb4540495df5bb2248de0cbad74.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:984

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-67-0x0000000000000000-mapping.dmp

Download
memory/784-60-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/784-61-0x0000000000220000-0x0000000000259000-memory.dmp

Filesize
228KB

Download
memory/784-62-0x0000000000400000-0x0000000000649000-memory.dmp

Filesize
2.3MB

Download
memory/984-68-0x0000000000000000-mapping.dmp

Download
memory/2036-63-0x0000000000000000-mapping.dmp

Download
memory/2036-66-0x0000000000400000-0x0000000000649000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing