qakbot | a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4

General

Target

a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe
Size

1.2MB
MD5

136b9c85525ba66276b8c9f6b7014b0b
SHA1

0cf5ba13d14c28c60586c7f4b9679925fa4d4172
SHA256

a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4
SHA512

0c02b116029a7d4f4c44988dc6220ed4050c94cab6e57f4aeb29d8edd0b8b59e74c89d6bd62e6e828826f44ebfb478280051ca289ea712c52d5fd113541e2590

Score

10^/10

qakbot spx133 1591267427 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

324.142

Botnet

spx133

Campaign

1591267427

C2

49.144.84.21:443

189.159.133.162:995

173.245.152.231:443

77.237.181.212:995

207.255.161.8:2078

76.187.8.160:443

207.255.161.8:2087

98.219.77.197:443

66.222.88.126:995

207.255.161.8:32102

108.58.9.238:995

47.152.210.233:443

1.40.42.4:443

188.27.71.163:443

82.127.193.151:2222

104.50.141.139:995

67.83.54.76:2222

86.126.97.183:2222

73.94.229.115:443

47.35.182.97:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exea23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe

pid	process
1920	a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe
808	a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe
808	a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe
808	a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe

description	pid	process	target process
PID 1920 wrote to memory of 808	1920	a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe	a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe
PID 1920 wrote to memory of 808	1920	a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe	a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe
PID 1920 wrote to memory of 808	1920	a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe	a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe
PID 1920 wrote to memory of 808	1920	a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe	a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe

C:\Users\Admin\AppData\Local\Temp\a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1920

C:\Users\Admin\AppData\Local\Temp\a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe
C:\Users\Admin\AppData\Local\Temp\a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4.bin.sample.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:808

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-62-0x0000000000000000-mapping.dmp

Download
memory/1920-59-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download
memory/1920-61-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1920-60-0x0000000000220000-0x0000000000257000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing