qakbot | f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac

General

Target

f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe
Size

1.8MB
MD5

bb62584b9838309fb13e405930ad6d06
SHA1

aa66fc36cadb293bde8f675d5d43d2c28f679eab
SHA256

f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac
SHA512

d80a97e9dd89ffa02248459a6dbb5596bd63a96153315d7702dabc3093a235c7d40992ecf131bb19de8b2fc67b5d69b5f4df8cf372a8c838b676091bb5189f03

Score

10^/10

qakbot spx84 1585051761 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

324.70

Botnet

spx84

Campaign

1585051761

C2

72.183.241.2:443

75.183.171.155:3389

2.190.139.78:443

98.197.254.40:443

70.174.3.241:443

72.190.30.180:443

197.210.96.222:995

75.110.93.212:443

98.204.224.168:443

78.97.145.242:443

24.99.180.247:443

207.5.138.66:0

73.214.231.2:443

72.132.249.144:995

72.80.137.215:443

81.147.42.207:2222

45.45.105.94:990

172.78.87.180:443

78.96.148.177:443

89.137.211.38:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1248 PING.EXE

pid	process
1248	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exef37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe

pid	process
1912	f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe
588	f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe
588	f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.execmd.exe

description	pid	process	target process
PID 1912 wrote to memory of 588	1912	f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe	f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe
PID 1912 wrote to memory of 588	1912	f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe	f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe
PID 1912 wrote to memory of 588	1912	f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe	f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe
PID 1912 wrote to memory of 588	1912	f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe	f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe
PID 1912 wrote to memory of 484	1912	f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe	cmd.exe
PID 1912 wrote to memory of 484	1912	f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe	cmd.exe
PID 1912 wrote to memory of 484	1912	f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe	cmd.exe
PID 1912 wrote to memory of 484	1912	f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe	cmd.exe
PID 484 wrote to memory of 1248	484	cmd.exe	PING.EXE
PID 484 wrote to memory of 1248	484	cmd.exe	PING.EXE
PID 484 wrote to memory of 1248	484	cmd.exe	PING.EXE
PID 484 wrote to memory of 1248	484	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe
"C:\Users\Admin\AppData\Local\Temp\f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1912

C:\Users\Admin\AppData\Local\Temp\f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe
C:\Users\Admin\AppData\Local\Temp\f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:588

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\f37c950e329c221ccb6d9184d39e73e0b56924bec963e20766148b630dea93ac.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:484

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:1248

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/588-58-0x00000000001B0000-0x00000000001E9000-memory.dmp

Filesize
228KB

Download
memory/588-59-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1912-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1912-55-0x0000000000220000-0x0000000000259000-memory.dmp

Filesize
228KB

Download
memory/1912-56-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing