qakbot | c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599

General

Target

c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe
Size

1.9MB
MD5

f04effdc5bee0d724fb05018f49fc55d
SHA1

e5f05ffc4253b6c4e0e33a01672d55d195d49776
SHA256

c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599
SHA512

0de6e13514c1a40f53d154cb617ceeab9712cb80533af18c06bd470b3a5c1d00e0cb120b45e84ccc8bc0d1881f336fea143f2e438199e2d3e41bb1f9b3df7830

Score

10^/10

qakbot spx109 1588257690 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

324.136

Botnet

spx109

Campaign

1588257690

C2

68.204.164.222:443

47.185.134.79:443

31.5.21.66:443

24.27.82.216:2222

178.193.33.121:2222

96.250.113.218:443

148.75.231.53:443

50.89.14.94:443

50.108.212.180:443

184.57.17.74:443

58.108.188.231:443

47.41.3.40:443

47.39.177.171:2222

47.136.224.60:443

72.29.181.77:2078

94.53.92.42:443

108.227.161.27:995

203.33.139.134:443

72.204.242.138:443

47.180.66.10:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1624 PING.EXE

pid	process
1624	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exec773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe

pid	process
812	c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe
1304	c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe
1304	c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.execmd.exe

description	pid	process	target process
PID 812 wrote to memory of 1304	812	c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe	c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe
PID 812 wrote to memory of 1304	812	c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe	c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe
PID 812 wrote to memory of 1304	812	c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe	c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe
PID 812 wrote to memory of 1304	812	c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe	c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe
PID 812 wrote to memory of 1664	812	c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe	cmd.exe
PID 812 wrote to memory of 1664	812	c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe	cmd.exe
PID 812 wrote to memory of 1664	812	c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe	cmd.exe
PID 812 wrote to memory of 1664	812	c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe	cmd.exe
PID 1664 wrote to memory of 1624	1664	cmd.exe	PING.EXE
PID 1664 wrote to memory of 1624	1664	cmd.exe	PING.EXE
PID 1664 wrote to memory of 1624	1664	cmd.exe	PING.EXE
PID 1664 wrote to memory of 1624	1664	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe
"C:\Users\Admin\AppData\Local\Temp\c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:812

C:\Users\Admin\AppData\Local\Temp\c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe
C:\Users\Admin\AppData\Local\Temp\c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1304

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\c773993caab5bfa7f121ca1e79713083d5a2d386aebb803f52971e0cc1320599.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:1624

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-54-0x00000000769D1000-0x00000000769D3000-memory.dmp

Filesize
8KB

Download
memory/812-56-0x00000000005F0000-0x0000000000627000-memory.dmp

Filesize
220KB

Download
memory/812-57-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/1304-58-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing