qakbot | 90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca

General

Target

90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe
Size

2.1MB
MD5

3cfafa3023835a5c03c97abfd498366a
SHA1

10ab87658d5dac5654ee68e902514e80e5d3ec1c
SHA256

90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca
SHA512

b9c5f9e41fa0f575c07ee122810492b5f6be37513376c75ee1b9373da7ba15e2cec0fe70823559ac0dfef0a31ab368ea5232b73a378f57590903bf7724be414f

Score

10^/10

qakbot spx90 1586180537 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

324.75

Botnet

spx90

Campaign

1586180537

C2

79.113.218.134:443

71.77.231.251:443

89.43.136.239:443

72.36.59.46:2222

76.30.66.244:443

73.163.242.114:443

173.216.174.39:443

70.95.94.91:2078

208.126.142.17:443

216.152.7.12:443

172.87.134.226:443

71.58.21.235:443

173.62.161.126:443

184.21.151.81:995

208.93.202.49:443

206.183.190.53:995

69.123.179.70:443

63.155.135.211:995

72.209.191.27:443

73.184.218.146:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1560 PING.EXE

pid	process
1560	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe

pid	process
2004	90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe
1536	90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe
1536	90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.execmd.exe

description	pid	process	target process
PID 2004 wrote to memory of 1536	2004	90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe	90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe
PID 2004 wrote to memory of 1536	2004	90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe	90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe
PID 2004 wrote to memory of 1536	2004	90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe	90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe
PID 2004 wrote to memory of 1536	2004	90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe	90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe
PID 2004 wrote to memory of 1624	2004	90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe	cmd.exe
PID 2004 wrote to memory of 1624	2004	90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe	cmd.exe
PID 2004 wrote to memory of 1624	2004	90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe	cmd.exe
PID 2004 wrote to memory of 1624	2004	90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe	cmd.exe
PID 1624 wrote to memory of 1560	1624	cmd.exe	PING.EXE
PID 1624 wrote to memory of 1560	1624	cmd.exe	PING.EXE
PID 1624 wrote to memory of 1560	1624	cmd.exe	PING.EXE
PID 1624 wrote to memory of 1560	1624	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe
"C:\Users\Admin\AppData\Local\Temp\90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004

C:\Users\Admin\AppData\Local\Temp\90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe
C:\Users\Admin\AppData\Local\Temp\90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\90e9c74f78bb70df8cdb84b78e24d997eba83e74fefc04833e14e17b4add10ca.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:1560

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-59-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download
memory/2004-55-0x0000000076731000-0x0000000076733000-memory.dmp

Filesize
8KB

Download
memory/2004-56-0x00000000002E0000-0x0000000000319000-memory.dmp

Filesize
228KB

Download
memory/2004-58-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing