qakbot | 8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8

General

Target

8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe
Size

311KB
MD5

12c09d5a6325da8b0301fc51db45f060
SHA1

b706805e9fb04d4ca758cbf8195cb4c28e985803
SHA256

8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8
SHA512

d5de944449625d73c777bdbd1c694d87e9ca54bcadaeda9f61c8080362decd875a03a9fcd7d6343f1c78c9c8584a39517f3f282196a9b8b4e4e46aa980996c92

Score

10^/10

qakbot notset 1596817234 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.42

Botnet

notset

Campaign

1596817234

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

47.44.217.98:443

86.97.146.204:2222

65.60.228.130:443

216.201.162.158:443

94.59.24.79:995

108.46.145.30:443

24.139.132.70:443

47.206.174.82:443

188.52.106.206:20

72.204.242.138:6881

173.173.72.199:443

71.163.224.206:443

63.155.9.141:995

100.34.195.237:443

47.39.177.171:2222

96.20.108.17:2222

115.21.224.117:443

70.164.39.91:443

45.47.65.191:443

207.155.107.111:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

748 PING.EXE

pid	process
748	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe

pid	process
1668	8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe
960	8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe
960	8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.execmd.exe

description	pid	process	target process
PID 1668 wrote to memory of 960	1668	8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe	8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe
PID 1668 wrote to memory of 960	1668	8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe	8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe
PID 1668 wrote to memory of 960	1668	8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe	8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe
PID 1668 wrote to memory of 960	1668	8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe	8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe
PID 1668 wrote to memory of 1876	1668	8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe	cmd.exe
PID 1668 wrote to memory of 1876	1668	8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe	cmd.exe
PID 1668 wrote to memory of 1876	1668	8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe	cmd.exe
PID 1668 wrote to memory of 1876	1668	8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe	cmd.exe
PID 1876 wrote to memory of 748	1876	cmd.exe	PING.EXE
PID 1876 wrote to memory of 748	1876	cmd.exe	PING.EXE
PID 1876 wrote to memory of 748	1876	cmd.exe	PING.EXE
PID 1876 wrote to memory of 748	1876	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe
"C:\Users\Admin\AppData\Local\Temp\8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe
C:\Users\Admin\AppData\Local\Temp\8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:960

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\8ef40c5c9fb37bdc7d93ca09b18f728b657a076afd4a5c5b39e4095554256ce8.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-58-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1668-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1668-55-0x0000000000220000-0x0000000000264000-memory.dmp

Filesize
272KB

Download
memory/1668-56-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing