qakbot | ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d

General

Target

ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe
Size

339KB
MD5

c6d39ab0c566a3c54e2058a79f05bd69
SHA1

9bdc178bb9e30d739df8397d96d1a99fd362bae1
SHA256

ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d
SHA512

a81279eb872d0f2433b490ba793431ec617a4e766391ea7a8ab632dc52a0ddc3d54fb646513bfb6da02729386b4d84fe68451db9e1d9601413f3ae4bfeec79a8

Score

10^/10

qakbot abc027 1604574287 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.59

Botnet

abc027

Campaign

1604574287

C2

93.86.252.177:995

184.98.97.227:995

188.25.24.21:2222

1.54.190.204:443

89.137.211.239:443

78.101.234.58:443

41.206.131.166:443

87.27.110.90:2222

47.44.217.98:443

197.45.110.165:995

217.133.54.140:32100

41.97.170.119:443

185.246.9.69:995

90.53.232.130:2222

72.186.1.237:443

144.139.230.139:443

86.164.27.33:2222

185.105.131.233:443

90.146.209.224:2222

108.46.145.30:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3220 PING.EXE

pid	process
3220	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exeebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe

pid	process
2424	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe
2424	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe
1464	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe
1464	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe
1464	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe
1464	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.execmd.exe

description	pid	process	target process
PID 2424 wrote to memory of 1464	2424	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe
PID 2424 wrote to memory of 1464	2424	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe
PID 2424 wrote to memory of 1464	2424	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe
PID 2424 wrote to memory of 2088	2424	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe	cmd.exe
PID 2424 wrote to memory of 2088	2424	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe	cmd.exe
PID 2424 wrote to memory of 2088	2424	ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe	cmd.exe
PID 2088 wrote to memory of 3220	2088	cmd.exe	PING.EXE
PID 2088 wrote to memory of 3220	2088	cmd.exe	PING.EXE
PID 2088 wrote to memory of 3220	2088	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe
"C:\Users\Admin\AppData\Local\Temp\ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2424

C:\Users\Admin\AppData\Local\Temp\ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe
C:\Users\Admin\AppData\Local\Temp\ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1464

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\ebb2782b060f9b2651c3d913842440419b95313825352f8af1438506c03e7a5d.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:3220

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-132-0x00000000005C0000-0x000000000061A000-memory.dmp

Filesize
360KB

Download
memory/1464-133-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2424-130-0x00000000021A0000-0x00000000021FA000-memory.dmp

Filesize
360KB

Download
memory/2424-131-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads