qakbot | 7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0

Analysis

max time kernel
139s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20/04/2022, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe
Size 226KB
Sample220420-lnvc6afec9
SHA256 7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0
MD5 f5f5f08eb05d99ad71e480770ce250bb
SHA1 8f1f1be35735d9fca76a6f2f02fff399a3a0451d
SHA512 2f5b4ddee875b3b7ec396aefa33fcac09b72becb0f0e763af22ee013ffbf50ebcf5aff8df7ac98754e8bcc0adbd4197ff07fe4e04d765e5d3e3a4f631dd8c8c6
MD5 SHA1 SHA512

Score

10^/10

qakbot tr01 1603793855 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

tr01

Campaign

1603793855

50.104.68.223:443
89.137.211.239:443
95.77.223.148:443
197.37.69.138:993
68.174.15.223:443
103.238.231.35:443
36.77.151.211:443
72.16.56.171:443
45.47.65.191:443
189.231.212.189:443
106.51.52.111:443
24.55.66.125:443
39.37.247.97:995
108.190.151.108:2222
203.198.96.61:443
73.228.1.246:443
35.134.202.234:443
188.50.230.249:995
86.120.64.150:2222
5.14.126.153:443
64.121.114.87:443
108.46.145.30:443
45.77.193.83:443
207.246.75.201:443
94.52.160.116:443
86.98.89.100:2222
47.44.217.98:443
102.186.103.0:443
217.162.149.212:443
92.59.35.196:2222
83.110.80.66:995
5.12.255.109:443
86.121.121.14:2222
45.32.154.10:443
98.26.50.62:995
2.50.57.213:443
77.27.174.49:995
2.7.65.32:2222
98.4.227.199:443
151.73.112.197:443
108.31.15.10:995
78.97.207.104:443
72.66.47.70:443
72.36.59.46:2222
80.240.26.178:443
184.97.134.255:443
216.201.162.158:443
146.200.250.36:2222
94.52.68.72:443
103.206.112.234:443
108.185.113.12:443
75.136.40.155:443
77.159.149.74:443
72.71.230.82:2222
66.215.32.224:443
45.32.155.12:443
203.106.195.67:443
199.247.16.80:443
41.227.67.92:443
173.3.17.223:995
185.19.190.81:443
78.96.199.79:443
173.245.152.231:443
75.137.239.211:443
1.160.141.215:443
217.165.96.127:990
50.244.112.10:995
41.97.179.154:443
134.0.196.46:995
45.32.165.134:443
41.225.13.128:8443
45.63.104.123:443
207.246.70.216:443
176.205.145.61:995
2.50.131.64:443
45.32.155.12:2222
96.30.198.161:443
140.82.27.132:443
45.32.155.12:995
24.43.22.220:993
173.70.165.101:995
202.141.244.118:995
80.195.103.146:2222
184.96.158.62:993
93.113.177.152:443
31.5.21.66:443
24.27.82.216:2222
84.247.55.190:443
188.27.178.166:443
45.32.162.253:443
95.179.247.224:443
199.247.22.145:443
95.76.27.6:443
81.97.154.100:443
174.30.165.242:2222
197.210.96.222:995
203.45.104.33:443
45.46.53.140:2222
189.183.209.130:995
173.21.10.71:2222
47.138.201.136:443
144.139.47.206:443
69.123.179.70:443
69.123.116.167:2222
24.40.173.134:443
173.173.1.164:443
117.199.7.191:443
85.204.189.105:443
72.29.181.78:2222
71.220.164.199:2222
65.102.150.178:995
24.128.117.95:443
69.47.239.10:443
200.38.254.177:443
201.103.145.28:443
74.195.88.59:443
66.97.247.15:443
50.29.166.232:995
83.110.3.77:2078
98.115.243.237:443
99.240.226.2:443
73.200.219.143:443
24.205.42.241:443
72.196.114.129:443
206.183.190.53:993
67.6.55.77:443
68.184.45.73:443
24.28.183.107:995
98.121.187.78:443
98.240.24.57:443
67.165.206.193:993
89.33.87.107:443
96.237.141.134:995
5.193.181.221:2078
24.213.191.38:0
108.30.125.94:443
108.191.28.158:443
71.197.126.250:443
68.46.142.48:995
75.136.26.147:443
72.82.15.220:443
191.84.0.209:443
71.182.142.63:443
36.236.230.253:443
186.31.47.254:443
68.104.6.221:443
74.137.189.78:443
79.117.56.230:443
68.33.206.204:443
187.200.72.253:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4984	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3260	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe
3260	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe
4700	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe
4700	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe
4700	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe
4700	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 4700	3260	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe	81
PID 3260 wrote to memory of 4700	3260	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe	81
PID 3260 wrote to memory of 4700	3260	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe	81
PID 3260 wrote to memory of 4684	3260	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe	82
PID 3260 wrote to memory of 4684	3260	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe	82
PID 3260 wrote to memory of 4684	3260	7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe	82
PID 4684 wrote to memory of 4984	4684	cmd.exe	84
PID 4684 wrote to memory of 4984	4684	cmd.exe	84
PID 4684 wrote to memory of 4984	4684	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe
"C:\Users\Admin\AppData\Local\Temp\7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Users\Admin\AppData\Local\Temp\7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe
  C:\Users\Admin\AppData\Local\Temp\7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\7cd7f2c5707e70f034b08518c4568f06dd2ecf3862fd88f0920c556f6d5f0ba0.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3260-130-0x00000000009E0000-0x0000000000A14000-memory.dmp

Download

memory/3260-131-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4700-133-0x0000000000400000-0x000000000043B000-memory.dmp

Download