qakbot | 6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5

General

Target

6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe
Size

1.0MB
MD5

929d676f65ef918e74c70a2693626836
SHA1

49a9fdb10f1457dffe1b118318b91bc37797e015
SHA256

6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5
SHA512

2364ab444324c3d24fc2c6374e75c6037edc1296d91867457df89d8994a10cd644b3bd829dcbeb85d4b1851d0857a1b93a6b756885e79f4a6c8b12c3c8614f71

Score

10^/10

qakbot abc020 1602752985 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc020

Campaign

1602752985

C2

2.89.121.99:995

89.42.142.35:443

81.133.234.36:2222

71.163.222.203:443

75.136.40.155:443

93.149.253.201:2222

71.187.170.235:443

185.19.190.81:443

196.221.61.242:443

72.28.255.159:995

45.32.162.253:443

45.32.155.12:443

45.32.155.12:2222

199.247.16.80:443

134.0.196.46:995

24.27.82.216:2222

117.218.208.239:443

68.225.60.77:443

217.162.149.212:443

71.19.217.23:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2028 PING.EXE

pid	process
2028	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe

pid	process
952	6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe
1328	6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe
1328	6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.execmd.exe

description	pid	process	target process
PID 952 wrote to memory of 1328	952	6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe	6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe
PID 952 wrote to memory of 1328	952	6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe	6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe
PID 952 wrote to memory of 1328	952	6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe	6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe
PID 952 wrote to memory of 1328	952	6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe	6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe
PID 952 wrote to memory of 844	952	6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe	cmd.exe
PID 952 wrote to memory of 844	952	6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe	cmd.exe
PID 952 wrote to memory of 844	952	6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe	cmd.exe
PID 952 wrote to memory of 844	952	6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe	cmd.exe
PID 844 wrote to memory of 2028	844	cmd.exe	PING.EXE
PID 844 wrote to memory of 2028	844	cmd.exe	PING.EXE
PID 844 wrote to memory of 2028	844	cmd.exe	PING.EXE
PID 844 wrote to memory of 2028	844	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe
"C:\Users\Admin\AppData\Local\Temp\6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:952

C:\Users\Admin\AppData\Local\Temp\6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe
C:\Users\Admin\AppData\Local\Temp\6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1328

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\6286bde1fdaf29aebcf97da1529ebb8539ca2e4fb22cbefc680eac2cc32fb1a5.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:2028

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-61-0x0000000000000000-mapping.dmp

Download
memory/952-54-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/952-55-0x0000000000770000-0x000000000087A000-memory.dmp

Filesize
1.0MB

Download
memory/952-56-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/1328-57-0x0000000000000000-mapping.dmp

Download
memory/1328-59-0x0000000001E30000-0x0000000001F3A000-memory.dmp

Filesize
1.0MB

Download
memory/1328-60-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/2028-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing