qakbot | 966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb

General

Target

966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe
Size

1.9MB
MD5

8d2541dff99194f2caaf922c01534d8b
SHA1

697b3d3ffe7a6cbcd6074ddc9c258fba5b30e048
SHA256

966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb
SHA512

e14236e68149de4dd58da5ff2be1d58cda03e50629c9569a803809e84e0c5707c19bd318ce3df9aa24fb1741a29d5908e611446563e1bd6d0761a50224c2c5df

Score

10^/10

qakbot partner01 1597332272 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

partner01

Campaign

1597332272

C2

72.28.255.159:995

197.210.96.222:995

71.192.44.92:443

189.183.72.138:995

68.33.206.204:443

49.191.3.234:443

71.56.53.127:443

80.14.209.42:2222

24.139.132.70:443

76.187.12.181:443

89.137.211.239:443

216.201.162.158:443

151.73.112.220:443

92.59.35.196:2222

189.140.55.226:443

201.216.216.245:443

50.244.112.10:995

108.28.179.42:995

108.27.217.44:443

72.185.47.86:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe

pid	process
748	966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe
1240	966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe
1240	966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe

description	pid	process	target process
PID 748 wrote to memory of 1240	748	966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe	966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe
PID 748 wrote to memory of 1240	748	966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe	966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe
PID 748 wrote to memory of 1240	748	966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe	966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe
PID 748 wrote to memory of 1240	748	966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe	966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe

C:\Users\Admin\AppData\Local\Temp\966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe
"C:\Users\Admin\AppData\Local\Temp\966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:748

C:\Users\Admin\AppData\Local\Temp\966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe
C:\Users\Admin\AppData\Local\Temp\966b94be9ea59f7ddd2a2e01ad64f4795efbc2fe3fa92fcd83002cd67a5c3efb.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1240

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-54-0x0000000000260000-0x0000000000294000-memory.dmp

Filesize
208KB

Download
memory/748-55-0x0000000075541000-0x0000000075543000-memory.dmp

Filesize
8KB

Download
memory/748-56-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/1240-57-0x0000000000000000-mapping.dmp

Download
memory/1240-59-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing