Resubmissions

20-03-2023 20:10

230320-yx3gcafc24 10

20-03-2023 10:43

230320-msm1bafa5t 10

20-03-2023 10:23

230320-me3hvach68 10

18-03-2023 10:19

230318-mcwyaaea3z 10

General

  • Target

    quak.dll

  • Size

    216KB

  • Sample

    230320-me3hvach68

  • MD5

    58e1c32eeb0130da19625e55ee48cf1e

  • SHA1

    00ae1c5066f67e5e71285de99bea8d8b67085743

  • SHA256

    f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

  • SHA512

    31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2

  • SSDEEP

    3072:4FCXMfyhFPZ8H7kJiIceKozOMeNJwOUJCfUfWcxQvAKChQztvWZZOtyFb8e:lXPFP6HWriMeN2rJCyWVDhM55

Malware Config

Extracted

Family

qakbot

Version

324.142

Botnet

spx143

Campaign

1592482956

C2

39.36.254.179:995

24.139.132.70:443

24.202.42.48:2222

72.204.242.138:443

172.242.156.50:995

72.204.242.138:20

68.174.15.223:443

74.193.197.246:443

96.56.237.174:990

64.19.74.29:995

70.168.130.172:443

189.236.166.167:443

68.4.137.211:443

76.187.8.160:443

76.86.57.179:2222

73.226.220.56:443

67.250.184.157:443

75.183.171.155:3389

173.172.205.216:443

173.3.132.17:995

Targets

    • Target

      quak.dll

    • Size

      216KB

    • MD5

      58e1c32eeb0130da19625e55ee48cf1e

    • SHA1

      00ae1c5066f67e5e71285de99bea8d8b67085743

    • SHA256

      f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

    • SHA512

      31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2

    • SSDEEP

      3072:4FCXMfyhFPZ8H7kJiIceKozOMeNJwOUJCfUfWcxQvAKChQztvWZZOtyFb8e:lXPFP6HWriMeN2rJCyWVDhM55

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Turns off Windows Defender SpyNet reporting

    • Windows security bypass

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

2
T1112

Discovery

System Information Discovery

2
T1082

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Tasks