qakbot | 586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
30/08/2023, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
Size 2.6MB
Sample230830-s2wayagd39
SHA256 586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac
MD5 3fe9004fb195d4e350d91b342c00c5c3
SHA1 809838d515e90619bdd17fdcaa12c732d98c5dee
SHA512 c0b9272c2dd7609c6fbc3ff3484b7c94a0e476fa88379bd783079a34a35ba1d31f1c635c20309cce983be79811cd6866499037dc0be41164bc2b133215dfc456
SSDEEP 12288:YlQ42wwLHqpVxTXLqVrytXS/eVYkfgn6ggK8:q2wwTEmy5Sm2kfg938
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot notset 1590741916 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

324.142

Botnet

notset

Campaign

1590741916

Credentials

Protocol
ftp
Host
192.185.5.208
Port
21
Username
[email protected]
Password
NxdkxAp4dUsY

Credentials

Protocol
ftp
Host
162.241.218.118
Port
21
Username
[email protected]
Password
EcOV0DyGVgVN

Credentials

Protocol
ftp
Host
69.89.31.139
Port
21
Username
[email protected]
Password
fcR7OvyLrMW6!

Credentials

Protocol
ftp
Host
169.207.67.14
Port
21
Username
[email protected]
Password
eQyicNLzzqPN

108.227.161.27:995
173.187.103.35:443
117.216.185.86:443
24.43.22.220:443
72.190.101.70:443
207.255.161.8:2087
189.160.217.221:443
207.255.161.8:32102
24.226.137.154:443
66.222.88.126:995
108.58.9.238:995
1.40.42.4:443
47.152.210.233:443
72.45.14.185:443
82.127.193.151:2222
101.108.113.6:443
175.111.128.234:995
175.111.128.234:443
47.39.76.74:443
5.12.214.109:2222
24.218.181.15:443
216.201.162.158:995
108.21.107.203:443
107.2.148.99:443
189.236.218.181:443
120.57.74.208:443
75.110.250.89:443
211.24.72.253:443
207.255.161.8:443
50.104.186.71:443
100.38.123.22:443
96.18.240.158:443
173.187.170.190:443
100.40.48.96:443
71.80.66.107:443
67.197.97.144:443
69.28.222.54:443
95.77.223.148:443
47.136.224.60:443
47.202.98.230:443
184.180.157.203:2222
104.221.4.11:2222
70.173.46.139:443
213.67.45.195:2222
46.214.62.199:443
67.131.59.17:443
154.56.69.172:443
72.16.212.108:465
98.121.187.78:443
217.162.149.212:443
74.33.70.245:443
89.47.223.207:443
188.26.243.186:443
72.177.157.217:443
72.29.181.77:2078
203.106.195.139:443
98.114.185.3:443
71.187.170.235:443
71.185.60.227:443
68.204.164.222:443
76.170.77.99:443
37.41.53.184:443
140.82.21.191:443
68.46.142.48:443
98.16.204.189:995
50.244.112.10:443
27.212.0.173:995
62.121.123.57:443
103.76.160.110:443
117.199.4.78:443
63.230.11.201:2083
95.76.6.106:995
67.182.16.216:32103
186.144.174.237:443
47.41.3.40:443
74.75.216.202:443
188.212.133.31:443
31.5.21.66:443
84.117.176.32:443
178.222.29.131:995
81.133.234.36:2222
71.220.172.127:2222
50.29.166.232:995
24.55.152.50:995
75.183.171.155:3389
78.188.109.130:443
58.233.220.182:443
78.97.119.189:443
71.77.231.251:443
73.226.220.56:443
68.174.15.223:443
70.183.127.6:995
59.26.204.210:443
5.107.213.220:2222
173.79.220.156:443
70.174.3.241:443
203.33.139.134:443
71.79.144.56:443
76.187.8.160:443
187.155.66.12:443
117.216.224.103:443
96.56.237.174:32103
79.116.68.99:2222
98.243.187.85:443
75.142.59.167:443
80.14.209.42:2222
120.29.124.86:443
73.121.132.5:443
73.94.229.115:443
108.51.73.186:443
50.247.230.33:995
96.56.237.174:993
50.78.93.74:443
50.244.112.106:443
45.77.215.141:443
66.68.22.151:443
144.202.48.107:443
207.246.71.122:443
201.211.6.211:2078
96.35.170.82:2222
67.170.137.8:443
108.185.113.12:443
98.32.60.217:443
207.255.161.8:2078
86.126.97.183:2222
108.27.217.44:443
207.255.161.8:32103
49.191.130.142:443
137.99.224.198:443
80.184.91.6:443
47.232.26.181:443
72.36.59.46:2222
96.56.237.174:990
207.255.161.8:995
24.43.22.220:993
94.10.81.239:443
94.52.160.116:443
67.0.74.119:443
175.137.136.79:443
73.232.165.200:995
79.119.67.149:443
62.38.111.70:2222
108.58.9.238:993
216.110.249.252:2222
67.209.195.198:3389
84.247.55.190:443
96.37.137.42:443
94.176.220.76:2222
173.245.152.231:443
96.227.122.123:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2704	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2776	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
2524	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
2524	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2524	2776	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe	28
PID 2776 wrote to memory of 2524	2776	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe	28
PID 2776 wrote to memory of 2524	2776	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe	28
PID 2776 wrote to memory of 2524	2776	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe	28
PID 2776 wrote to memory of 2800	2776	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe	31
PID 2776 wrote to memory of 2800	2776	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe	31
PID 2776 wrote to memory of 2800	2776	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe	31
PID 2776 wrote to memory of 2800	2776	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe	31
PID 2800 wrote to memory of 2704	2800	cmd.exe	33
PID 2800 wrote to memory of 2704	2800	cmd.exe	33
PID 2800 wrote to memory of 2704	2800	cmd.exe	33
PID 2800 wrote to memory of 2704	2800	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
"C:\Users\Admin\AppData\Local\Temp\retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
  C:\Users\Admin\AppData\Local\Temp\retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2524-3-0x0000000000400000-0x00000000006A7000-memory.dmp

Download

memory/2524-4-0x0000000000400000-0x00000000006A7000-memory.dmp

Download

memory/2776-0-0x0000000000220000-0x0000000000258000-memory.dmp

Download

memory/2776-1-0x0000000000400000-0x00000000006A7000-memory.dmp

Download

memory/2776-2-0x0000000000400000-0x00000000006A7000-memory.dmp

Download

memory/2776-5-0x0000000000400000-0x00000000006A7000-memory.dmp

Download