qakbot | 586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac

Analysis

max time kernel
138s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230824-en
resource tags

arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2023, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
Size 2.6MB
Sample230830-s2wayagd39
SHA256 586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac
MD5 3fe9004fb195d4e350d91b342c00c5c3
SHA1 809838d515e90619bdd17fdcaa12c732d98c5dee
SHA512 c0b9272c2dd7609c6fbc3ff3484b7c94a0e476fa88379bd783079a34a35ba1d31f1c635c20309cce983be79811cd6866499037dc0be41164bc2b133215dfc456
SSDEEP 12288:YlQ42wwLHqpVxTXLqVrytXS/eVYkfgn6ggK8:q2wwTEmy5Sm2kfg938
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot notset 1590741916 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

324.142

Botnet

notset

Campaign

1590741916

Credentials

Protocol
ftp
Host
192.185.5.208
Port
21
Username
[email protected]
Password
NxdkxAp4dUsY

Credentials

Protocol
ftp
Host
162.241.218.118
Port
21
Username
[email protected]
Password
EcOV0DyGVgVN

Credentials

Protocol
ftp
Host
69.89.31.139
Port
21
Username
[email protected]
Password
fcR7OvyLrMW6!

Credentials

Protocol
ftp
Host
169.207.67.14
Port
21
Username
[email protected]
Password
eQyicNLzzqPN

108.227.161.27:995
173.187.103.35:443
117.216.185.86:443
24.43.22.220:443
72.190.101.70:443
207.255.161.8:2087
189.160.217.221:443
207.255.161.8:32102
24.226.137.154:443
66.222.88.126:995
108.58.9.238:995
1.40.42.4:443
47.152.210.233:443
72.45.14.185:443
82.127.193.151:2222
101.108.113.6:443
175.111.128.234:995
175.111.128.234:443
47.39.76.74:443
5.12.214.109:2222
24.218.181.15:443
216.201.162.158:995
108.21.107.203:443
107.2.148.99:443
189.236.218.181:443
120.57.74.208:443
75.110.250.89:443
211.24.72.253:443
207.255.161.8:443
50.104.186.71:443
100.38.123.22:443
96.18.240.158:443
173.187.170.190:443
100.40.48.96:443
71.80.66.107:443
67.197.97.144:443
69.28.222.54:443
95.77.223.148:443
47.136.224.60:443
47.202.98.230:443
184.180.157.203:2222
104.221.4.11:2222
70.173.46.139:443
213.67.45.195:2222
46.214.62.199:443
67.131.59.17:443
154.56.69.172:443
72.16.212.108:465
98.121.187.78:443
217.162.149.212:443
74.33.70.245:443
89.47.223.207:443
188.26.243.186:443
72.177.157.217:443
72.29.181.77:2078
203.106.195.139:443
98.114.185.3:443
71.187.170.235:443
71.185.60.227:443
68.204.164.222:443
76.170.77.99:443
37.41.53.184:443
140.82.21.191:443
68.46.142.48:443
98.16.204.189:995
50.244.112.10:443
27.212.0.173:995
62.121.123.57:443
103.76.160.110:443
117.199.4.78:443
63.230.11.201:2083
95.76.6.106:995
67.182.16.216:32103
186.144.174.237:443
47.41.3.40:443
74.75.216.202:443
188.212.133.31:443
31.5.21.66:443
84.117.176.32:443
178.222.29.131:995
81.133.234.36:2222
71.220.172.127:2222
50.29.166.232:995
24.55.152.50:995
75.183.171.155:3389
78.188.109.130:443
58.233.220.182:443
78.97.119.189:443
71.77.231.251:443
73.226.220.56:443
68.174.15.223:443
70.183.127.6:995
59.26.204.210:443
5.107.213.220:2222
173.79.220.156:443
70.174.3.241:443
203.33.139.134:443
71.79.144.56:443
76.187.8.160:443
187.155.66.12:443
117.216.224.103:443
96.56.237.174:32103
79.116.68.99:2222
98.243.187.85:443
75.142.59.167:443
80.14.209.42:2222
120.29.124.86:443
73.121.132.5:443
73.94.229.115:443
108.51.73.186:443
50.247.230.33:995
96.56.237.174:993
50.78.93.74:443
50.244.112.106:443
45.77.215.141:443
66.68.22.151:443
144.202.48.107:443
207.246.71.122:443
201.211.6.211:2078
96.35.170.82:2222
67.170.137.8:443
108.185.113.12:443
98.32.60.217:443
207.255.161.8:2078
86.126.97.183:2222
108.27.217.44:443
207.255.161.8:32103
49.191.130.142:443
137.99.224.198:443
80.184.91.6:443
47.232.26.181:443
72.36.59.46:2222
96.56.237.174:990
207.255.161.8:995
24.43.22.220:993
94.10.81.239:443
94.52.160.116:443
67.0.74.119:443
175.137.136.79:443
73.232.165.200:995
79.119.67.149:443
62.38.111.70:2222
108.58.9.238:993
216.110.249.252:2222
67.209.195.198:3389
84.247.55.190:443
96.37.137.42:443
94.176.220.76:2222
173.245.152.231:443
96.227.122.123:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Control Panel\International\Geo\Nation	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3100	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4164	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
4164	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
4876	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
4876	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
4876	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
4876	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 4876	4164	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe	87
PID 4164 wrote to memory of 4876	4164	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe	87
PID 4164 wrote to memory of 4876	4164	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe	87
PID 4164 wrote to memory of 756	4164	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe	88
PID 4164 wrote to memory of 756	4164	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe	88
PID 4164 wrote to memory of 756	4164	retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe	88
PID 756 wrote to memory of 3100	756	cmd.exe	90
PID 756 wrote to memory of 3100	756	cmd.exe	90
PID 756 wrote to memory of 3100	756	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
"C:\Users\Admin\AppData\Local\Temp\retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Users\Admin\AppData\Local\Temp\retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe
  C:\Users\Admin\AppData\Local\Temp\retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\retrohunt_586eb933e2123d683f8ce8da2aece5a2094dca72be0a1ded18210c12351451ac.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4164-0-0x0000000000840000-0x0000000000878000-memory.dmp

Download

memory/4164-1-0x0000000000400000-0x00000000006A7000-memory.dmp

Download

memory/4164-2-0x0000000000400000-0x00000000006A7000-memory.dmp

Download

memory/4164-4-0x0000000000400000-0x00000000006A7000-memory.dmp

Download

memory/4876-3-0x0000000000400000-0x00000000006A7000-memory.dmp

Download