qakbot | f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057

General

Target

f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe
Size

1.1MB
MD5

c0524801008ee715be12b40905775327
SHA1

8be4831719184559e3051e5f0b38707ca6141302
SHA256

f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057
SHA512

2eec77b5b54203077b126e4dc1ef8457f15f047bb4e4ab6752113779dfd505e6c43cd7f6157d4b1674e8b67b4f4466cd287781414683d47005a758c8a96dee38
SSDEEP

12288:rhvgrb1rbX82UML/axdZP/rmhLeh3Kb2GH71NQTLBR32Yrm25Q7aDaNb:L2UM7YGedKaGHJNQTVR32Ya2KOeb

Score

10^/10

qakbot notset 1590741916 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

324.142

Botnet

notset

Campaign

1590741916

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
[email protected]
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
[email protected]
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
[email protected]
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
[email protected]
Password:
eQyicNLzzqPN

C2

108.227.161.27:995

173.187.103.35:443

117.216.185.86:443

24.43.22.220:443

72.190.101.70:443

207.255.161.8:2087

189.160.217.221:443

207.255.161.8:32102

24.226.137.154:443

66.222.88.126:995

108.58.9.238:995

1.40.42.4:443

47.152.210.233:443

72.45.14.185:443

82.127.193.151:2222

101.108.113.6:443

175.111.128.234:995

175.111.128.234:443

47.39.76.74:443

5.12.214.109:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
816	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exef4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe

pid	Process
2988	f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe
1964	f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe
1964	f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.execmd.exe

description	pid	Process	procid_target
PID 2988 wrote to memory of 1964	2988	f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe	28
PID 2988 wrote to memory of 1964	2988	f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe	28
PID 2988 wrote to memory of 1964	2988	f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe	28
PID 2988 wrote to memory of 1964	2988	f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe	28
PID 2988 wrote to memory of 2356	2988	f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe	29
PID 2988 wrote to memory of 2356	2988	f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe	29
PID 2988 wrote to memory of 2356	2988	f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe	29
PID 2988 wrote to memory of 2356	2988	f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe	29
PID 2356 wrote to memory of 816	2356	cmd.exe	31
PID 2356 wrote to memory of 816	2356	cmd.exe	31
PID 2356 wrote to memory of 816	2356	cmd.exe	31
PID 2356 wrote to memory of 816	2356	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe
"C:\Users\Admin\AppData\Local\Temp\f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe
  C:\Users\Admin\AppData\Local\Temp\f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\f4c6470686b385378a04ad01937a125af6f1bbf62e09bc143be937b835306057.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1964-3-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/1964-4-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/2988-0-0x0000000000570000-0x00000000005A8000-memory.dmp

Filesize
224KB

Download
memory/2988-1-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/2988-2-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/2988-5-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads