qakbot | 8d77cbb7e76c2127e13437f551c0e5907902cd3102eb58d7b8c3e0f7f670214e

Analysis

max time kernel
102s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/01/2024, 03:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
834e05af27bfe0fcdb045a226d37196d.exe
Size 706KB
Sample240131-dt4vsaafd3
SHA256 8d77cbb7e76c2127e13437f551c0e5907902cd3102eb58d7b8c3e0f7f670214e
MD5 834e05af27bfe0fcdb045a226d37196d
SHA1 21eb764cf36045d141f96f870cbaa30ed06575d3
SHA512 db97e61930ee4a86be0f9105e9bbc63fea768f1b091afed298295fb73c6cf3f91284ec3d3a092a4fabd4ad335f0321eab4d89035cbb16a88a90ce1829bf02ef7
SSDEEP 12288:rXJPiW2+w7SuTKfUVLgofr1RFMNnKcSCXxyfjvCPaPsb0z/888888888888W888D:rXJPimSVLLgoz1RRCXxyfjvzP1Ku
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot notset 1590741916 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

324.142

Botnet

notset

Campaign

1590741916

Credentials

Protocol
ftp
Host
192.185.5.208
Port
21
Username
[email protected]
Password
NxdkxAp4dUsY

Credentials

Protocol
ftp
Host
162.241.218.118
Port
21
Username
[email protected]
Password
EcOV0DyGVgVN

Credentials

Protocol
ftp
Host
69.89.31.139
Port
21
Username
[email protected]
Password
fcR7OvyLrMW6!

Credentials

Protocol
ftp
Host
169.207.67.14
Port
21
Username
[email protected]
Password
eQyicNLzzqPN

108.227.161.27:995
173.187.103.35:443
117.216.185.86:443
24.43.22.220:443
72.190.101.70:443
207.255.161.8:2087
189.160.217.221:443
207.255.161.8:32102
24.226.137.154:443
66.222.88.126:995
108.58.9.238:995
1.40.42.4:443
47.152.210.233:443
72.45.14.185:443
82.127.193.151:2222
101.108.113.6:443
175.111.128.234:995
175.111.128.234:443
47.39.76.74:443
5.12.214.109:2222
24.218.181.15:443
216.201.162.158:995
108.21.107.203:443
107.2.148.99:443
189.236.218.181:443
120.57.74.208:443
75.110.250.89:443
211.24.72.253:443
207.255.161.8:443
50.104.186.71:443
100.38.123.22:443
96.18.240.158:443
173.187.170.190:443
100.40.48.96:443
71.80.66.107:443
67.197.97.144:443
69.28.222.54:443
95.77.223.148:443
47.136.224.60:443
47.202.98.230:443
184.180.157.203:2222
104.221.4.11:2222
70.173.46.139:443
213.67.45.195:2222
46.214.62.199:443
67.131.59.17:443
154.56.69.172:443
72.16.212.108:465
98.121.187.78:443
217.162.149.212:443
74.33.70.245:443
89.47.223.207:443
188.26.243.186:443
72.177.157.217:443
72.29.181.77:2078
203.106.195.139:443
98.114.185.3:443
71.187.170.235:443
71.185.60.227:443
68.204.164.222:443
76.170.77.99:443
37.41.53.184:443
140.82.21.191:443
68.46.142.48:443
98.16.204.189:995
50.244.112.10:443
27.212.0.173:995
62.121.123.57:443
103.76.160.110:443
117.199.4.78:443
63.230.11.201:2083
95.76.6.106:995
67.182.16.216:32103
186.144.174.237:443
47.41.3.40:443
74.75.216.202:443
188.212.133.31:443
31.5.21.66:443
84.117.176.32:443
178.222.29.131:995
81.133.234.36:2222
71.220.172.127:2222
50.29.166.232:995
24.55.152.50:995
75.183.171.155:3389
78.188.109.130:443
58.233.220.182:443
78.97.119.189:443
71.77.231.251:443
73.226.220.56:443
68.174.15.223:443
70.183.127.6:995
59.26.204.210:443
5.107.213.220:2222
173.79.220.156:443
70.174.3.241:443
203.33.139.134:443
71.79.144.56:443
76.187.8.160:443
187.155.66.12:443
117.216.224.103:443
96.56.237.174:32103
79.116.68.99:2222
98.243.187.85:443
75.142.59.167:443
80.14.209.42:2222
120.29.124.86:443
73.121.132.5:443
73.94.229.115:443
108.51.73.186:443
50.247.230.33:995
96.56.237.174:993
50.78.93.74:443
50.244.112.106:443
45.77.215.141:443
66.68.22.151:443
144.202.48.107:443
207.246.71.122:443
201.211.6.211:2078
96.35.170.82:2222
67.170.137.8:443
108.185.113.12:443
98.32.60.217:443
207.255.161.8:2078
86.126.97.183:2222
108.27.217.44:443
207.255.161.8:32103
49.191.130.142:443
137.99.224.198:443
80.184.91.6:443
47.232.26.181:443
72.36.59.46:2222
96.56.237.174:990
207.255.161.8:995
24.43.22.220:993
94.10.81.239:443
94.52.160.116:443
67.0.74.119:443
175.137.136.79:443
73.232.165.200:995
79.119.67.149:443
62.38.111.70:2222
108.58.9.238:993
216.110.249.252:2222
67.209.195.198:3389
84.247.55.190:443
96.37.137.42:443
94.176.220.76:2222
173.245.152.231:443
96.227.122.123:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	834e05af27bfe0fcdb045a226d37196d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	834e05af27bfe0fcdb045a226d37196d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	834e05af27bfe0fcdb045a226d37196d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	834e05af27bfe0fcdb045a226d37196d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	834e05af27bfe0fcdb045a226d37196d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	834e05af27bfe0fcdb045a226d37196d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	834e05af27bfe0fcdb045a226d37196d.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1612	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3160	834e05af27bfe0fcdb045a226d37196d.exe
3160	834e05af27bfe0fcdb045a226d37196d.exe
2388	834e05af27bfe0fcdb045a226d37196d.exe
2388	834e05af27bfe0fcdb045a226d37196d.exe
2388	834e05af27bfe0fcdb045a226d37196d.exe
2388	834e05af27bfe0fcdb045a226d37196d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 2388	3160	834e05af27bfe0fcdb045a226d37196d.exe	92
PID 3160 wrote to memory of 2388	3160	834e05af27bfe0fcdb045a226d37196d.exe	92
PID 3160 wrote to memory of 2388	3160	834e05af27bfe0fcdb045a226d37196d.exe	92
PID 3160 wrote to memory of 2212	3160	834e05af27bfe0fcdb045a226d37196d.exe	93
PID 3160 wrote to memory of 2212	3160	834e05af27bfe0fcdb045a226d37196d.exe	93
PID 3160 wrote to memory of 2212	3160	834e05af27bfe0fcdb045a226d37196d.exe	93
PID 2212 wrote to memory of 1612	2212	cmd.exe	95
PID 2212 wrote to memory of 1612	2212	cmd.exe	95
PID 2212 wrote to memory of 1612	2212	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\834e05af27bfe0fcdb045a226d37196d.exe
"C:\Users\Admin\AppData\Local\Temp\834e05af27bfe0fcdb045a226d37196d.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Users\Admin\AppData\Local\Temp\834e05af27bfe0fcdb045a226d37196d.exe
  C:\Users\Admin\AppData\Local\Temp\834e05af27bfe0fcdb045a226d37196d.exe /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\834e05af27bfe0fcdb045a226d37196d.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2388-4-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/2388-5-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/3160-0-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/3160-1-0x00000000006B0000-0x00000000006E8000-memory.dmp

Download

memory/3160-2-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/3160-3-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/3160-6-0x0000000000400000-0x00000000004B4000-memory.dmp

Download