qakbot | 2084acc65a520f3947385ad22b8238c6907cf93d091fc19263de8cd64b71346e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe
Size

4.0MB
MD5

70cf72c2fe104564e06fc40630c3c4c4
SHA1

24fce3e1466b5c46ea35b6be2c022aa6706e7138
SHA256

2084acc65a520f3947385ad22b8238c6907cf93d091fc19263de8cd64b71346e
SHA512

c97c90c1000691aa02fa2034ee6fc0d67f2acaee7e391cea9771c086f0dfc0e28536f24218f927ad396b048a553f58010e9d42fc0895c33e73653748b6d08d17
SSDEEP

6144:R1grY0tn9cY1pZHiCKuZqncFL68UlyCSLo3fw:R5NCkgqcFL64H0o

Score

10^/10

qakbot abc010 1601379374 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc010

Campaign

1601379374

24.104.222.81:443

108.190.151.108:2222

71.74.12.34:443

93.177.144.236:443

191.84.15.181:443

82.210.157.185:443

75.137.239.211:443

141.158.47.123:443

108.49.221.180:443

189.183.74.198:995

74.195.88.59:995

95.77.144.238:443

103.206.112.234:443

100.1.39.62:443

24.27.82.216:2222

80.240.26.178:443

50.244.112.106:443

5.15.90.159:2222

89.42.142.35:443

24.201.79.208:2078

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2816 PING.EXE

pid	process
2816	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe

pid	process
2196	70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe
2972	70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe
2972	70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 2196 wrote to memory of 2972	2196	70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe	70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe
PID 2196 wrote to memory of 2972	2196	70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe	70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe
PID 2196 wrote to memory of 2972	2196	70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe	70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe
PID 2196 wrote to memory of 2972	2196	70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe	70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe
PID 2196 wrote to memory of 2824	2196	70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe	cmd.exe
PID 2196 wrote to memory of 2824	2196	70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe	cmd.exe
PID 2196 wrote to memory of 2824	2196	70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe	cmd.exe
PID 2196 wrote to memory of 2824	2196	70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe	cmd.exe
PID 2824 wrote to memory of 2816	2824	cmd.exe	PING.EXE
PID 2824 wrote to memory of 2816	2824	cmd.exe	PING.EXE
PID 2824 wrote to memory of 2816	2824	cmd.exe	PING.EXE
PID 2824 wrote to memory of 2816	2824	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2196

C:\Users\Admin\AppData\Local\Temp\70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2972

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\70cf72c2fe104564e06fc40630c3c4c4_JaffaCakes118.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2824

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:2816

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2196-1-0x0000000000810000-0x000000000088C000-memory.dmp

Filesize
496KB

Download
memory/2196-0-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/2196-2-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2196-3-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/2196-7-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2196-6-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/2972-4-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/2972-5-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download