qakbot | 6b8c4f94cfb09ebe365c1db4ba45404039d860d0bbe61395eef6dd5929ca4f30

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d8574097e8b51fc753926a2bc664a80N.exe
Size 5.7MB
Sample240907-d2dcsssfnj
SHA256 6b8c4f94cfb09ebe365c1db4ba45404039d860d0bbe61395eef6dd5929ca4f30
MD5 5d8574097e8b51fc753926a2bc664a80
SHA1 291f81cf6f058202a7d7ef58ca4a2d28b6b9c547
SHA512 a640efb8fd171c769fdd0396dbba307c443550481db8b79076fa5996a8b65ce4cba2441136b3ed3a7be2e000b696fa9e677701f5de674412226f67c1869e1e4b
SSDEEP 6144:K4thSUHz9HRg1c5Fm0Dq7VTu0Cdvm2MU3Iv7HCuqBl9scWBJy:hh3Hz9HeWFJDmV61AXuu6D
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot abc001 1599561498 banker discovery stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc001

Campaign

1599561498

166.62.180.194:2078
99.240.226.2:443
95.77.144.238:443
85.122.141.42:995
31.53.49.169:2222
201.216.216.245:443
209.59.87.147:443
85.186.122.190:443
45.32.155.12:443
178.193.38.188:2222
89.137.211.72:443
66.215.32.224:443
199.247.22.145:443
71.84.5.114:995
216.201.162.158:443
47.146.32.175:443
75.81.25.223:443
178.222.21.87:995
24.234.86.201:995
68.33.206.204:443
69.11.247.242:443
184.180.157.203:2222
108.185.113.12:443
154.56.64.251:443
176.202.187.129:61201
185.246.9.69:995
207.255.161.8:993
173.70.165.101:995
2.7.65.32:2222
71.126.139.251:443
36.77.151.211:443
76.111.128.194:443
71.187.170.235:443
72.28.255.159:995
207.255.161.8:32100
5.13.76.177:443
74.75.237.11:443
86.98.49.75:2078
68.14.210.246:22
94.49.68.94:995
50.104.68.223:443
50.244.112.10:995
72.204.242.138:465
46.248.48.232:995
72.209.191.27:443
50.232.172.114:443
71.182.142.63:443
108.31.15.10:995
86.163.174.7:2222
68.174.15.223:443
96.18.240.158:443
108.46.145.30:443
81.103.144.77:443
203.198.96.200:443
207.246.75.201:443
45.77.193.83:443
77.27.174.49:995
67.209.195.198:443
134.0.196.46:995
118.168.233.83:443
98.173.34.212:995
50.29.166.232:995
207.255.161.8:995
86.97.146.204:2222
217.165.164.57:2222
103.76.160.110:443
50.244.112.106:443
77.159.149.74:443
86.98.89.78:2222
47.28.131.209:443
82.210.157.185:443
47.153.115.154:995
173.81.22.215:443
188.26.178.176:2222
213.120.109.73:2222
2.42.219.242:443
72.179.13.59:443
176.223.7.75:2222
24.37.178.158:443
95.179.247.224:443
45.32.154.10:443
199.247.16.80:443
207.255.161.8:443
207.255.161.8:2087
207.255.161.8:32103
96.227.127.13:443
192.40.225.168:443
117.218.208.239:443
189.231.196.236:443
39.36.29.105:995
105.102.107.86:443
47.146.169.85:443
65.30.213.13:6882
209.182.122.217:443
72.204.242.138:20
89.45.107.94:443
64.121.114.87:443
75.110.250.89:995
80.195.103.146:2222
78.96.199.79:443
47.44.217.98:443
75.136.40.155:443
46.53.5.10:443
50.247.230.33:995
41.228.56.159:443
68.190.152.98:443
72.90.243.117:0
72.66.47.70:443
80.240.26.178:443
203.106.195.67:443
72.132.249.144:995
86.97.162.2:443
211.24.72.253:443
141.158.47.123:443
41.97.162.27:443
41.36.51.183:995
47.180.66.10:443
190.85.91.154:443
2.91.73.118:995
72.186.1.237:443
175.211.225.118:443
173.245.152.231:443
75.87.161.32:995
73.232.165.200:995
217.162.149.212:443
207.255.161.8:465
173.22.125.129:2222
61.3.126.55:443
208.82.44.203:443
172.78.30.215:443
59.96.59.31:443
5.193.181.221:2078
104.221.4.11:2222
200.124.231.21:443
185.19.190.81:443
24.201.79.208:2078
98.121.187.78:443
2.50.59.219:443
59.26.204.144:443
81.133.234.36:2222
58.233.220.210:443
151.73.125.102:443
197.37.111.167:993
35.134.202.234:443
84.247.55.190:443
172.91.19.192:443
188.214.223.150:995
47.138.201.136:443
47.185.140.236:80
117.199.2.176:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	5d8574097e8b51fc753926a2bc664a80N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d8574097e8b51fc753926a2bc664a80N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d8574097e8b51fc753926a2bc664a80N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2364	cmd.exe
3524	PING.EXE

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	5d8574097e8b51fc753926a2bc664a80N.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	5d8574097e8b51fc753926a2bc664a80N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	5d8574097e8b51fc753926a2bc664a80N.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	5d8574097e8b51fc753926a2bc664a80N.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	5d8574097e8b51fc753926a2bc664a80N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	5d8574097e8b51fc753926a2bc664a80N.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3524	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2028	5d8574097e8b51fc753926a2bc664a80N.exe
2028	5d8574097e8b51fc753926a2bc664a80N.exe
900	5d8574097e8b51fc753926a2bc664a80N.exe
900	5d8574097e8b51fc753926a2bc664a80N.exe
900	5d8574097e8b51fc753926a2bc664a80N.exe
900	5d8574097e8b51fc753926a2bc664a80N.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 900	2028	5d8574097e8b51fc753926a2bc664a80N.exe	96
PID 2028 wrote to memory of 900	2028	5d8574097e8b51fc753926a2bc664a80N.exe	96
PID 2028 wrote to memory of 900	2028	5d8574097e8b51fc753926a2bc664a80N.exe	96
PID 2028 wrote to memory of 2364	2028	5d8574097e8b51fc753926a2bc664a80N.exe	99
PID 2028 wrote to memory of 2364	2028	5d8574097e8b51fc753926a2bc664a80N.exe	99
PID 2028 wrote to memory of 2364	2028	5d8574097e8b51fc753926a2bc664a80N.exe	99
PID 2364 wrote to memory of 3524	2364	cmd.exe	101
PID 2364 wrote to memory of 3524	2364	cmd.exe	101
PID 2364 wrote to memory of 3524	2364	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\5d8574097e8b51fc753926a2bc664a80N.exe
"C:\Users\Admin\AppData\Local\Temp\5d8574097e8b51fc753926a2bc664a80N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\5d8574097e8b51fc753926a2bc664a80N.exe
  C:\Users\Admin\AppData\Local\Temp\5d8574097e8b51fc753926a2bc664a80N.exe /C
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\5d8574097e8b51fc753926a2bc664a80N.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-5-0x0000000000400000-0x00000000009BD000-memory.dmp

Download

memory/900-6-0x0000000000400000-0x00000000009BD000-memory.dmp

Download

memory/900-8-0x0000000000400000-0x00000000009BD000-memory.dmp

Download

memory/2028-0-0x0000000002710000-0x000000000278C000-memory.dmp

Download

memory/2028-1-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/2028-2-0x0000000000400000-0x00000000009BD000-memory.dmp

Download

memory/2028-3-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/2028-10-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/2028-9-0x0000000000400000-0x00000000009BD000-memory.dmp

Download