qakbot | 871371ff7eb668d8281e8a01af78e4f037f5204311e996b7a133e0d5c51a612e

General

Target

444444.exe
Size

340KB
MD5

36af3d937d99c46cd829957af7f37886
SHA1

6901f63c7339374c0c1b499f593b0a7520c2e266
SHA256

871371ff7eb668d8281e8a01af78e4f037f5204311e996b7a133e0d5c51a612e
SHA512

2cf1464e7fe0645dbc2b9b6e0b158c512ffc8fa9d3b1ba5f10fdefdd3674d69a5a36c7be74b9468d6af9a62972728b13f62e43c3ccb7386e5c415d5d05608e5d

Score

10^/10

evasion trojan persistence banker stealer qakbot

Malware Config

Signatures

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Aehqityril = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ujuwuua.exe444444.exeujuwuua.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&135B206D&0&010000	ujuwuua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&135B206D&0&010000	444444.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Service	444444.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Service	444444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&135B206D&0&000000	ujuwuua.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\DeviceDesc	ujuwuua.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\DeviceDesc	ujuwuua.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\DeviceDesc	444444.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\DeviceDesc	444444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&135B206D&0&010000	ujuwuua.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\DeviceDesc	ujuwuua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&135B206D&0&000000	444444.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Service	ujuwuua.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Service	ujuwuua.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Service	ujuwuua.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Service	ujuwuua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&135B206D&0&000000	ujuwuua.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\DeviceDesc	ujuwuua.exe

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	reg.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

444444.exeujuwuua.exe444444.exeujuwuua.exe

description	pid	process	target process
PID 4020 wrote to memory of 3988	4020	444444.exe	444444.exe
PID 4020 wrote to memory of 3988	4020	444444.exe	444444.exe
PID 4020 wrote to memory of 3988	4020	444444.exe	444444.exe
PID 4020 wrote to memory of 2588	4020	444444.exe	ujuwuua.exe
PID 4020 wrote to memory of 2588	4020	444444.exe	ujuwuua.exe
PID 4020 wrote to memory of 2588	4020	444444.exe	ujuwuua.exe
PID 4020 wrote to memory of 3544	4020	444444.exe	schtasks.exe
PID 4020 wrote to memory of 3544	4020	444444.exe	schtasks.exe
PID 4020 wrote to memory of 3544	4020	444444.exe	schtasks.exe
PID 2588 wrote to memory of 3500	2588	ujuwuua.exe	ujuwuua.exe
PID 2588 wrote to memory of 3500	2588	ujuwuua.exe	ujuwuua.exe
PID 2588 wrote to memory of 3500	2588	ujuwuua.exe	ujuwuua.exe
PID 2588 wrote to memory of 3080	2588	ujuwuua.exe	explorer.exe
PID 2588 wrote to memory of 3080	2588	ujuwuua.exe	explorer.exe
PID 2588 wrote to memory of 3080	2588	ujuwuua.exe	explorer.exe
PID 2588 wrote to memory of 3080	2588	ujuwuua.exe	explorer.exe
PID 2932 wrote to memory of 3256	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 3256	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 1016	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 1016	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 3836	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 3836	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 544	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 544	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 908	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 908	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 496	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 496	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 1156	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 1156	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 1292	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 1292	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 1516	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 1516	2932	444444.exe	reg.exe
PID 2932 wrote to memory of 1728	2932	444444.exe	ujuwuua.exe
PID 2932 wrote to memory of 1728	2932	444444.exe	ujuwuua.exe
PID 2932 wrote to memory of 1728	2932	444444.exe	ujuwuua.exe
PID 2932 wrote to memory of 64	2932	444444.exe	cmd.exe
PID 2932 wrote to memory of 64	2932	444444.exe	cmd.exe
PID 2932 wrote to memory of 2064	2932	444444.exe	schtasks.exe
PID 2932 wrote to memory of 2064	2932	444444.exe	schtasks.exe
PID 1728 wrote to memory of 2708	1728	ujuwuua.exe	ujuwuua.exe
PID 1728 wrote to memory of 2708	1728	ujuwuua.exe	ujuwuua.exe
PID 1728 wrote to memory of 2708	1728	ujuwuua.exe	ujuwuua.exe

Executes dropped EXE 4 IoCs

Processes:

ujuwuua.exeujuwuua.exeujuwuua.exeujuwuua.exe

pid process

2588 ujuwuua.exe
3500 ujuwuua.exe
1728 ujuwuua.exe
2708 ujuwuua.exe

pid	process
2588	ujuwuua.exe
3500	ujuwuua.exe
1728	ujuwuua.exe
2708	ujuwuua.exe

Turns off Windows Defender SpyNet reporting 6 IoCs

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SpyNetReporting = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SubmitSamplesConsent = "2"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2"	reg.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Software\Microsoft\Windows\CurrentVersion\Run\ypppot = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Aehqityril\\ujuwuua.exe\""	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3544 schtasks.exe

pid	process
3544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

444444.exe444444.exeujuwuua.exeujuwuua.exeexplorer.exe444444.exeujuwuua.exeujuwuua.exe

pid	process
4020	444444.exe
4020	444444.exe
3988	444444.exe
3988	444444.exe
3988	444444.exe
3988	444444.exe
2588	ujuwuua.exe
2588	ujuwuua.exe
3500	ujuwuua.exe
3500	ujuwuua.exe
3500	ujuwuua.exe
3500	ujuwuua.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
2932	444444.exe
2932	444444.exe
1728	ujuwuua.exe
1728	ujuwuua.exe
2708	ujuwuua.exe
2708	ujuwuua.exe
2708	ujuwuua.exe
2708	ujuwuua.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ujuwuua.exe

pid process

2588 ujuwuua.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2488 PING.EXE

pid	process
2588	ujuwuua.exe

pid	process
2488	PING.EXE

C:\Users\Admin\AppData\Local\Temp\444444.exe
"C:\Users\Admin\AppData\Local\Temp\444444.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:4020

C:\Users\Admin\AppData\Local\Temp\444444.exe
C:\Users\Admin\AppData\Local\Temp\444444.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3988

C:\Users\Admin\AppData\Roaming\Microsoft\Aehqityril\ujuwuua.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Aehqityril\ujuwuua.exe
2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2588

C:\Users\Admin\AppData\Roaming\Microsoft\Aehqityril\ujuwuua.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Aehqityril\ujuwuua.exe /C
3⤵
- Checks SCSI registry key(s)
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3500

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
PID:3080

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn iwzaihlrp /tr "\"C:\Users\Admin\AppData\Local\Temp\444444.exe\" /I iwzaihlrp" /SC ONCE /Z /ST 21:09 /ET 21:21
2⤵
- Creates scheduled task(s)
PID:3544

C:\Users\Admin\AppData\Local\Temp\444444.exe
C:\Users\Admin\AppData\Local\Temp\444444.exe /I iwzaihlrp
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:2932

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:3256

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:1016

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:3836

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:544

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:908

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:496

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:1156

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:1292

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Aehqityril" /d "0"
2⤵
- Windows security bypass
PID:1516

C:\Users\Admin\AppData\Roaming\Microsoft\Aehqityril\ujuwuua.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Aehqityril\ujuwuua.exe
2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1728

C:\Users\Admin\AppData\Roaming\Microsoft\Aehqityril\ujuwuua.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Aehqityril\ujuwuua.exe /C
3⤵
- Checks SCSI registry key(s)
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2708

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\444444.exe"
2⤵
PID:64

C:\Windows\system32\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:2488

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /DELETE /F /TN iwzaihlrp
2⤵
PID:2064

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Aehqityril\ujuwuua.dat

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Aehqityril\ujuwuua.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Aehqityril\ujuwuua.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Aehqityril\ujuwuua.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Aehqityril\ujuwuua.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Aehqityril\ujuwuua.exe

Download Submit
memory/2588-5-0x0000000000870000-0x00000000008AB000-memory.dmp

Filesize
236KB

Download
memory/2708-9-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/3500-4-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download
memory/3988-0-0x0000000002970000-0x0000000002971000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads