qakbot | 5df0f7749580fcbf6251e0ae59b24c35a949c253c0f099f7f30bd2e66fcbf9b1

General

Target

file1.bin.exe
Size

1.2MB
MD5

ba6e8aa94975c85cbe78166aa8bb1ba9
SHA1

7d3d07c1ca51d3133aaf4bd2bc1287e19487bd87
SHA256

5df0f7749580fcbf6251e0ae59b24c35a949c253c0f099f7f30bd2e66fcbf9b1
SHA512

3757a04f43528ed6c7e79a54c354915fba39d377e64fcdc719039114c68cf7bda8c3bec171163e00d7d7747c56c7453ffe64c9c150fe21e8e09081bf428caa0b

Score

10^/10

trojan banker stealer qakbot evasion

Malware Config

Extracted

Family

qakbot

Botnet

spx135

Campaign

1591627649

C2

89.32.216.156:443

74.222.204.82:443

24.183.39.93:443

97.93.211.17:443

80.14.209.42:2222

96.35.170.82:2222

151.73.124.242:443

98.110.231.63:443

108.227.161.27:995

173.3.132.17:995

31.5.41.52:443

24.122.228.88:443

5.107.208.94:2222

76.185.136.58:443

50.29.166.232:995

73.210.114.187:443

92.114.107.193:995

24.43.22.220:993

50.247.230.33:995

72.142.106.198:465

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1856 PING.EXE
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1844 schtasks.exe

pid	process
1856	PING.EXE

pid	process
1844	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

file1.bin.exefile1.bin.exeoamupn.exeoamupn.exeexplorer.exefile1.bin.exeoamupn.exeoamupn.exe

pid	process
1520	file1.bin.exe
480	file1.bin.exe
480	file1.bin.exe
1824	oamupn.exe
1884	oamupn.exe
1884	oamupn.exe
1784	explorer.exe
1784	explorer.exe
1340	file1.bin.exe
2004	oamupn.exe
1500	oamupn.exe
1500	oamupn.exe

Suspicious use of WriteProcessMemory 77 IoCs

Processes:

file1.bin.exeoamupn.exetaskeng.exefile1.bin.exe

description	pid	process	target process
PID 1520 wrote to memory of 480	1520	file1.bin.exe	file1.bin.exe
PID 1520 wrote to memory of 480	1520	file1.bin.exe	file1.bin.exe
PID 1520 wrote to memory of 480	1520	file1.bin.exe	file1.bin.exe
PID 1520 wrote to memory of 480	1520	file1.bin.exe	file1.bin.exe
PID 1520 wrote to memory of 1824	1520	file1.bin.exe	oamupn.exe
PID 1520 wrote to memory of 1824	1520	file1.bin.exe	oamupn.exe
PID 1520 wrote to memory of 1824	1520	file1.bin.exe	oamupn.exe
PID 1520 wrote to memory of 1824	1520	file1.bin.exe	oamupn.exe
PID 1520 wrote to memory of 1844	1520	file1.bin.exe	schtasks.exe
PID 1520 wrote to memory of 1844	1520	file1.bin.exe	schtasks.exe
PID 1520 wrote to memory of 1844	1520	file1.bin.exe	schtasks.exe
PID 1520 wrote to memory of 1844	1520	file1.bin.exe	schtasks.exe
PID 1824 wrote to memory of 1884	1824	oamupn.exe	oamupn.exe
PID 1824 wrote to memory of 1884	1824	oamupn.exe	oamupn.exe
PID 1824 wrote to memory of 1884	1824	oamupn.exe	oamupn.exe
PID 1824 wrote to memory of 1884	1824	oamupn.exe	oamupn.exe
PID 1824 wrote to memory of 1784	1824	oamupn.exe	explorer.exe
PID 1824 wrote to memory of 1784	1824	oamupn.exe	explorer.exe
PID 1824 wrote to memory of 1784	1824	oamupn.exe	explorer.exe
PID 1824 wrote to memory of 1784	1824	oamupn.exe	explorer.exe
PID 1824 wrote to memory of 1784	1824	oamupn.exe	explorer.exe
PID 1144 wrote to memory of 1340	1144	taskeng.exe	file1.bin.exe
PID 1144 wrote to memory of 1340	1144	taskeng.exe	file1.bin.exe
PID 1144 wrote to memory of 1340	1144	taskeng.exe	file1.bin.exe
PID 1144 wrote to memory of 1340	1144	taskeng.exe	file1.bin.exe
PID 1340 wrote to memory of 300	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 300	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 300	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 300	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1640	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1640	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1640	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1640	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1604	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1604	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1604	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1604	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1636	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1636	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1636	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1636	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1592	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1592	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1592	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1592	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1556	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1556	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1556	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1556	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1924	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1924	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1924	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1924	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1928	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1928	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1928	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1928	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1016	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1016	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1016	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 1016	1340	file1.bin.exe	reg.exe
PID 1340 wrote to memory of 2004	1340	file1.bin.exe	oamupn.exe
PID 1340 wrote to memory of 2004	1340	file1.bin.exe	oamupn.exe
PID 1340 wrote to memory of 2004	1340	file1.bin.exe	oamupn.exe

Loads dropped DLL 3 IoCs

Processes:

file1.bin.exefile1.bin.exe

pid process

1520 file1.bin.exe
1520 file1.bin.exe
1340 file1.bin.exe
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Turns off Windows Defender SpyNet reporting 6 IoCs

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReporting = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet\SubmitSamplesConsent = "2"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SpyNetReporting = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SubmitSamplesConsent = "2"	reg.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

file1.bin.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	file1.bin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	file1.bin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	file1.bin.exe

Executes dropped EXE 4 IoCs

Processes:

oamupn.exeoamupn.exeoamupn.exeoamupn.exe

pid process

1824 oamupn.exe
1884 oamupn.exe
2004 oamupn.exe
1500 oamupn.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

oamupn.exe

pid process

1824 oamupn.exe

pid	process
1824	oamupn.exe
1884	oamupn.exe
2004	oamupn.exe
1500	oamupn.exe

pid	process
1824	oamupn.exe

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet	reg.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt = "0"	reg.exe

C:\Users\Admin\AppData\Local\Temp\file1.bin.exe
"C:\Users\Admin\AppData\Local\Temp\file1.bin.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1520

C:\Users\Admin\AppData\Local\Temp\file1.bin.exe
C:\Users\Admin\AppData\Local\Temp\file1.bin.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:480

C:\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt\oamupn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt\oamupn.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:1824

C:\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt\oamupn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt\oamupn.exe /C
3⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:1884

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1784

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn nnsbgtr /tr "\"C:\Users\Admin\AppData\Local\Temp\file1.bin.exe\" /I nnsbgtr" /SC ONCE /Z /ST 00:09 /ET 00:21
2⤵
- Creates scheduled task(s)
PID:1844

C:\Windows\system32\taskeng.exe
taskeng.exe {D5252335-9845-4F52-B253-B990452F254E} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1144

C:\Users\Admin\AppData\Local\Temp\file1.bin.exe
C:\Users\Admin\AppData\Local\Temp\file1.bin.exe /I nnsbgtr
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:1340

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
3⤵
- Turns off Windows Defender SpyNet reporting
- Windows security modification
PID:300

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
3⤵
- Turns off Windows Defender SpyNet reporting
- Windows security modification
PID:1640

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
3⤵
PID:1604

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
3⤵
PID:1636

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
3⤵
- Turns off Windows Defender SpyNet reporting
- Windows security modification
PID:1592

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
3⤵
- Turns off Windows Defender SpyNet reporting
- Windows security modification
PID:1556

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
3⤵
- Turns off Windows Defender SpyNet reporting
- Windows security modification
PID:1924

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
3⤵
- Turns off Windows Defender SpyNet reporting
- Windows security modification
PID:1928

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt" /d "0"
3⤵
- Windows security bypass
PID:1016

C:\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt\oamupn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt\oamupn.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:2004

C:\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt\oamupn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt\oamupn.exe /C
4⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:1500

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\file1.bin.exe"
3⤵
PID:1244

C:\Windows\system32\PING.EXE
ping.exe -n 6 127.0.0.1
4⤵
- Runs ping.exe
PID:1856

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /DELETE /F /TN nnsbgtr
3⤵
PID:1440

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt\oamupn.dat

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt\oamupn.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt\oamupn.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt\oamupn.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt\oamupn.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt\oamupn.exe

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt\oamupn.exe

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt\oamupn.exe

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Pxugzybt\oamupn.exe

Download Submit
memory/480-0-0x0000000002470000-0x0000000002481000-memory.dmp

Filesize
68KB

Download
memory/1500-12-0x0000000002470000-0x0000000002481000-memory.dmp

Filesize
68KB

Download
memory/1824-7-0x00000000003A0000-0x00000000003DA000-memory.dmp

Filesize
232KB

Download
memory/1884-6-0x0000000002540000-0x0000000002551000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads