qakbot | 5df0f7749580fcbf6251e0ae59b24c35a949c253c0f099f7f30bd2e66fcbf9b1

General

Target

file1.bin.exe
Size

1.2MB
MD5

ba6e8aa94975c85cbe78166aa8bb1ba9
SHA1

7d3d07c1ca51d3133aaf4bd2bc1287e19487bd87
SHA256

5df0f7749580fcbf6251e0ae59b24c35a949c253c0f099f7f30bd2e66fcbf9b1
SHA512

3757a04f43528ed6c7e79a54c354915fba39d377e64fcdc719039114c68cf7bda8c3bec171163e00d7d7747c56c7453ffe64c9c150fe21e8e09081bf428caa0b

Score

10^/10

evasion trojan banker stealer qakbot

Malware Config

Extracted

Family

qakbot

Botnet

spx135

Campaign

1591627649

C2

89.32.216.156:443

74.222.204.82:443

24.183.39.93:443

97.93.211.17:443

80.14.209.42:2222

96.35.170.82:2222

151.73.124.242:443

98.110.231.63:443

108.227.161.27:995

173.3.132.17:995

31.5.41.52:443

24.122.228.88:443

5.107.208.94:2222

76.185.136.58:443

50.29.166.232:995

73.210.114.187:443

92.114.107.193:995

24.43.22.220:993

50.247.230.33:995

72.142.106.198:465

Signatures

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet	reg.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

file1.bin.exerzeza.exefile1.bin.exerzeza.exe

description	pid	process	target process
PID 2804 wrote to memory of 1504	2804	file1.bin.exe	file1.bin.exe
PID 2804 wrote to memory of 1504	2804	file1.bin.exe	file1.bin.exe
PID 2804 wrote to memory of 1504	2804	file1.bin.exe	file1.bin.exe
PID 2804 wrote to memory of 2500	2804	file1.bin.exe	rzeza.exe
PID 2804 wrote to memory of 2500	2804	file1.bin.exe	rzeza.exe
PID 2804 wrote to memory of 2500	2804	file1.bin.exe	rzeza.exe
PID 2804 wrote to memory of 2744	2804	file1.bin.exe	schtasks.exe
PID 2804 wrote to memory of 2744	2804	file1.bin.exe	schtasks.exe
PID 2804 wrote to memory of 2744	2804	file1.bin.exe	schtasks.exe
PID 2500 wrote to memory of 3508	2500	rzeza.exe	rzeza.exe
PID 2500 wrote to memory of 3508	2500	rzeza.exe	rzeza.exe
PID 2500 wrote to memory of 3508	2500	rzeza.exe	rzeza.exe
PID 2500 wrote to memory of 3016	2500	rzeza.exe	explorer.exe
PID 2500 wrote to memory of 3016	2500	rzeza.exe	explorer.exe
PID 2500 wrote to memory of 3016	2500	rzeza.exe	explorer.exe
PID 2500 wrote to memory of 3016	2500	rzeza.exe	explorer.exe
PID 3864 wrote to memory of 3964	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 3964	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 3820	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 3820	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 1476	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 1476	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 3548	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 3548	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 2980	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 2980	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 3444	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 3444	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 2272	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 2272	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 632	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 632	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 3644	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 3644	3864	file1.bin.exe	reg.exe
PID 3864 wrote to memory of 3808	3864	file1.bin.exe	rzeza.exe
PID 3864 wrote to memory of 3808	3864	file1.bin.exe	rzeza.exe
PID 3864 wrote to memory of 3808	3864	file1.bin.exe	rzeza.exe
PID 3864 wrote to memory of 2908	3864	file1.bin.exe	cmd.exe
PID 3864 wrote to memory of 2908	3864	file1.bin.exe	cmd.exe
PID 3864 wrote to memory of 3160	3864	file1.bin.exe	schtasks.exe
PID 3864 wrote to memory of 3160	3864	file1.bin.exe	schtasks.exe
PID 3808 wrote to memory of 2616	3808	rzeza.exe	rzeza.exe
PID 3808 wrote to memory of 2616	3808	rzeza.exe	rzeza.exe
PID 3808 wrote to memory of 2616	3808	rzeza.exe	rzeza.exe

Turns off Windows Defender SpyNet reporting 6 IoCs

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SpyNetReporting = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SubmitSamplesConsent = "2"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2"	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1112 PING.EXE

pid	process
1112	PING.EXE

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

file1.bin.exerzeza.exerzeza.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	file1.bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	rzeza.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	rzeza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	rzeza.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	rzeza.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	rzeza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	rzeza.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	rzeza.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	rzeza.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	rzeza.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	file1.bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	file1.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	file1.bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	file1.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	file1.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	rzeza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	rzeza.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	rzeza.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

file1.bin.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	file1.bin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	file1.bin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	file1.bin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	file1.bin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	file1.bin.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2744 schtasks.exe
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

pid	process
2744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

file1.bin.exefile1.bin.exerzeza.exerzeza.exeexplorer.exefile1.bin.exerzeza.exerzeza.exe

pid	process
2804	file1.bin.exe
2804	file1.bin.exe
1504	file1.bin.exe
1504	file1.bin.exe
1504	file1.bin.exe
1504	file1.bin.exe
2500	rzeza.exe
2500	rzeza.exe
3508	rzeza.exe
3508	rzeza.exe
3508	rzeza.exe
3508	rzeza.exe
3016	explorer.exe
3016	explorer.exe
3016	explorer.exe
3016	explorer.exe
3864	file1.bin.exe
3864	file1.bin.exe
3808	rzeza.exe
3808	rzeza.exe
2616	rzeza.exe
2616	rzeza.exe
2616	rzeza.exe
2616	rzeza.exe

Executes dropped EXE 4 IoCs

Processes:

rzeza.exerzeza.exerzeza.exerzeza.exe

pid process

2500 rzeza.exe
3508 rzeza.exe
3808 rzeza.exe
2616 rzeza.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rzeza.exe

pid process

2500 rzeza.exe

pid	process
2500	rzeza.exe
3508	rzeza.exe
3808	rzeza.exe
2616	rzeza.exe

pid	process
2500	rzeza.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Mfqeeqxq = "0"	reg.exe

C:\Users\Admin\AppData\Local\Temp\file1.bin.exe
"C:\Users\Admin\AppData\Local\Temp\file1.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:2804

C:\Users\Admin\AppData\Local\Temp\file1.bin.exe
C:\Users\Admin\AppData\Local\Temp\file1.bin.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1504

C:\Users\Admin\AppData\Roaming\Microsoft\Mfqeeqxq\rzeza.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Mfqeeqxq\rzeza.exe
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:2500

C:\Users\Admin\AppData\Roaming\Microsoft\Mfqeeqxq\rzeza.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Mfqeeqxq\rzeza.exe /C
3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:3508

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3016

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mxerouwqc /tr "\"C:\Users\Admin\AppData\Local\Temp\file1.bin.exe\" /I mxerouwqc" /SC ONCE /Z /ST 00:09 /ET 00:21
2⤵
- Creates scheduled task(s)
PID:2744

C:\Users\Admin\AppData\Local\Temp\file1.bin.exe
C:\Users\Admin\AppData\Local\Temp\file1.bin.exe /I mxerouwqc
1⤵
- Suspicious use of WriteProcessMemory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3864

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:3964

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:3820

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:1476

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:3548

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:2980

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:3444

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:2272

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:632

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Mfqeeqxq" /d "0"
2⤵
- Windows security bypass
PID:3644

C:\Users\Admin\AppData\Roaming\Microsoft\Mfqeeqxq\rzeza.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Mfqeeqxq\rzeza.exe
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:3808

C:\Users\Admin\AppData\Roaming\Microsoft\Mfqeeqxq\rzeza.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Mfqeeqxq\rzeza.exe /C
3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:2616

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\file1.bin.exe"
2⤵
PID:2908

C:\Windows\system32\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:1112

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /DELETE /F /TN mxerouwqc
2⤵
PID:3160

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Mfqeeqxq\rzeza.dat

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Mfqeeqxq\rzeza.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Mfqeeqxq\rzeza.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Mfqeeqxq\rzeza.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Mfqeeqxq\rzeza.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Mfqeeqxq\rzeza.exe

Download Submit
memory/1504-0-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/2500-5-0x00000000020D0000-0x000000000210A000-memory.dmp

Filesize
232KB

Download
memory/2616-9-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download
memory/3508-4-0x0000000002880000-0x0000000002881000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads