qakbot | faf8184aa2a041106b6db4e567716ef5327df36371e5044b1c3818c1ac4d0466

General

Target

file1.exe
Size

1.1MB
MD5

0c5d9a27daa00d234af1a30882aacc50
SHA1

ac369d06c81af9d663e135a04dc94e582a0604fb
SHA256

faf8184aa2a041106b6db4e567716ef5327df36371e5044b1c3818c1ac4d0466
SHA512

4f16b17d05359863da6e8128215d68532f81350b339167469174993064451fc1f7b2fbe9af0d58c43e04611ac7912369f8af9f59092305b4ca7390a93066a7d9

Score

10^/10

trojan banker stealer qakbot evasion

Malware Config

Extracted

Family

qakbot

Botnet

spx135

Campaign

1591627649

C2

89.32.216.156:443

74.222.204.82:443

24.183.39.93:443

97.93.211.17:443

80.14.209.42:2222

96.35.170.82:2222

151.73.124.242:443

98.110.231.63:443

108.227.161.27:995

173.3.132.17:995

31.5.41.52:443

24.122.228.88:443

5.107.208.94:2222

76.185.136.58:443

50.29.166.232:995

73.210.114.187:443

92.114.107.193:995

24.43.22.220:993

50.247.230.33:995

72.142.106.198:465

Signatures

Modifies data under HKEY_USERS 5 IoCs

Processes:

file1.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	file1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	file1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	file1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	file1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	file1.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

file1.exeyoteyuvi.exefile1.exeyoteyuvi.exe

description	pid	process	target process
PID 2904 wrote to memory of 1792	2904	file1.exe	file1.exe
PID 2904 wrote to memory of 1792	2904	file1.exe	file1.exe
PID 2904 wrote to memory of 1792	2904	file1.exe	file1.exe
PID 2904 wrote to memory of 2804	2904	file1.exe	yoteyuvi.exe
PID 2904 wrote to memory of 2804	2904	file1.exe	yoteyuvi.exe
PID 2904 wrote to memory of 2804	2904	file1.exe	yoteyuvi.exe
PID 2904 wrote to memory of 3816	2904	file1.exe	schtasks.exe
PID 2904 wrote to memory of 3816	2904	file1.exe	schtasks.exe
PID 2904 wrote to memory of 3816	2904	file1.exe	schtasks.exe
PID 2804 wrote to memory of 3164	2804	yoteyuvi.exe	yoteyuvi.exe
PID 2804 wrote to memory of 3164	2804	yoteyuvi.exe	yoteyuvi.exe
PID 2804 wrote to memory of 3164	2804	yoteyuvi.exe	yoteyuvi.exe
PID 2804 wrote to memory of 3944	2804	yoteyuvi.exe	explorer.exe
PID 2804 wrote to memory of 3944	2804	yoteyuvi.exe	explorer.exe
PID 2804 wrote to memory of 3944	2804	yoteyuvi.exe	explorer.exe
PID 2804 wrote to memory of 3944	2804	yoteyuvi.exe	explorer.exe
PID 3432 wrote to memory of 2400	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 2400	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 64	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 64	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 3044	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 3044	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 3616	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 3616	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 3492	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 3492	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 800	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 800	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 3860	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 3860	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 548	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 548	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 1256	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 1256	3432	file1.exe	reg.exe
PID 3432 wrote to memory of 2196	3432	file1.exe	yoteyuvi.exe
PID 3432 wrote to memory of 2196	3432	file1.exe	yoteyuvi.exe
PID 3432 wrote to memory of 2196	3432	file1.exe	yoteyuvi.exe
PID 3432 wrote to memory of 1280	3432	file1.exe	cmd.exe
PID 3432 wrote to memory of 1280	3432	file1.exe	cmd.exe
PID 3432 wrote to memory of 1096	3432	file1.exe	schtasks.exe
PID 3432 wrote to memory of 1096	3432	file1.exe	schtasks.exe
PID 2196 wrote to memory of 3516	2196	yoteyuvi.exe	yoteyuvi.exe
PID 2196 wrote to memory of 3516	2196	yoteyuvi.exe	yoteyuvi.exe
PID 2196 wrote to memory of 3516	2196	yoteyuvi.exe	yoteyuvi.exe

Executes dropped EXE 4 IoCs

Processes:

yoteyuvi.exeyoteyuvi.exeyoteyuvi.exeyoteyuvi.exe

pid process

2804 yoteyuvi.exe
3164 yoteyuvi.exe
2196 yoteyuvi.exe
3516 yoteyuvi.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3560 PING.EXE

pid	process
2804	yoteyuvi.exe
3164	yoteyuvi.exe
2196	yoteyuvi.exe
3516	yoteyuvi.exe

pid	process
3560	PING.EXE

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

file1.exeyoteyuvi.exeyoteyuvi.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	file1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	yoteyuvi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	file1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	file1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	yoteyuvi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	yoteyuvi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	yoteyuvi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	yoteyuvi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	file1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	yoteyuvi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	yoteyuvi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	yoteyuvi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	file1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	file1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	yoteyuvi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	yoteyuvi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	yoteyuvi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	yoteyuvi.exe

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	reg.exe

Turns off Windows Defender SpyNet reporting 6 IoCs

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SpyNetReporting = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SubmitSamplesConsent = "2"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	reg.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

file1.exefile1.exeyoteyuvi.exeyoteyuvi.exeexplorer.exefile1.exeyoteyuvi.exeyoteyuvi.exe

pid	process
2904	file1.exe
2904	file1.exe
1792	file1.exe
1792	file1.exe
1792	file1.exe
1792	file1.exe
2804	yoteyuvi.exe
2804	yoteyuvi.exe
3164	yoteyuvi.exe
3164	yoteyuvi.exe
3164	yoteyuvi.exe
3164	yoteyuvi.exe
3944	explorer.exe
3944	explorer.exe
3944	explorer.exe
3944	explorer.exe
3432	file1.exe
3432	file1.exe
2196	yoteyuvi.exe
2196	yoteyuvi.exe
3516	yoteyuvi.exe
3516	yoteyuvi.exe
3516	yoteyuvi.exe
3516	yoteyuvi.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

yoteyuvi.exe

pid process

2804 yoteyuvi.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3816 schtasks.exe

pid	process
2804	yoteyuvi.exe

pid	process
3816	schtasks.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Nrkqut = "0"	reg.exe

C:\Users\Admin\AppData\Local\Temp\file1.exe
"C:\Users\Admin\AppData\Local\Temp\file1.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:2904

C:\Users\Admin\AppData\Local\Temp\file1.exe
C:\Users\Admin\AppData\Local\Temp\file1.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1792

C:\Users\Admin\AppData\Roaming\Microsoft\Nrkqut\yoteyuvi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Nrkqut\yoteyuvi.exe
2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2804

C:\Users\Admin\AppData\Roaming\Microsoft\Nrkqut\yoteyuvi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Nrkqut\yoteyuvi.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3164

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qpbhwzpny /tr "\"C:\Users\Admin\AppData\Local\Temp\file1.exe\" /I qpbhwzpny" /SC ONCE /Z /ST 21:20 /ET 21:32
2⤵
- Creates scheduled task(s)
PID:3816

C:\Users\Admin\AppData\Local\Temp\file1.exe
C:\Users\Admin\AppData\Local\Temp\file1.exe /I qpbhwzpny
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:3432

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:2400

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:64

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:3044

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:3616

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:3492

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:800

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:3860

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:548

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Nrkqut" /d "0"
2⤵
- Windows security bypass
PID:1256

C:\Users\Admin\AppData\Roaming\Microsoft\Nrkqut\yoteyuvi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Nrkqut\yoteyuvi.exe
2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2196

C:\Users\Admin\AppData\Roaming\Microsoft\Nrkqut\yoteyuvi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Nrkqut\yoteyuvi.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3516

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\file1.exe"
2⤵
PID:1280

C:\Windows\system32\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:3560

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /DELETE /F /TN qpbhwzpny
2⤵
PID:1096

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Nrkqut\yoteyuvi.dat

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Nrkqut\yoteyuvi.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Nrkqut\yoteyuvi.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Nrkqut\yoteyuvi.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Nrkqut\yoteyuvi.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Nrkqut\yoteyuvi.exe

Download Submit
memory/1792-0-0x00000000028E0000-0x00000000028E1000-memory.dmp

Filesize
4KB

Download
memory/2804-5-0x00000000021D0000-0x000000000220A000-memory.dmp

Filesize
232KB

Download
memory/3164-4-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/3516-9-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads