qakbot | 78749911faeac0032bb0c8562761fa6ee3fb85f37e099f5169d9dcc29c8024bd

Analysis

max time kernel
148s
max time network
113s
platform
windows10_x64
resource
win10
submitted
08/09/2020, 17:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
55555555.exe
Size 5.7MB
Sample200908-xf445kn846
SHA256 78749911faeac0032bb0c8562761fa6ee3fb85f37e099f5169d9dcc29c8024bd
MD5 627c6052598b7bc3932ae6a164fe2a0b
SHA1 1d23d5c6a1d0b0887a7aa138db9f09416d889cc7
SHA512 46fce2c0216e091ac36474085ea02411e8ad5f955b6d7fb3a1edf2e09f22c91e0c23808c15c7c28e8319c86c67662bff2656d7ec8978648be5b74b4c731a7797
MD5 SHA1 SHA512

Score

10^/10

trojan banker stealer qakbot

Malware Config

Extracted

Family

qakbot

Botnet

abc001

Campaign

1599561498

166.62.180.194:2078
99.240.226.2:443
95.77.144.238:443
85.122.141.42:995
31.53.49.169:2222
201.216.216.245:443
209.59.87.147:443
85.186.122.190:443
45.32.155.12:443
178.193.38.188:2222
89.137.211.72:443
66.215.32.224:443
199.247.22.145:443
71.84.5.114:995
216.201.162.158:443
47.146.32.175:443
75.81.25.223:443
178.222.21.87:995
24.234.86.201:995
68.33.206.204:443
69.11.247.242:443
184.180.157.203:2222
108.185.113.12:443
154.56.64.251:443
176.202.187.129:61201
185.246.9.69:995
207.255.161.8:993
173.70.165.101:995
2.7.65.32:2222
71.126.139.251:443
36.77.151.211:443
76.111.128.194:443
71.187.170.235:443
72.28.255.159:995
207.255.161.8:32100
5.13.76.177:443
74.75.237.11:443
86.98.49.75:2078
68.14.210.246:22
94.49.68.94:995
50.104.68.223:443
50.244.112.10:995
72.204.242.138:465
46.248.48.232:995
72.209.191.27:443
50.232.172.114:443
71.182.142.63:443
108.31.15.10:995
86.163.174.7:2222
68.174.15.223:443
96.18.240.158:443
108.46.145.30:443
81.103.144.77:443
203.198.96.200:443
207.246.75.201:443
45.77.193.83:443
77.27.174.49:995
67.209.195.198:443
134.0.196.46:995
118.168.233.83:443
98.173.34.212:995
50.29.166.232:995
207.255.161.8:995
86.97.146.204:2222
217.165.164.57:2222
103.76.160.110:443
50.244.112.106:443
77.159.149.74:443
86.98.89.78:2222
47.28.131.209:443
82.210.157.185:443
47.153.115.154:995
173.81.22.215:443
188.26.178.176:2222
213.120.109.73:2222
2.42.219.242:443
72.179.13.59:443
176.223.7.75:2222
24.37.178.158:443
95.179.247.224:443
45.32.154.10:443
199.247.16.80:443
207.255.161.8:443
207.255.161.8:2087
207.255.161.8:32103
96.227.127.13:443
192.40.225.168:443
117.218.208.239:443
189.231.196.236:443
39.36.29.105:995
105.102.107.86:443
47.146.169.85:443
65.30.213.13:6882
209.182.122.217:443
72.204.242.138:20
89.45.107.94:443
64.121.114.87:443
75.110.250.89:995
80.195.103.146:2222
78.96.199.79:443
47.44.217.98:443
75.136.40.155:443
46.53.5.10:443
50.247.230.33:995
41.228.56.159:443
68.190.152.98:443
72.90.243.117:0
72.66.47.70:443
80.240.26.178:443
203.106.195.67:443
72.132.249.144:995
86.97.162.2:443
211.24.72.253:443
141.158.47.123:443
41.97.162.27:443
41.36.51.183:995
47.180.66.10:443
190.85.91.154:443
2.91.73.118:995
72.186.1.237:443
175.211.225.118:443
173.245.152.231:443
75.87.161.32:995
73.232.165.200:995
217.162.149.212:443
207.255.161.8:465
173.22.125.129:2222
61.3.126.55:443
208.82.44.203:443
172.78.30.215:443
59.96.59.31:443
5.193.181.221:2078
104.221.4.11:2222
200.124.231.21:443
185.19.190.81:443
24.201.79.208:2078
98.121.187.78:443
2.50.59.219:443
59.26.204.144:443
81.133.234.36:2222
58.233.220.210:443
151.73.125.102:443
197.37.111.167:993
35.134.202.234:443
84.247.55.190:443
172.91.19.192:443
188.214.223.150:995
47.138.201.136:443
47.185.140.236:80
117.199.2.176:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Executes dropped EXE 2 IoCs

pid	Process
1476	cicpu.exe
1972	cicpu.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	55555555.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	cicpu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	cicpu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	cicpu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	55555555.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	55555555.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	55555555.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	cicpu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	cicpu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	55555555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	55555555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	cicpu.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1616	schtasks.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 5e601d3f0986d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2896	55555555.exe
2896	55555555.exe
1176	55555555.exe
1176	55555555.exe
1176	55555555.exe
1176	55555555.exe
1476	cicpu.exe
1476	cicpu.exe
1972	cicpu.exe
1972	cicpu.exe
1972	cicpu.exe
1972	cicpu.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1476	cicpu.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	640	svchost.exe
Token: SeCreatePagefilePrivilege	640	svchost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 1176	2896	55555555.exe	76
PID 2896 wrote to memory of 1176	2896	55555555.exe	76
PID 2896 wrote to memory of 1176	2896	55555555.exe	76
PID 2896 wrote to memory of 1476	2896	55555555.exe	77
PID 2896 wrote to memory of 1476	2896	55555555.exe	77
PID 2896 wrote to memory of 1476	2896	55555555.exe	77
PID 2896 wrote to memory of 1616	2896	55555555.exe	78
PID 2896 wrote to memory of 1616	2896	55555555.exe	78
PID 2896 wrote to memory of 1616	2896	55555555.exe	78
PID 1476 wrote to memory of 1972	1476	cicpu.exe	80
PID 1476 wrote to memory of 1972	1476	cicpu.exe	80
PID 1476 wrote to memory of 1972	1476	cicpu.exe	80
PID 1476 wrote to memory of 2136	1476	cicpu.exe	81
PID 1476 wrote to memory of 2136	1476	cicpu.exe	81
PID 1476 wrote to memory of 2136	1476	cicpu.exe	81
PID 1476 wrote to memory of 2136	1476	cicpu.exe	81

C:\Users\Admin\AppData\Local\Temp\55555555.exe
"C:\Users\Admin\AppData\Local\Temp\55555555.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\55555555.exe
  C:\Users\Admin\AppData\Local\Temp\55555555.exe /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1176
- C:\Users\Admin\AppData\Roaming\Microsoft\Guxcozirufts\cicpu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Guxcozirufts\cicpu.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Users\Admin\AppData\Roaming\Microsoft\Guxcozirufts\cicpu.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Guxcozirufts\cicpu.exe /C
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:1972
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2136
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ehvlijff /tr "\"C:\Users\Admin\AppData\Local\Temp\55555555.exe\" /I ehvlijff" /SC ONCE /Z /ST 17:58 /ET 18:10
  2⤵
  - Creates scheduled task(s)
  PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:640

C:\Users\Admin\AppData\Local\Temp\55555555.exe
C:\Users\Admin\AppData\Local\Temp\55555555.exe /I ehvlijff
1⤵
PID:2536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-1-0x0000000002D10000-0x0000000002D11000-memory.dmp

Download

memory/1476-9-0x00000000026E0000-0x0000000002717000-memory.dmp

Download

memory/1972-8-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Download