qakbot | f3e3d35760f655af5a57029b73c2cc2f42d09de1a694b2eb22366a3e6c49a068

Analysis

max time kernel
147s
max time network
113s
platform
windows10_x64
resource
win10v200722
submitted
17/09/2020, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
555555555555.png.exe
Size 1.0MB
Sample200917-cssz9xhj6e
SHA256 f3e3d35760f655af5a57029b73c2cc2f42d09de1a694b2eb22366a3e6c49a068
MD5 4f3f4287b1e41dd40ee6d3271c60949f
SHA1 72a8490fb212d23e9cfde5bda851dcb1d7c1d895
SHA512 5610668cf8c495b27b60bef35414c009c220ae6373b70617dd06ae4ec35f291d0a02170ad8f35996ed327e6f06aa5d4dc824fac3f8a462e2867eb742cd799df4
MD5 SHA1 SHA512

Score

10^/10

trojan banker stealer qakbot

Malware Config

Extracted

Family

qakbot

Botnet

abc004

Campaign

1600240826

96.227.127.13:443
98.22.65.76:443
67.165.206.193:993
50.244.112.10:995
72.204.242.138:465
72.36.59.46:2222
68.174.15.223:443
69.11.247.242:443
75.81.25.223:443
95.77.223.148:443
47.146.32.175:443
50.232.172.114:443
24.231.54.185:2222
184.180.157.203:2222
190.31.192.182:443
84.47.220.117:995
96.18.240.158:443
117.199.14.80:443
184.97.148.2:443
207.255.161.8:993
69.167.206.238:50001
173.26.189.151:443
2.90.44.121:995
78.96.199.79:443
156.213.179.139:443
84.232.238.30:443
213.31.203.48:2222
36.77.151.211:443
71.187.170.235:443
24.218.181.15:443
199.247.22.145:443
207.255.161.8:32100
207.255.161.8:2078
96.41.93.96:443
188.51.33.232:995
50.244.112.106:443
24.37.178.158:443
47.28.131.209:443
141.158.47.123:443
72.204.242.138:990
41.228.203.53:443
72.179.13.59:443
186.94.5.67:2078
175.211.225.118:443
178.222.113.168:995
50.104.68.223:443
98.16.204.189:995
189.231.196.236:443
67.209.195.198:443
80.14.209.42:2222
84.117.176.32:443
207.255.161.8:995
2.7.65.32:2222
120.150.60.189:995
73.228.1.246:443
209.137.209.163:995
185.246.9.69:995
45.32.154.10:443
24.205.42.241:443
199.247.16.80:443
207.246.75.201:443
45.77.193.83:443
72.190.101.70:443
80.195.103.146:2222
188.24.196.245:995
2.91.109.154:995
188.247.252.243:443
203.198.96.200:443
67.170.137.8:443
47.138.201.136:443
144.139.47.206:443
31.5.21.66:443
96.30.198.161:443
95.179.247.224:443
117.218.208.239:443
92.59.35.196:2222
24.210.45.215:443
98.26.50.62:995
72.204.242.138:20
207.255.161.8:443
207.255.161.8:2087
207.255.161.8:32103
72.204.242.138:53
5.12.0.239:443
74.75.216.202:443
173.22.125.129:2222
86.98.89.62:2222
39.36.105.140:995
65.131.34.101:995
84.78.128.76:2222
2.90.109.29:995
24.53.49.240:2222
51.223.158.125:443
217.165.164.132:2222
72.209.191.27:443
189.183.73.227:995
47.44.217.98:443
84.247.55.190:443
71.221.92.98:443
103.76.160.110:443
47.146.169.85:443
80.240.26.178:443
67.60.113.253:2222
75.87.161.32:995
66.222.88.126:995
24.201.79.208:2078
24.234.86.201:995
47.147.11.28:443
65.30.213.13:6882
95.76.109.181:443
24.40.173.134:443
75.136.40.155:443
134.0.196.46:995
5.12.194.114:2222
2.50.59.219:443
172.78.30.215:443
190.85.91.154:443
5.193.181.221:2078
75.182.214.87:443
73.200.219.143:443
63.155.74.135:995
68.13.99.24:443
173.81.22.215:443
98.121.187.78:443
187.206.64.235:995
83.110.6.64:2222
103.206.112.234:443
216.201.162.158:443
37.210.186.213:61201
69.123.179.70:443
71.126.139.251:443
71.84.5.114:995
59.26.204.144:443
108.178.66.82:995
134.228.24.29:443
76.170.77.99:995
184.98.103.204:995
166.62.180.194:2078
108.185.113.12:443
216.163.4.136:443
66.215.32.224:443
71.220.200.82:2222
35.134.202.234:443
117.215.198.3:443
72.204.242.138:32102
77.159.149.74:443
207.255.161.8:465
200.75.136.78:443
45.46.53.140:2222
202.141.244.118:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Executes dropped EXE 2 IoCs

pid	Process
4000	yeotea.exe
2892	yeotea.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	yeotea.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	yeotea.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	yeotea.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	555555555555.png.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	555555555555.png.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	555555555555.png.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	yeotea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	yeotea.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	yeotea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	555555555555.png.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	555555555555.png.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	555555555555.png.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
584	555555555555.png.exe
584	555555555555.png.exe
3172	555555555555.png.exe
3172	555555555555.png.exe
3172	555555555555.png.exe
3172	555555555555.png.exe
4000	yeotea.exe
4000	yeotea.exe
2892	yeotea.exe
2892	yeotea.exe
2892	yeotea.exe
2892	yeotea.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4000	yeotea.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 584 wrote to memory of 3172	584	555555555555.png.exe	76
PID 584 wrote to memory of 3172	584	555555555555.png.exe	76
PID 584 wrote to memory of 3172	584	555555555555.png.exe	76
PID 584 wrote to memory of 4000	584	555555555555.png.exe	77
PID 584 wrote to memory of 4000	584	555555555555.png.exe	77
PID 584 wrote to memory of 4000	584	555555555555.png.exe	77
PID 584 wrote to memory of 3100	584	555555555555.png.exe	78
PID 584 wrote to memory of 3100	584	555555555555.png.exe	78
PID 584 wrote to memory of 3100	584	555555555555.png.exe	78
PID 4000 wrote to memory of 2892	4000	yeotea.exe	80
PID 4000 wrote to memory of 2892	4000	yeotea.exe	80
PID 4000 wrote to memory of 2892	4000	yeotea.exe	80
PID 4000 wrote to memory of 2676	4000	yeotea.exe	81
PID 4000 wrote to memory of 2676	4000	yeotea.exe	81
PID 4000 wrote to memory of 2676	4000	yeotea.exe	81
PID 4000 wrote to memory of 2676	4000	yeotea.exe	81

C:\Users\Admin\AppData\Local\Temp\555555555555.png.exe
"C:\Users\Admin\AppData\Local\Temp\555555555555.png.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:584
- C:\Users\Admin\AppData\Local\Temp\555555555555.png.exe
  C:\Users\Admin\AppData\Local\Temp\555555555555.png.exe /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:3172
- C:\Users\Admin\AppData\Roaming\Microsoft\Mviwifbdy\yeotea.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Mviwifbdy\yeotea.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Users\Admin\AppData\Roaming\Microsoft\Mviwifbdy\yeotea.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Mviwifbdy\yeotea.exe /C
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:2892
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2676
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hbeqrpwfyj /tr "\"C:\Users\Admin\AppData\Local\Temp\555555555555.png.exe\" /I hbeqrpwfyj" /SC ONCE /Z /ST 10:29 /ET 10:41
  2⤵
  - Creates scheduled task(s)
  PID:3100

C:\Users\Admin\AppData\Local\Temp\555555555555.png.exe
C:\Users\Admin\AppData\Local\Temp\555555555555.png.exe /I hbeqrpwfyj
1⤵
PID:184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2892-8-0x0000000002850000-0x0000000002851000-memory.dmp

Download

memory/3172-1-0x0000000002990000-0x0000000002991000-memory.dmp

Download

memory/4000-9-0x0000000002610000-0x0000000002647000-memory.dmp

Download