qakbot | 8800b7fd8e3b6b8e98c14bda53fbdfa5acfe041874345dc9b732f546fcce21c3

General

Target

Permission_898654266_09172020.xls
Size

103KB
MD5

94b8d6427ecda9366383fa9a14c5cf68
SHA1

64524ea55eebe3465f3365888a17da2381566529
SHA256

8800b7fd8e3b6b8e98c14bda53fbdfa5acfe041874345dc9b732f546fcce21c3
SHA512

bb9a912d0162cc25c3ee1fc8037bfeda051599680db9da2d1d089804c9cb498c5f2928d0f5e63f4cfb7d3518ce3acc2545cc12b1b08a8149fbc1798d605a492e

Score

10^/10

trojan banker stealer qakbot

Malware Config

Extracted

Family

qakbot

Botnet

abc005

Campaign

1600415827

C2

50.244.112.10:995

207.237.1.152:443

184.97.148.2:443

207.255.161.8:993

69.167.206.238:50001

72.36.59.46:2222

173.26.189.151:443

2.50.59.177:443

217.162.149.212:443

199.247.22.145:443

203.106.195.67:443

109.154.214.224:2222

117.199.14.31:443

175.211.225.118:443

188.51.33.232:995

50.244.112.106:443

65.30.213.13:6882

24.37.178.158:443

47.28.131.209:443

207.255.161.8:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 5 IoCs

Processes:

ocean.exeocean.exevowxi.exevowxi.exeocean.exe

pid process

4028 ocean.exe
1064 ocean.exe
3376 vowxi.exe
1244 vowxi.exe
2672 ocean.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ocean.exevowxi.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	ocean.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	ocean.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	vowxi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	vowxi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	vowxi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	ocean.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	ocean.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	ocean.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	vowxi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	ocean.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	vowxi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	vowxi.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1504 schtasks.exe

pid	process
1504	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3876 EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

ocean.exeocean.exevowxi.exevowxi.exeexplorer.exe

pid	process
4028	ocean.exe
4028	ocean.exe
1064	ocean.exe
1064	ocean.exe
1064	ocean.exe
1064	ocean.exe
3376	vowxi.exe
3376	vowxi.exe
1244	vowxi.exe
1244	vowxi.exe
1244	vowxi.exe
1244	vowxi.exe
2164	explorer.exe
2164	explorer.exe
2164	explorer.exe
2164	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

vowxi.exe

pid process

3376 vowxi.exe

pid	process
3376	vowxi.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
3876	EXCEL.EXE
3876	EXCEL.EXE
3876	EXCEL.EXE
3876	EXCEL.EXE
3876	EXCEL.EXE
3876	EXCEL.EXE
3876	EXCEL.EXE
3876	EXCEL.EXE
3876	EXCEL.EXE
3876	EXCEL.EXE
3876	EXCEL.EXE
3876	EXCEL.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

EXCEL.EXEocean.exevowxi.exe

description	pid	process	target process
PID 3876 wrote to memory of 4028	3876	EXCEL.EXE	ocean.exe
PID 3876 wrote to memory of 4028	3876	EXCEL.EXE	ocean.exe
PID 3876 wrote to memory of 4028	3876	EXCEL.EXE	ocean.exe
PID 4028 wrote to memory of 1064	4028	ocean.exe	ocean.exe
PID 4028 wrote to memory of 1064	4028	ocean.exe	ocean.exe
PID 4028 wrote to memory of 1064	4028	ocean.exe	ocean.exe
PID 4028 wrote to memory of 3376	4028	ocean.exe	vowxi.exe
PID 4028 wrote to memory of 3376	4028	ocean.exe	vowxi.exe
PID 4028 wrote to memory of 3376	4028	ocean.exe	vowxi.exe
PID 4028 wrote to memory of 1504	4028	ocean.exe	schtasks.exe
PID 4028 wrote to memory of 1504	4028	ocean.exe	schtasks.exe
PID 4028 wrote to memory of 1504	4028	ocean.exe	schtasks.exe
PID 3376 wrote to memory of 1244	3376	vowxi.exe	vowxi.exe
PID 3376 wrote to memory of 1244	3376	vowxi.exe	vowxi.exe
PID 3376 wrote to memory of 1244	3376	vowxi.exe	vowxi.exe
PID 3376 wrote to memory of 2164	3376	vowxi.exe	explorer.exe
PID 3376 wrote to memory of 2164	3376	vowxi.exe	explorer.exe
PID 3376 wrote to memory of 2164	3376	vowxi.exe	explorer.exe
PID 3376 wrote to memory of 2164	3376	vowxi.exe	explorer.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Permission_898654266_09172020.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Fetil\Giola\ocean.exe
  "C:\Fetil\Giola\ocean.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Fetil\Giola\ocean.exe
    C:\Fetil\Giola\ocean.exe /C
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:1064
- - C:\Users\Admin\AppData\Roaming\Microsoft\Lcexbwwbror\vowxi.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Lcexbwwbror\vowxi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Lcexbwwbror\vowxi.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Lcexbwwbror\vowxi.exe /C
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      PID:1244
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2164
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vpkurizv /tr "\"C:\Fetil\Giola\ocean.exe\" /I vpkurizv" /SC ONCE /Z /ST 19:06 /ET 19:18
    3⤵
    - Creates scheduled task(s)
    PID:1504

C:\Fetil\Giola\ocean.exe
C:\Fetil\Giola\ocean.exe /I vpkurizv
1⤵
- Executes dropped EXE
PID:2672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Fetil\Giola\ocean.exe

Download Submit
C:\Fetil\Giola\ocean.exe

Download Submit
C:\Fetil\Giola\ocean.exe

Download Submit
C:\Fetil\Giola\ocean.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lcexbwwbror\vowxi.dat

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lcexbwwbror\vowxi.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lcexbwwbror\vowxi.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lcexbwwbror\vowxi.exe

Download Submit
memory/1064-6-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download
memory/1064-4-0x0000000000000000-mapping.dmp

Download
memory/1244-11-0x0000000000000000-mapping.dmp

Download
memory/1244-13-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/1504-10-0x0000000000000000-mapping.dmp

Download
memory/2164-15-0x0000000000000000-mapping.dmp

Download
memory/3376-7-0x0000000000000000-mapping.dmp

Download
memory/3376-14-0x00000000006A0000-0x00000000006D7000-memory.dmp

Filesize
220KB

Download
memory/3876-0-0x00007FFC63190000-0x00007FFC63856000-memory.dmp

Filesize
6.8MB

Download
memory/4028-1-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads