qakbot | 91647ac947d5d5d3a0dc69e98070bfc2f9841d7839b579d69c524b02869a497f | Triage

Resubmissions

16-10-2020 05:49

201016-1g17p444t6 10

15-10-2020 18:27

201015-k8r5q4zt2a 10

Sharing

General

Target

bemaji.exe
Size

135KB
Sample

201016-1g17p444t6
MD5

6cc41d1ccd61ccdb3857703f83959aca
SHA1

caf89ae09f7435dcef4e886b056d020ee34925cf
SHA256

91647ac947d5d5d3a0dc69e98070bfc2f9841d7839b579d69c524b02869a497f
SHA512

4adde26f8e13509a6ead86ebe23b7b45742e4dea5faf364b0559f0b5142b8faa2e8331e79528e60af1e290804e9ebbc29cba94833cede3e723b83b55fd7bcc8e

Score

10^/10

qakbot smokeloader systembc tr01 1602688146 backdoor banker persistence stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://sm15sdsd.xyz/

rc4.i32

rc4.i32

Extracted

Family

qakbot

Version

325.43

Botnet

tr01

Campaign

1602688146

C2

73.228.1.246:443

74.109.219.145:443

76.111.128.194:443

90.175.88.99:2222

108.191.28.158:443

68.225.60.77:443

75.136.40.155:443

5.193.181.221:2078

72.204.242.138:20

118.160.162.234:443

68.14.210.246:22

148.101.74.12:443

74.222.204.82:443

96.30.198.161:443

140.82.27.132:443

2.50.131.64:443

45.32.155.12:995

45.63.104.123:443

45.32.165.134:443

217.162.149.212:443

Targets

- Target
  
  bemaji.exe
- Size
  
  135KB
- MD5
  
  6cc41d1ccd61ccdb3857703f83959aca
- SHA1
  
  caf89ae09f7435dcef4e886b056d020ee34925cf
- SHA256
  
  91647ac947d5d5d3a0dc69e98070bfc2f9841d7839b579d69c524b02869a497f
- SHA512
  
  4adde26f8e13509a6ead86ebe23b7b45742e4dea5faf364b0559f0b5142b8faa2e8331e79528e60af1e290804e9ebbc29cba94833cede3e723b83b55fd7bcc8e
Score

10^/10

qakbot smokeloader systembc tr01 1602688146 backdoor banker persistence stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateProcessExOtherParentProcess
- SystemBC
  SystemBC is a proxy and remote administration tool first seen in 2019.
  trojan systembc
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbotsmokeloadersystembctr011602688146backdoorbankerpersistencestealertrojan

behavioral2

qakbotsmokeloadersystembctr011602688146backdoorbankerstealertrojan