qakbot | 4df5cd5441ddcc5ded6bf4d096d45606baaa4e613786ae999200887e8b12f9bb

General

Target

test.bin.exe
Size

275KB
MD5

d3bb30bfb5961a4d53bb322d22a9b9f0
SHA1

52ea2d102ef7b7432b4c6d4924e5a856cb32682f
SHA256

4df5cd5441ddcc5ded6bf4d096d45606baaa4e613786ae999200887e8b12f9bb
SHA512

7629fd7d726144b883ab60eddeeca851b2030332606ae5238f342351051ca7de6b9b0d831546176650d60017964a77ecc8f13cf09025c44172cdfca332a64fe2

Score

10^/10

qakbot notset 1596817234 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1596817234

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
[email protected]
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
[email protected]
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
[email protected]
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
[email protected]
Password:
eQyicNLzzqPN

C2

47.44.217.98:443

86.97.146.204:2222

65.60.228.130:443

216.201.162.158:443

94.59.24.79:995

108.46.145.30:443

24.139.132.70:443

47.206.174.82:443

188.52.106.206:20

72.204.242.138:6881

173.173.72.199:443

71.163.224.206:443

63.155.9.141:995

100.34.195.237:443

47.39.177.171:2222

96.20.108.17:2222

115.21.224.117:443

70.164.39.91:443

45.47.65.191:443

207.155.107.111:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

haeah.exehaeah.exe

pid process

740 haeah.exe
3128 haeah.exe

pid	process
740	haeah.exe
3128	haeah.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

haeah.exetest.bin.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	haeah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	haeah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	test.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	test.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	test.bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	haeah.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	haeah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	test.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	test.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	test.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	haeah.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	haeah.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3372 schtasks.exe

pid	process
3372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

test.bin.exetest.bin.exehaeah.exehaeah.exeexplorer.exetest.bin.exe

pid	process
3976	test.bin.exe
3976	test.bin.exe
1608	test.bin.exe
1608	test.bin.exe
1608	test.bin.exe
1608	test.bin.exe
740	haeah.exe
740	haeah.exe
3128	haeah.exe
3128	haeah.exe
3128	haeah.exe
3128	haeah.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3472	test.bin.exe
3472	test.bin.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

haeah.exe

pid process

740 haeah.exe

pid	process
740	haeah.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

test.bin.exehaeah.exe

description	pid	process	target process
PID 3976 wrote to memory of 1608	3976	test.bin.exe	test.bin.exe
PID 3976 wrote to memory of 1608	3976	test.bin.exe	test.bin.exe
PID 3976 wrote to memory of 1608	3976	test.bin.exe	test.bin.exe
PID 3976 wrote to memory of 740	3976	test.bin.exe	haeah.exe
PID 3976 wrote to memory of 740	3976	test.bin.exe	haeah.exe
PID 3976 wrote to memory of 740	3976	test.bin.exe	haeah.exe
PID 3976 wrote to memory of 3372	3976	test.bin.exe	schtasks.exe
PID 3976 wrote to memory of 3372	3976	test.bin.exe	schtasks.exe
PID 3976 wrote to memory of 3372	3976	test.bin.exe	schtasks.exe
PID 740 wrote to memory of 3128	740	haeah.exe	haeah.exe
PID 740 wrote to memory of 3128	740	haeah.exe	haeah.exe
PID 740 wrote to memory of 3128	740	haeah.exe	haeah.exe
PID 740 wrote to memory of 3308	740	haeah.exe	explorer.exe
PID 740 wrote to memory of 3308	740	haeah.exe	explorer.exe
PID 740 wrote to memory of 3308	740	haeah.exe	explorer.exe
PID 740 wrote to memory of 3308	740	haeah.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\test.bin.exe
"C:\Users\Admin\AppData\Local\Temp\test.bin.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3976

C:\Users\Admin\AppData\Local\Temp\test.bin.exe
C:\Users\Admin\AppData\Local\Temp\test.bin.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1608

C:\Users\Admin\AppData\Roaming\Microsoft\Rszivysefoz\haeah.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Rszivysefoz\haeah.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:740

C:\Users\Admin\AppData\Roaming\Microsoft\Rszivysefoz\haeah.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Rszivysefoz\haeah.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3128

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3308

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zgyfxhg /tr "\"C:\Users\Admin\AppData\Local\Temp\test.bin.exe\" /I zgyfxhg" /SC ONCE /Z /ST 12:56 /ET 13:08
2⤵
- Creates scheduled task(s)
PID:3372

C:\Users\Admin\AppData\Local\Temp\test.bin.exe
C:\Users\Admin\AppData\Local\Temp\test.bin.exe /I zgyfxhg
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3472

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Rszivysefoz\haeah.dat
MD5
94d47ff5ffb065832733940ebbc00e5d

SHA1
99d7d5f961b075646af34b0854c28100e785b752

SHA256
cd76d7532ffc647ff66c7be2b3a4e7ddca031e3696966c57a2c5aa55d4c0b2ae

SHA512
0831505b5f8ca883b945b635ca7e77bd75185b5a2cbc07c1243b716b77e35a4510ae02470a854de7e647a558b7d1548d34c7d8b0bf4b065f112e2a579f952980

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Rszivysefoz\haeah.exe
MD5
d3bb30bfb5961a4d53bb322d22a9b9f0

SHA1
52ea2d102ef7b7432b4c6d4924e5a856cb32682f

SHA256
4df5cd5441ddcc5ded6bf4d096d45606baaa4e613786ae999200887e8b12f9bb

SHA512
7629fd7d726144b883ab60eddeeca851b2030332606ae5238f342351051ca7de6b9b0d831546176650d60017964a77ecc8f13cf09025c44172cdfca332a64fe2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Rszivysefoz\haeah.exe
MD5
d3bb30bfb5961a4d53bb322d22a9b9f0

SHA1
52ea2d102ef7b7432b4c6d4924e5a856cb32682f

SHA256
4df5cd5441ddcc5ded6bf4d096d45606baaa4e613786ae999200887e8b12f9bb

SHA512
7629fd7d726144b883ab60eddeeca851b2030332606ae5238f342351051ca7de6b9b0d831546176650d60017964a77ecc8f13cf09025c44172cdfca332a64fe2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Rszivysefoz\haeah.exe
MD5
d3bb30bfb5961a4d53bb322d22a9b9f0

SHA1
52ea2d102ef7b7432b4c6d4924e5a856cb32682f

SHA256
4df5cd5441ddcc5ded6bf4d096d45606baaa4e613786ae999200887e8b12f9bb

SHA512
7629fd7d726144b883ab60eddeeca851b2030332606ae5238f342351051ca7de6b9b0d831546176650d60017964a77ecc8f13cf09025c44172cdfca332a64fe2

Download Submit
memory/740-2-0x0000000000000000-mapping.dmp

Download
memory/740-9-0x0000000002220000-0x0000000002267000-memory.dmp

Filesize
284KB

Download
memory/1608-0-0x0000000000000000-mapping.dmp

Download
memory/1608-1-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/3128-6-0x0000000000000000-mapping.dmp

Download
memory/3128-8-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/3308-10-0x0000000000000000-mapping.dmp

Download
memory/3372-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads