qakbot | 19be195d3ca5f391ccd2b246b4b0f30bae7cc5b7c94cabc718ca1633bca57fbe

General

Target

qldjyb.exe
Size

1.0MB
MD5

b816a35127bbbbf7af0a0e6c0c266a59
SHA1

dd326994acef89039d06dfe78a30cea394421574
SHA256

19be195d3ca5f391ccd2b246b4b0f30bae7cc5b7c94cabc718ca1633bca57fbe
SHA512

d4384c8862b39dbef22130e63ccd4c6dfdabeddc07d80bb92f90735a6601b89ff7181a72abf2c9ae4df7bc964d7607cb4d916a89a56c395d691e6809bd60a67f

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
[email protected]
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
[email protected]
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
[email protected]
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
[email protected]
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

xifgnld.exexifgnld.exe

pid process

2984 xifgnld.exe
2392 xifgnld.exe

pid	process
2984	xifgnld.exe
2392	xifgnld.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

qldjyb.exexifgnld.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	qldjyb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	qldjyb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	qldjyb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	qldjyb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	xifgnld.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	xifgnld.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	qldjyb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	qldjyb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	xifgnld.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	xifgnld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	xifgnld.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	xifgnld.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

184 schtasks.exe

pid	process
184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

qldjyb.exeqldjyb.exexifgnld.exexifgnld.exeexplorer.exeqldjyb.exe

pid	process
2484	qldjyb.exe
2484	qldjyb.exe
1652	qldjyb.exe
1652	qldjyb.exe
1652	qldjyb.exe
1652	qldjyb.exe
2984	xifgnld.exe
2984	xifgnld.exe
2392	xifgnld.exe
2392	xifgnld.exe
2392	xifgnld.exe
2392	xifgnld.exe
3656	explorer.exe
3656	explorer.exe
3656	explorer.exe
3656	explorer.exe
3496	qldjyb.exe
3496	qldjyb.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

xifgnld.exe

pid process

2984 xifgnld.exe

pid	process
2984	xifgnld.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

qldjyb.exexifgnld.exe

description	pid	process	target process
PID 2484 wrote to memory of 1652	2484	qldjyb.exe	qldjyb.exe
PID 2484 wrote to memory of 1652	2484	qldjyb.exe	qldjyb.exe
PID 2484 wrote to memory of 1652	2484	qldjyb.exe	qldjyb.exe
PID 2484 wrote to memory of 2984	2484	qldjyb.exe	xifgnld.exe
PID 2484 wrote to memory of 2984	2484	qldjyb.exe	xifgnld.exe
PID 2484 wrote to memory of 2984	2484	qldjyb.exe	xifgnld.exe
PID 2484 wrote to memory of 184	2484	qldjyb.exe	schtasks.exe
PID 2484 wrote to memory of 184	2484	qldjyb.exe	schtasks.exe
PID 2484 wrote to memory of 184	2484	qldjyb.exe	schtasks.exe
PID 2984 wrote to memory of 2392	2984	xifgnld.exe	xifgnld.exe
PID 2984 wrote to memory of 2392	2984	xifgnld.exe	xifgnld.exe
PID 2984 wrote to memory of 2392	2984	xifgnld.exe	xifgnld.exe
PID 2984 wrote to memory of 3656	2984	xifgnld.exe	explorer.exe
PID 2984 wrote to memory of 3656	2984	xifgnld.exe	explorer.exe
PID 2984 wrote to memory of 3656	2984	xifgnld.exe	explorer.exe
PID 2984 wrote to memory of 3656	2984	xifgnld.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\qldjyb.exe
"C:\Users\Admin\AppData\Local\Temp\qldjyb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2484

C:\Users\Admin\AppData\Local\Temp\qldjyb.exe
C:\Users\Admin\AppData\Local\Temp\qldjyb.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1652

C:\Users\Admin\AppData\Roaming\Microsoft\Zonmuhecedo\xifgnld.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Zonmuhecedo\xifgnld.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2984

C:\Users\Admin\AppData\Roaming\Microsoft\Zonmuhecedo\xifgnld.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Zonmuhecedo\xifgnld.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:2392

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3656

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn blcecsobjt /tr "\"C:\Users\Admin\AppData\Local\Temp\qldjyb.exe\" /I blcecsobjt" /SC ONCE /Z /ST 15:44 /ET 15:56
2⤵
- Creates scheduled task(s)
PID:184

C:\Users\Admin\AppData\Local\Temp\qldjyb.exe
C:\Users\Admin\AppData\Local\Temp\qldjyb.exe /I blcecsobjt
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3496

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Zonmuhecedo\xifgnld.dat
MD5
d9dd5758b9e4269324e8d006629a1661

SHA1
370fc6f4a0a417e5eacec3834a5fcb02d5417e1f

SHA256
8a2298052486d510e03b5564f47a71f9f2976625804a6b7d53d6c7049879aa75

SHA512
3127739090a8486bf0f8bb8e44b2d9954f5bc2b12a492aa0b1748b4d1a6e8807e9bc9025a97a0b3b561d62c0a74dcc20a59bdfe428758f05b450e8d26236c853

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Zonmuhecedo\xifgnld.exe
MD5
b816a35127bbbbf7af0a0e6c0c266a59

SHA1
dd326994acef89039d06dfe78a30cea394421574

SHA256
19be195d3ca5f391ccd2b246b4b0f30bae7cc5b7c94cabc718ca1633bca57fbe

SHA512
d4384c8862b39dbef22130e63ccd4c6dfdabeddc07d80bb92f90735a6601b89ff7181a72abf2c9ae4df7bc964d7607cb4d916a89a56c395d691e6809bd60a67f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Zonmuhecedo\xifgnld.exe
MD5
b816a35127bbbbf7af0a0e6c0c266a59

SHA1
dd326994acef89039d06dfe78a30cea394421574

SHA256
19be195d3ca5f391ccd2b246b4b0f30bae7cc5b7c94cabc718ca1633bca57fbe

SHA512
d4384c8862b39dbef22130e63ccd4c6dfdabeddc07d80bb92f90735a6601b89ff7181a72abf2c9ae4df7bc964d7607cb4d916a89a56c395d691e6809bd60a67f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Zonmuhecedo\xifgnld.exe
MD5
b816a35127bbbbf7af0a0e6c0c266a59

SHA1
dd326994acef89039d06dfe78a30cea394421574

SHA256
19be195d3ca5f391ccd2b246b4b0f30bae7cc5b7c94cabc718ca1633bca57fbe

SHA512
d4384c8862b39dbef22130e63ccd4c6dfdabeddc07d80bb92f90735a6601b89ff7181a72abf2c9ae4df7bc964d7607cb4d916a89a56c395d691e6809bd60a67f

Download Submit
memory/184-5-0x0000000000000000-mapping.dmp

Download
memory/1652-0-0x0000000000000000-mapping.dmp

Download
memory/1652-1-0x0000000002840000-0x0000000002841000-memory.dmp

Filesize
4KB

Download
memory/2392-6-0x0000000000000000-mapping.dmp

Download
memory/2392-8-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/2984-2-0x0000000000000000-mapping.dmp

Download
memory/2984-9-0x0000000002180000-0x00000000021BA000-memory.dmp

Filesize
232KB

Download
memory/3656-10-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads