qakbot | afcc73c2353a206773b01f137b4e8d79b5a838caa7fe9d55c8deebc5676a02fe

General

Target

rwqhfw.exe
Size

1.0MB
MD5

09bed39ccab3d6acb99922af1c55df22
SHA1

608831583f6e863e55d9d96a390623788f37ee20
SHA256

afcc73c2353a206773b01f137b4e8d79b5a838caa7fe9d55c8deebc5676a02fe
SHA512

ff6bbbb5f4d0b269142a9c8637586f1e0702a2e42a6194bfb1755cdf2353d5fd91850f9bb3a62a97297183c631f491aff0fa82a2a4ec19d89fb093e8ac505aa9

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
[email protected]
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
[email protected]
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
[email protected]
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
[email protected]
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

weiudmda.exeweiudmda.exe

pid process

2964 weiudmda.exe
2688 weiudmda.exe

pid	process
2964	weiudmda.exe
2688	weiudmda.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rwqhfw.exeweiudmda.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	rwqhfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	weiudmda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	weiudmda.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	weiudmda.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	weiudmda.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	rwqhfw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	rwqhfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	rwqhfw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	rwqhfw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	rwqhfw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	weiudmda.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	weiudmda.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

732 schtasks.exe

pid	process
732	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

rwqhfw.exerwqhfw.exeweiudmda.exeweiudmda.exeexplorer.exerwqhfw.exe

pid	process
412	rwqhfw.exe
412	rwqhfw.exe
3336	rwqhfw.exe
3336	rwqhfw.exe
3336	rwqhfw.exe
3336	rwqhfw.exe
2964	weiudmda.exe
2964	weiudmda.exe
2688	weiudmda.exe
2688	weiudmda.exe
2688	weiudmda.exe
2688	weiudmda.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
3244	rwqhfw.exe
3244	rwqhfw.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

weiudmda.exe

pid process

2964 weiudmda.exe

pid	process
2964	weiudmda.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rwqhfw.exeweiudmda.exe

description	pid	process	target process
PID 412 wrote to memory of 3336	412	rwqhfw.exe	rwqhfw.exe
PID 412 wrote to memory of 3336	412	rwqhfw.exe	rwqhfw.exe
PID 412 wrote to memory of 3336	412	rwqhfw.exe	rwqhfw.exe
PID 412 wrote to memory of 2964	412	rwqhfw.exe	weiudmda.exe
PID 412 wrote to memory of 2964	412	rwqhfw.exe	weiudmda.exe
PID 412 wrote to memory of 2964	412	rwqhfw.exe	weiudmda.exe
PID 412 wrote to memory of 732	412	rwqhfw.exe	schtasks.exe
PID 412 wrote to memory of 732	412	rwqhfw.exe	schtasks.exe
PID 412 wrote to memory of 732	412	rwqhfw.exe	schtasks.exe
PID 2964 wrote to memory of 2688	2964	weiudmda.exe	weiudmda.exe
PID 2964 wrote to memory of 2688	2964	weiudmda.exe	weiudmda.exe
PID 2964 wrote to memory of 2688	2964	weiudmda.exe	weiudmda.exe
PID 2964 wrote to memory of 548	2964	weiudmda.exe	explorer.exe
PID 2964 wrote to memory of 548	2964	weiudmda.exe	explorer.exe
PID 2964 wrote to memory of 548	2964	weiudmda.exe	explorer.exe
PID 2964 wrote to memory of 548	2964	weiudmda.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\rwqhfw.exe
"C:\Users\Admin\AppData\Local\Temp\rwqhfw.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:412

C:\Users\Admin\AppData\Local\Temp\rwqhfw.exe
C:\Users\Admin\AppData\Local\Temp\rwqhfw.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3336

C:\Users\Admin\AppData\Roaming\Microsoft\Ctrny\weiudmda.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ctrny\weiudmda.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2964

C:\Users\Admin\AppData\Roaming\Microsoft\Ctrny\weiudmda.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ctrny\weiudmda.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:2688

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:548

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bbeuazqm /tr "\"C:\Users\Admin\AppData\Local\Temp\rwqhfw.exe\" /I bbeuazqm" /SC ONCE /Z /ST 15:44 /ET 15:56
2⤵
- Creates scheduled task(s)
PID:732

C:\Users\Admin\AppData\Local\Temp\rwqhfw.exe
C:\Users\Admin\AppData\Local\Temp\rwqhfw.exe /I bbeuazqm
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3244

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Ctrny\weiudmda.dat
MD5
711e34afac6c99f383ee991cdce9f0be

SHA1
c2ea274ed6f9f9e0f18d84d614cc5a01f4262a03

SHA256
d51d1542126618badfa69d6add7c9c14fa5af8105a9e1f7ffd2d96865dffa14f

SHA512
1f2501b85868ca0b861e52871207a60ce8b294ecd7d371b919a0a07dd7243fb742040a8fea01933d0994d3caa995af78e99dd3951cd58a0ded40757fb1c71b87

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ctrny\weiudmda.exe
MD5
09bed39ccab3d6acb99922af1c55df22

SHA1
608831583f6e863e55d9d96a390623788f37ee20

SHA256
afcc73c2353a206773b01f137b4e8d79b5a838caa7fe9d55c8deebc5676a02fe

SHA512
ff6bbbb5f4d0b269142a9c8637586f1e0702a2e42a6194bfb1755cdf2353d5fd91850f9bb3a62a97297183c631f491aff0fa82a2a4ec19d89fb093e8ac505aa9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ctrny\weiudmda.exe
MD5
09bed39ccab3d6acb99922af1c55df22

SHA1
608831583f6e863e55d9d96a390623788f37ee20

SHA256
afcc73c2353a206773b01f137b4e8d79b5a838caa7fe9d55c8deebc5676a02fe

SHA512
ff6bbbb5f4d0b269142a9c8637586f1e0702a2e42a6194bfb1755cdf2353d5fd91850f9bb3a62a97297183c631f491aff0fa82a2a4ec19d89fb093e8ac505aa9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ctrny\weiudmda.exe
MD5
09bed39ccab3d6acb99922af1c55df22

SHA1
608831583f6e863e55d9d96a390623788f37ee20

SHA256
afcc73c2353a206773b01f137b4e8d79b5a838caa7fe9d55c8deebc5676a02fe

SHA512
ff6bbbb5f4d0b269142a9c8637586f1e0702a2e42a6194bfb1755cdf2353d5fd91850f9bb3a62a97297183c631f491aff0fa82a2a4ec19d89fb093e8ac505aa9

Download Submit
memory/548-10-0x0000000000000000-mapping.dmp

Download
memory/732-5-0x0000000000000000-mapping.dmp

Download
memory/2688-6-0x0000000000000000-mapping.dmp

Download
memory/2688-8-0x00000000028F0000-0x00000000028F1000-memory.dmp

Filesize
4KB

Download
memory/2964-2-0x0000000000000000-mapping.dmp

Download
memory/2964-9-0x00000000021A0000-0x00000000021DA000-memory.dmp

Filesize
232KB

Download
memory/3336-0-0x0000000000000000-mapping.dmp

Download
memory/3336-1-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads