qakbot | 32488f5551ee2821d8cfda2571b392999cf688ef537cf189d3b4289c5f721fa6

General

Target

kcthys.exe
Size

1.0MB
MD5

ecd4045f0fb5fefe54225ca504164ff3
SHA1

7d90762abc3506887f932bad59c7ccbdda341bd6
SHA256

32488f5551ee2821d8cfda2571b392999cf688ef537cf189d3b4289c5f721fa6
SHA512

01fb1299f1fcf9526de20c5a3b69b3cf8030ba54fecbdfb50ebdf285020c5b3ac9863b9c2247f7ecee80c8b6bfc3df37963d8583c9855a0c0828e41013d2b51b

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
[email protected]
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
[email protected]
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
[email protected]
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
[email protected]
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

bqndoayk.exebqndoayk.exe

pid process

3752 bqndoayk.exe
3164 bqndoayk.exe

pid	process
3752	bqndoayk.exe
3164	bqndoayk.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

kcthys.exebqndoayk.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	kcthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	kcthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	kcthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	bqndoayk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	bqndoayk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	kcthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	kcthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	bqndoayk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	bqndoayk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	bqndoayk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	kcthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	bqndoayk.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3436 schtasks.exe

pid	process
3436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

kcthys.exekcthys.exebqndoayk.exebqndoayk.exeexplorer.exekcthys.exe

pid	process
3976	kcthys.exe
3976	kcthys.exe
3532	kcthys.exe
3532	kcthys.exe
3532	kcthys.exe
3532	kcthys.exe
3752	bqndoayk.exe
3752	bqndoayk.exe
3164	bqndoayk.exe
3164	bqndoayk.exe
3164	bqndoayk.exe
3164	bqndoayk.exe
3484	explorer.exe
3484	explorer.exe
3484	explorer.exe
3484	explorer.exe
2076	kcthys.exe
2076	kcthys.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

bqndoayk.exe

pid process

3752 bqndoayk.exe

pid	process
3752	bqndoayk.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

kcthys.exebqndoayk.exe

description	pid	process	target process
PID 3976 wrote to memory of 3532	3976	kcthys.exe	kcthys.exe
PID 3976 wrote to memory of 3532	3976	kcthys.exe	kcthys.exe
PID 3976 wrote to memory of 3532	3976	kcthys.exe	kcthys.exe
PID 3976 wrote to memory of 3752	3976	kcthys.exe	bqndoayk.exe
PID 3976 wrote to memory of 3752	3976	kcthys.exe	bqndoayk.exe
PID 3976 wrote to memory of 3752	3976	kcthys.exe	bqndoayk.exe
PID 3976 wrote to memory of 3436	3976	kcthys.exe	schtasks.exe
PID 3976 wrote to memory of 3436	3976	kcthys.exe	schtasks.exe
PID 3976 wrote to memory of 3436	3976	kcthys.exe	schtasks.exe
PID 3752 wrote to memory of 3164	3752	bqndoayk.exe	bqndoayk.exe
PID 3752 wrote to memory of 3164	3752	bqndoayk.exe	bqndoayk.exe
PID 3752 wrote to memory of 3164	3752	bqndoayk.exe	bqndoayk.exe
PID 3752 wrote to memory of 3484	3752	bqndoayk.exe	explorer.exe
PID 3752 wrote to memory of 3484	3752	bqndoayk.exe	explorer.exe
PID 3752 wrote to memory of 3484	3752	bqndoayk.exe	explorer.exe
PID 3752 wrote to memory of 3484	3752	bqndoayk.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\kcthys.exe
"C:\Users\Admin\AppData\Local\Temp\kcthys.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3976

C:\Users\Admin\AppData\Local\Temp\kcthys.exe
C:\Users\Admin\AppData\Local\Temp\kcthys.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3532

C:\Users\Admin\AppData\Roaming\Microsoft\Mmyoubsaymvy\bqndoayk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Mmyoubsaymvy\bqndoayk.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3752

C:\Users\Admin\AppData\Roaming\Microsoft\Mmyoubsaymvy\bqndoayk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Mmyoubsaymvy\bqndoayk.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3164

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3484

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pivonrlg /tr "\"C:\Users\Admin\AppData\Local\Temp\kcthys.exe\" /I pivonrlg" /SC ONCE /Z /ST 14:44 /ET 14:56
2⤵
- Creates scheduled task(s)
PID:3436

C:\Users\Admin\AppData\Local\Temp\kcthys.exe
C:\Users\Admin\AppData\Local\Temp\kcthys.exe /I pivonrlg
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Mmyoubsaymvy\bqndoayk.dat
MD5
8d14c0cb308cc076efb170c3f98d7525

SHA1
71270e0e6c0a75c7d95390407ed4dd2a9f924b22

SHA256
48ffcc37820c294713dedd98219e457ec7d7b27b1d6623e0a3f8c2f13a6fdaf4

SHA512
d6859a69e4c536d4d354b8441b3bc2d4ba136c2933ff405a05535a2e51c4edaa18ad9ec3c4c18424f4933bcfa86fbaf0d98aa0ea3d04a0fd9cb52b4cf6930aa5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Mmyoubsaymvy\bqndoayk.exe
MD5
ecd4045f0fb5fefe54225ca504164ff3

SHA1
7d90762abc3506887f932bad59c7ccbdda341bd6

SHA256
32488f5551ee2821d8cfda2571b392999cf688ef537cf189d3b4289c5f721fa6

SHA512
01fb1299f1fcf9526de20c5a3b69b3cf8030ba54fecbdfb50ebdf285020c5b3ac9863b9c2247f7ecee80c8b6bfc3df37963d8583c9855a0c0828e41013d2b51b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Mmyoubsaymvy\bqndoayk.exe
MD5
ecd4045f0fb5fefe54225ca504164ff3

SHA1
7d90762abc3506887f932bad59c7ccbdda341bd6

SHA256
32488f5551ee2821d8cfda2571b392999cf688ef537cf189d3b4289c5f721fa6

SHA512
01fb1299f1fcf9526de20c5a3b69b3cf8030ba54fecbdfb50ebdf285020c5b3ac9863b9c2247f7ecee80c8b6bfc3df37963d8583c9855a0c0828e41013d2b51b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Mmyoubsaymvy\bqndoayk.exe
MD5
ecd4045f0fb5fefe54225ca504164ff3

SHA1
7d90762abc3506887f932bad59c7ccbdda341bd6

SHA256
32488f5551ee2821d8cfda2571b392999cf688ef537cf189d3b4289c5f721fa6

SHA512
01fb1299f1fcf9526de20c5a3b69b3cf8030ba54fecbdfb50ebdf285020c5b3ac9863b9c2247f7ecee80c8b6bfc3df37963d8583c9855a0c0828e41013d2b51b

Download Submit
memory/3164-6-0x0000000000000000-mapping.dmp

Download
memory/3164-8-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/3436-5-0x0000000000000000-mapping.dmp

Download
memory/3484-10-0x0000000000000000-mapping.dmp

Download
memory/3532-0-0x0000000000000000-mapping.dmp

Download
memory/3532-1-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/3752-2-0x0000000000000000-mapping.dmp

Download
memory/3752-9-0x00000000020B0000-0x00000000020EA000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads