qakbot | cd9702eb5f317f58701901ad6af143877e7792eafe83d0cc5e07b35c20457dd3

General

Target

odkjia.exe
Size

1.9MB
MD5

9f56c3933dcbed29f1b535ec8f6d5371
SHA1

d687da6c66e24fb77b977372c6dc9f727d639ebe
SHA256

cd9702eb5f317f58701901ad6af143877e7792eafe83d0cc5e07b35c20457dd3
SHA512

c92e699ea1457ed4f4c66ea2332000225746fb71020aa01525b062bbb4722d732823f70f2d0579056ddaaad98cd8c0d41db52653243da9807809ec90ca92c957

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

vayva.exevayva.exe

pid process

932 vayva.exe
3160 vayva.exe

pid	process
932	vayva.exe
3160	vayva.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vayva.exeodkjia.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	vayva.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	vayva.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	odkjia.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	odkjia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	odkjia.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	odkjia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	vayva.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	odkjia.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	odkjia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	vayva.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	vayva.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	vayva.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2316 schtasks.exe

pid	process
2316	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

odkjia.exeodkjia.exevayva.exevayva.exeexplorer.exeodkjia.exe

pid	process
4040	odkjia.exe
4040	odkjia.exe
3548	odkjia.exe
3548	odkjia.exe
3548	odkjia.exe
3548	odkjia.exe
932	vayva.exe
932	vayva.exe
3160	vayva.exe
3160	vayva.exe
3160	vayva.exe
3160	vayva.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3292	explorer.exe
3724	odkjia.exe
3724	odkjia.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

vayva.exe

pid process

932 vayva.exe

pid	process
932	vayva.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

odkjia.exevayva.exe

description	pid	process	target process
PID 4040 wrote to memory of 3548	4040	odkjia.exe	odkjia.exe
PID 4040 wrote to memory of 3548	4040	odkjia.exe	odkjia.exe
PID 4040 wrote to memory of 3548	4040	odkjia.exe	odkjia.exe
PID 4040 wrote to memory of 932	4040	odkjia.exe	vayva.exe
PID 4040 wrote to memory of 932	4040	odkjia.exe	vayva.exe
PID 4040 wrote to memory of 932	4040	odkjia.exe	vayva.exe
PID 4040 wrote to memory of 2316	4040	odkjia.exe	schtasks.exe
PID 4040 wrote to memory of 2316	4040	odkjia.exe	schtasks.exe
PID 4040 wrote to memory of 2316	4040	odkjia.exe	schtasks.exe
PID 932 wrote to memory of 3160	932	vayva.exe	vayva.exe
PID 932 wrote to memory of 3160	932	vayva.exe	vayva.exe
PID 932 wrote to memory of 3160	932	vayva.exe	vayva.exe
PID 932 wrote to memory of 3292	932	vayva.exe	explorer.exe
PID 932 wrote to memory of 3292	932	vayva.exe	explorer.exe
PID 932 wrote to memory of 3292	932	vayva.exe	explorer.exe
PID 932 wrote to memory of 3292	932	vayva.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\odkjia.exe
"C:\Users\Admin\AppData\Local\Temp\odkjia.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4040

C:\Users\Admin\AppData\Local\Temp\odkjia.exe
C:\Users\Admin\AppData\Local\Temp\odkjia.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3548

C:\Users\Admin\AppData\Roaming\Microsoft\Qiieojfvs\vayva.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Qiieojfvs\vayva.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:932

C:\Users\Admin\AppData\Roaming\Microsoft\Qiieojfvs\vayva.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Qiieojfvs\vayva.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3160

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3292

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ethgwmhggk /tr "\"C:\Users\Admin\AppData\Local\Temp\odkjia.exe\" /I ethgwmhggk" /SC ONCE /Z /ST 14:44 /ET 14:56
2⤵
- Creates scheduled task(s)
PID:2316

C:\Users\Admin\AppData\Local\Temp\odkjia.exe
C:\Users\Admin\AppData\Local\Temp\odkjia.exe /I ethgwmhggk
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3724

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Qiieojfvs\vayva.dat
MD5
712d28f3935bd2b8bd92173baf4fb13f

SHA1
cb5fb8f32e4422d0fa50424eba8c0923aaa2e2bd

SHA256
590b0bff8c2a7c7393261d3ff0bc561759c82b23ab71371135989b7325530767

SHA512
f211bd1c43c4714e601dd9e5dcb70891f9e2e03452e2c9c78b9832c64a1371d73a8b0e2328e1232c10b3a84a283e55d7e0ac8fae4ffd562ecf995e7fbe66f02d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Qiieojfvs\vayva.exe
MD5
9f56c3933dcbed29f1b535ec8f6d5371

SHA1
d687da6c66e24fb77b977372c6dc9f727d639ebe

SHA256
cd9702eb5f317f58701901ad6af143877e7792eafe83d0cc5e07b35c20457dd3

SHA512
c92e699ea1457ed4f4c66ea2332000225746fb71020aa01525b062bbb4722d732823f70f2d0579056ddaaad98cd8c0d41db52653243da9807809ec90ca92c957

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Qiieojfvs\vayva.exe
MD5
9f56c3933dcbed29f1b535ec8f6d5371

SHA1
d687da6c66e24fb77b977372c6dc9f727d639ebe

SHA256
cd9702eb5f317f58701901ad6af143877e7792eafe83d0cc5e07b35c20457dd3

SHA512
c92e699ea1457ed4f4c66ea2332000225746fb71020aa01525b062bbb4722d732823f70f2d0579056ddaaad98cd8c0d41db52653243da9807809ec90ca92c957

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Qiieojfvs\vayva.exe
MD5
9f56c3933dcbed29f1b535ec8f6d5371

SHA1
d687da6c66e24fb77b977372c6dc9f727d639ebe

SHA256
cd9702eb5f317f58701901ad6af143877e7792eafe83d0cc5e07b35c20457dd3

SHA512
c92e699ea1457ed4f4c66ea2332000225746fb71020aa01525b062bbb4722d732823f70f2d0579056ddaaad98cd8c0d41db52653243da9807809ec90ca92c957

Download Submit
memory/932-2-0x0000000000000000-mapping.dmp

Download
memory/932-9-0x00000000027D0000-0x000000000280A000-memory.dmp

Filesize
232KB

Download
memory/2316-5-0x0000000000000000-mapping.dmp

Download
memory/3160-6-0x0000000000000000-mapping.dmp

Download
memory/3160-8-0x00000000027F0000-0x00000000027F1000-memory.dmp

Filesize
4KB

Download
memory/3292-10-0x0000000000000000-mapping.dmp

Download
memory/3548-0-0x0000000000000000-mapping.dmp

Download
memory/3548-1-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads