qakbot | e61909ef1fb3c15aa6d59a74988c23ca084e214bf53a8c5b0ce58b35b6ebf0e5

General

Target

xxnphy.exe
Size

1.9MB
MD5

9d6cd8e81e93f992c582882cba1ef1ca
SHA1

57845de1acd7fea9286a60c4766eaee0918e1bfa
SHA256

e61909ef1fb3c15aa6d59a74988c23ca084e214bf53a8c5b0ce58b35b6ebf0e5
SHA512

bdd9fef8f535b8a0b835b0cc80541e9ddd388c1ac78d6d49d3c47c4fa42b98b1c19368f6603080b0ce7bc15864261fd4d62f692d261947ea8b40eb5f8b90a3bb

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
[email protected]
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
[email protected]
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
[email protected]
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
[email protected]
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

gkuqja.exegkuqja.exe

pid process

3256 gkuqja.exe
3880 gkuqja.exe

pid	process
3256	gkuqja.exe
3880	gkuqja.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

xxnphy.exegkuqja.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	xxnphy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	xxnphy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	xxnphy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	xxnphy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	gkuqja.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	gkuqja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	gkuqja.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	gkuqja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	xxnphy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	xxnphy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	gkuqja.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	gkuqja.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4172 schtasks.exe

pid	process
4172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

xxnphy.exexxnphy.exegkuqja.exegkuqja.exeexplorer.exexxnphy.exe

pid	process
4640	xxnphy.exe
4640	xxnphy.exe
3564	xxnphy.exe
3564	xxnphy.exe
3564	xxnphy.exe
3564	xxnphy.exe
3256	gkuqja.exe
3256	gkuqja.exe
3880	gkuqja.exe
3880	gkuqja.exe
3880	gkuqja.exe
3880	gkuqja.exe
4028	explorer.exe
4028	explorer.exe
4028	explorer.exe
4028	explorer.exe
3524	xxnphy.exe
3524	xxnphy.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

gkuqja.exe

pid process

3256 gkuqja.exe

pid	process
3256	gkuqja.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

xxnphy.exegkuqja.exe

description	pid	process	target process
PID 4640 wrote to memory of 3564	4640	xxnphy.exe	xxnphy.exe
PID 4640 wrote to memory of 3564	4640	xxnphy.exe	xxnphy.exe
PID 4640 wrote to memory of 3564	4640	xxnphy.exe	xxnphy.exe
PID 4640 wrote to memory of 3256	4640	xxnphy.exe	gkuqja.exe
PID 4640 wrote to memory of 3256	4640	xxnphy.exe	gkuqja.exe
PID 4640 wrote to memory of 3256	4640	xxnphy.exe	gkuqja.exe
PID 4640 wrote to memory of 4172	4640	xxnphy.exe	schtasks.exe
PID 4640 wrote to memory of 4172	4640	xxnphy.exe	schtasks.exe
PID 4640 wrote to memory of 4172	4640	xxnphy.exe	schtasks.exe
PID 3256 wrote to memory of 3880	3256	gkuqja.exe	gkuqja.exe
PID 3256 wrote to memory of 3880	3256	gkuqja.exe	gkuqja.exe
PID 3256 wrote to memory of 3880	3256	gkuqja.exe	gkuqja.exe
PID 3256 wrote to memory of 4028	3256	gkuqja.exe	explorer.exe
PID 3256 wrote to memory of 4028	3256	gkuqja.exe	explorer.exe
PID 3256 wrote to memory of 4028	3256	gkuqja.exe	explorer.exe
PID 3256 wrote to memory of 4028	3256	gkuqja.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\xxnphy.exe
"C:\Users\Admin\AppData\Local\Temp\xxnphy.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\xxnphy.exe
  C:\Users\Admin\AppData\Local\Temp\xxnphy.exe /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:3564
- C:\Users\Admin\AppData\Roaming\Microsoft\Fkbpcx\gkuqja.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Fkbpcx\gkuqja.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Users\Admin\AppData\Roaming\Microsoft\Fkbpcx\gkuqja.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Fkbpcx\gkuqja.exe /C
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:3880
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4028
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn tbrqfahwy /tr "\"C:\Users\Admin\AppData\Local\Temp\xxnphy.exe\" /I tbrqfahwy" /SC ONCE /Z /ST 14:44 /ET 14:56
  2⤵
  - Creates scheduled task(s)
  PID:4172

C:\Users\Admin\AppData\Local\Temp\xxnphy.exe
C:\Users\Admin\AppData\Local\Temp\xxnphy.exe /I tbrqfahwy
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Fkbpcx\gkuqja.dat

MD5
a64bd2d95d772d262ea6a71d8d16cc05

SHA1
51daae5195f994db940d0dea47698e7152797d18

SHA256
21f2bb49dbaf16d38e0d0766247fd1b85ff4ba85a73a83f3aa559d4a1b5a5cec

SHA512
6271d7e31e040c2136a480d3263cfb4d29cd8119a3c04210d4195c64fce7feee64ee53118064e35014d913366bda07c86f315f53f38c202a71ff84f41457619c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Fkbpcx\gkuqja.exe

MD5
9d6cd8e81e93f992c582882cba1ef1ca

SHA1
57845de1acd7fea9286a60c4766eaee0918e1bfa

SHA256
e61909ef1fb3c15aa6d59a74988c23ca084e214bf53a8c5b0ce58b35b6ebf0e5

SHA512
bdd9fef8f535b8a0b835b0cc80541e9ddd388c1ac78d6d49d3c47c4fa42b98b1c19368f6603080b0ce7bc15864261fd4d62f692d261947ea8b40eb5f8b90a3bb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Fkbpcx\gkuqja.exe

MD5
9d6cd8e81e93f992c582882cba1ef1ca

SHA1
57845de1acd7fea9286a60c4766eaee0918e1bfa

SHA256
e61909ef1fb3c15aa6d59a74988c23ca084e214bf53a8c5b0ce58b35b6ebf0e5

SHA512
bdd9fef8f535b8a0b835b0cc80541e9ddd388c1ac78d6d49d3c47c4fa42b98b1c19368f6603080b0ce7bc15864261fd4d62f692d261947ea8b40eb5f8b90a3bb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Fkbpcx\gkuqja.exe

MD5
9d6cd8e81e93f992c582882cba1ef1ca

SHA1
57845de1acd7fea9286a60c4766eaee0918e1bfa

SHA256
e61909ef1fb3c15aa6d59a74988c23ca084e214bf53a8c5b0ce58b35b6ebf0e5

SHA512
bdd9fef8f535b8a0b835b0cc80541e9ddd388c1ac78d6d49d3c47c4fa42b98b1c19368f6603080b0ce7bc15864261fd4d62f692d261947ea8b40eb5f8b90a3bb

Download Submit
memory/3256-2-0x0000000000000000-mapping.dmp

Download
memory/3256-9-0x00000000007C0000-0x00000000007FA000-memory.dmp

Filesize
232KB

Download
memory/3564-0-0x0000000000000000-mapping.dmp

Download
memory/3564-1-0x0000000002890000-0x0000000002891000-memory.dmp

Filesize
4KB

Download
memory/3880-6-0x0000000000000000-mapping.dmp

Download
memory/3880-8-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download
memory/4028-10-0x0000000000000000-mapping.dmp

Download
memory/4172-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads