qakbot | 8962e42fd6241d4043598bc7825af7547fcc480f4c7cb8b791590ffe6be3f64d

Analysis

max time kernel
98s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
17/11/2020, 14:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
olfvrs.exe
Size 1.9MB
Sample201117-tt6vbgl18n
SHA256 8962e42fd6241d4043598bc7825af7547fcc480f4c7cb8b791590ffe6be3f64d
MD5 dac233fbb37a56a5e83732edfecb9150
SHA1 c77d969ac78c83b0331e8c159ab9654b92d14838
SHA512 7f48bf57a5a88d6338cc4a5619a8c096a2887a9e7cefea45bfee138a1c66f624bd15f7651974ab656170b1033ff23eb63f18b01af40348886b6324af44e5e2a3
MD5 SHA1 SHA512

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol
ftp
Host
192.185.5.208
Port
21
Username
[email protected]
Password
NxdkxAp4dUsY

Credentials

Protocol
ftp
Host
162.241.218.118
Port
21
Username
[email protected]
Password
EcOV0DyGVgVN

Credentials

Protocol
ftp
Host
69.89.31.139
Port
21
Username
[email protected]
Password
fcR7OvyLrMW6!

Credentials

Protocol
ftp
Host
169.207.67.14
Port
21
Username
[email protected]
Password
eQyicNLzzqPN

67.6.55.77:443
89.136.39.108:443
2.50.58.76:443
188.25.158.61:443
45.63.107.192:995
45.32.154.10:443
94.52.160.116:443
45.63.107.192:2222
45.63.107.192:443
72.204.242.138:465
84.117.176.32:443
95.77.223.148:443
47.146.39.147:443
41.225.13.128:8443
80.14.209.42:2222
190.220.8.10:995
66.76.105.194:443
105.101.69.242:443
89.33.87.107:443
75.136.40.155:443
78.97.3.6:443
108.46.145.30:443
68.134.181.98:443
85.121.42.12:995
75.87.161.32:995
68.174.15.223:443
149.28.99.97:995
199.247.16.80:443
45.32.155.12:443
149.28.99.97:2222
149.28.99.97:443
70.168.130.172:995
93.86.252.177:995
50.244.112.10:995
59.99.36.238:443
185.246.9.69:995
208.99.100.129:443
41.97.25.63:443
72.186.1.237:443
59.99.36.241:443
45.32.155.12:2222
96.30.198.161:443
140.82.27.132:443
45.32.165.134:443
45.63.104.123:443
207.246.70.216:443
97.118.38.31:993
134.228.24.29:443
188.25.24.21:2222
2.89.17.127:995
72.82.15.220:443
174.62.13.151:443
120.150.60.189:995
80.195.103.146:2222
142.129.227.86:443
89.137.221.232:443
98.26.50.62:995
74.129.26.119:443
146.199.132.233:2222
77.27.174.49:995
172.114.116.226:995
95.179.247.224:443
189.231.189.64:443
45.32.155.12:995
45.32.162.253:443
199.247.22.145:443
35.134.202.234:443
184.98.97.227:995
85.122.141.42:995
89.137.211.239:443
72.16.56.171:443
72.28.255.159:995
47.44.217.98:443
189.183.206.170:995
64.185.5.157:443
202.141.244.118:995
72.209.191.27:443
86.122.18.250:443
141.158.47.123:443
203.198.96.164:443
173.245.152.231:443
95.77.144.238:443
41.228.227.124:443
67.78.151.218:2222
84.232.238.30:443
188.27.32.167:443
173.3.17.223:995
201.215.96.174:0
69.11.247.242:443
87.65.204.240:995
207.246.75.201:443
217.162.149.212:443
45.77.193.83:443
80.240.26.178:443
98.16.204.189:995
173.90.33.182:2222
103.206.112.234:443
72.36.59.46:2222
190.220.8.10:443
86.98.89.245:2222
39.36.35.237:995
217.165.96.127:990
151.73.112.197:443
79.113.119.125:443
2.50.110.49:2078
72.66.47.70:443
93.113.177.152:443
103.238.231.35:443
78.97.207.104:443
156.213.227.208:443
71.163.223.253:443
108.31.15.10:995
184.21.136.237:443
184.179.14.130:22
81.133.234.36:2222
74.75.216.202:443
2.51.247.69:995
96.243.35.201:443
46.53.16.93:443
217.165.2.92:995
37.106.7.143:443
203.106.195.67:443
172.91.19.192:443
2.7.202.106:2222
78.96.199.79:443
184.55.32.182:443
24.205.42.241:443
103.76.160.110:443
188.121.219.88:2222
79.113.208.68:443
85.204.189.105:443
50.96.234.132:995
31.5.21.66:443
66.215.32.224:443
81.97.154.100:443
47.185.140.236:80
108.30.125.94:443
188.247.252.243:443
69.47.26.41:443
74.195.88.59:443
95.76.27.6:443
68.46.142.48:995
73.200.219.143:443
173.173.1.164:443
24.40.173.134:443
173.21.10.71:2222
73.225.67.0:443
45.47.65.191:443
75.106.52.142:443
75.182.220.196:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Executes dropped EXE 2 IoCs

pid	Process
4048	jnxqb.exe
1100	jnxqb.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	olfvrs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	jnxqb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	jnxqb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	jnxqb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	olfvrs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	olfvrs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	olfvrs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	jnxqb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	jnxqb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	olfvrs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	olfvrs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	jnxqb.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
556	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
796	olfvrs.exe
796	olfvrs.exe
2800	olfvrs.exe
2800	olfvrs.exe
2800	olfvrs.exe
2800	olfvrs.exe
4048	jnxqb.exe
4048	jnxqb.exe
1100	jnxqb.exe
1100	jnxqb.exe
1100	jnxqb.exe
1100	jnxqb.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
3628	olfvrs.exe
3628	olfvrs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4048	jnxqb.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 2800	796	olfvrs.exe	75
PID 796 wrote to memory of 2800	796	olfvrs.exe	75
PID 796 wrote to memory of 2800	796	olfvrs.exe	75
PID 796 wrote to memory of 4048	796	olfvrs.exe	79
PID 796 wrote to memory of 4048	796	olfvrs.exe	79
PID 796 wrote to memory of 4048	796	olfvrs.exe	79
PID 796 wrote to memory of 556	796	olfvrs.exe	80
PID 796 wrote to memory of 556	796	olfvrs.exe	80
PID 796 wrote to memory of 556	796	olfvrs.exe	80
PID 4048 wrote to memory of 1100	4048	jnxqb.exe	82
PID 4048 wrote to memory of 1100	4048	jnxqb.exe	82
PID 4048 wrote to memory of 1100	4048	jnxqb.exe	82
PID 4048 wrote to memory of 2136	4048	jnxqb.exe	83
PID 4048 wrote to memory of 2136	4048	jnxqb.exe	83
PID 4048 wrote to memory of 2136	4048	jnxqb.exe	83
PID 4048 wrote to memory of 2136	4048	jnxqb.exe	83

C:\Users\Admin\AppData\Local\Temp\olfvrs.exe
"C:\Users\Admin\AppData\Local\Temp\olfvrs.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:796
- C:\Users\Admin\AppData\Local\Temp\olfvrs.exe
  C:\Users\Admin\AppData\Local\Temp\olfvrs.exe /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:2800
- C:\Users\Admin\AppData\Roaming\Microsoft\Sqeobycx\jnxqb.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Sqeobycx\jnxqb.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Users\Admin\AppData\Roaming\Microsoft\Sqeobycx\jnxqb.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Sqeobycx\jnxqb.exe /C
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:1100
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2136
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jvjgvnxdl /tr "\"C:\Users\Admin\AppData\Local\Temp\olfvrs.exe\" /I jvjgvnxdl" /SC ONCE /Z /ST 14:44 /ET 14:56
  2⤵
  - Creates scheduled task(s)
  PID:556

C:\Users\Admin\AppData\Local\Temp\olfvrs.exe
C:\Users\Admin\AppData\Local\Temp\olfvrs.exe /I jvjgvnxdl
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-8-0x00000000028E0000-0x00000000028E1000-memory.dmp

Download

memory/2800-1-0x0000000002810000-0x0000000002811000-memory.dmp

Download

memory/4048-9-0x0000000002170000-0x00000000021AA000-memory.dmp

Download