qakbot | d2dd5755c638bdd30ce8cf3f6cde8e6f8c475c03e8240d1e94ea5720c09477cc

General

Target

nlfkzt.exe
Size

1.9MB
MD5

6a3dacd4ebff41202fc7e92ec2ce9adf
SHA1

dab26f806eaa39e8b8835689338911a1c5010bb3
SHA256

d2dd5755c638bdd30ce8cf3f6cde8e6f8c475c03e8240d1e94ea5720c09477cc
SHA512

a6a78880be4adc5587f83373a61893c0f56f8e5bccaac1f604accda370e092c238755b6627f1fd7eca81996ad7b9944001dc5b6ff3e2f9edb1f3c0fac2ad92be

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

yxyiw.exeyxyiw.exe

pid process

3380 yxyiw.exe
1972 yxyiw.exe

pid	process
3380	yxyiw.exe
1972	yxyiw.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

yxyiw.exenlfkzt.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	yxyiw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	yxyiw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	nlfkzt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	nlfkzt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	nlfkzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	yxyiw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	yxyiw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	yxyiw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	nlfkzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	nlfkzt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	nlfkzt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	yxyiw.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1160 schtasks.exe

pid	process
1160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

nlfkzt.exenlfkzt.exeyxyiw.exeyxyiw.exeexplorer.exenlfkzt.exe

pid	process
3324	nlfkzt.exe
3324	nlfkzt.exe
3136	nlfkzt.exe
3136	nlfkzt.exe
3136	nlfkzt.exe
3136	nlfkzt.exe
3380	yxyiw.exe
3380	yxyiw.exe
1972	yxyiw.exe
1972	yxyiw.exe
1972	yxyiw.exe
1972	yxyiw.exe
2324	explorer.exe
2324	explorer.exe
2324	explorer.exe
2324	explorer.exe
1584	nlfkzt.exe
1584	nlfkzt.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

yxyiw.exe

pid process

3380 yxyiw.exe

pid	process
3380	yxyiw.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

nlfkzt.exeyxyiw.exe

description	pid	process	target process
PID 3324 wrote to memory of 3136	3324	nlfkzt.exe	nlfkzt.exe
PID 3324 wrote to memory of 3136	3324	nlfkzt.exe	nlfkzt.exe
PID 3324 wrote to memory of 3136	3324	nlfkzt.exe	nlfkzt.exe
PID 3324 wrote to memory of 3380	3324	nlfkzt.exe	yxyiw.exe
PID 3324 wrote to memory of 3380	3324	nlfkzt.exe	yxyiw.exe
PID 3324 wrote to memory of 3380	3324	nlfkzt.exe	yxyiw.exe
PID 3324 wrote to memory of 1160	3324	nlfkzt.exe	schtasks.exe
PID 3324 wrote to memory of 1160	3324	nlfkzt.exe	schtasks.exe
PID 3324 wrote to memory of 1160	3324	nlfkzt.exe	schtasks.exe
PID 3380 wrote to memory of 1972	3380	yxyiw.exe	yxyiw.exe
PID 3380 wrote to memory of 1972	3380	yxyiw.exe	yxyiw.exe
PID 3380 wrote to memory of 1972	3380	yxyiw.exe	yxyiw.exe
PID 3380 wrote to memory of 2324	3380	yxyiw.exe	explorer.exe
PID 3380 wrote to memory of 2324	3380	yxyiw.exe	explorer.exe
PID 3380 wrote to memory of 2324	3380	yxyiw.exe	explorer.exe
PID 3380 wrote to memory of 2324	3380	yxyiw.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\nlfkzt.exe
"C:\Users\Admin\AppData\Local\Temp\nlfkzt.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3324

C:\Users\Admin\AppData\Local\Temp\nlfkzt.exe
C:\Users\Admin\AppData\Local\Temp\nlfkzt.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3136

C:\Users\Admin\AppData\Roaming\Microsoft\Yuhcibr\yxyiw.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Yuhcibr\yxyiw.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3380

C:\Users\Admin\AppData\Roaming\Microsoft\Yuhcibr\yxyiw.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Yuhcibr\yxyiw.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1972

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2324

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fwcfjqjdh /tr "\"C:\Users\Admin\AppData\Local\Temp\nlfkzt.exe\" /I fwcfjqjdh" /SC ONCE /Z /ST 15:37 /ET 15:49
2⤵
- Creates scheduled task(s)
PID:1160

C:\Users\Admin\AppData\Local\Temp\nlfkzt.exe
C:\Users\Admin\AppData\Local\Temp\nlfkzt.exe /I fwcfjqjdh
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1584

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Yuhcibr\yxyiw.dat
MD5
cc71e90123f5d14f272385023e02b63a

SHA1
1b9197c7a641a15194409ca07bc339df01ecbd2e

SHA256
fdea300722760c36cc212f6365ad266c94af750c823c83440567ddfd90edd279

SHA512
0b28f1dbe5859a48d53dbcdf981f41e88a2ad9bc7ed4c0c1284eeac14b4de6dd13b95fba531061ec4e3a8bce63dff3b8c09cc5e830fef39c2320fbb30c98a92e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yuhcibr\yxyiw.exe
MD5
6a3dacd4ebff41202fc7e92ec2ce9adf

SHA1
dab26f806eaa39e8b8835689338911a1c5010bb3

SHA256
d2dd5755c638bdd30ce8cf3f6cde8e6f8c475c03e8240d1e94ea5720c09477cc

SHA512
a6a78880be4adc5587f83373a61893c0f56f8e5bccaac1f604accda370e092c238755b6627f1fd7eca81996ad7b9944001dc5b6ff3e2f9edb1f3c0fac2ad92be

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yuhcibr\yxyiw.exe
MD5
6a3dacd4ebff41202fc7e92ec2ce9adf

SHA1
dab26f806eaa39e8b8835689338911a1c5010bb3

SHA256
d2dd5755c638bdd30ce8cf3f6cde8e6f8c475c03e8240d1e94ea5720c09477cc

SHA512
a6a78880be4adc5587f83373a61893c0f56f8e5bccaac1f604accda370e092c238755b6627f1fd7eca81996ad7b9944001dc5b6ff3e2f9edb1f3c0fac2ad92be

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yuhcibr\yxyiw.exe
MD5
6a3dacd4ebff41202fc7e92ec2ce9adf

SHA1
dab26f806eaa39e8b8835689338911a1c5010bb3

SHA256
d2dd5755c638bdd30ce8cf3f6cde8e6f8c475c03e8240d1e94ea5720c09477cc

SHA512
a6a78880be4adc5587f83373a61893c0f56f8e5bccaac1f604accda370e092c238755b6627f1fd7eca81996ad7b9944001dc5b6ff3e2f9edb1f3c0fac2ad92be

Download Submit
memory/1160-5-0x0000000000000000-mapping.dmp

Download
memory/1972-6-0x0000000000000000-mapping.dmp

Download
memory/1972-8-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/2324-10-0x0000000000000000-mapping.dmp

Download
memory/3136-0-0x0000000000000000-mapping.dmp

Download
memory/3136-1-0x0000000002900000-0x0000000002901000-memory.dmp

Filesize
4KB

Download
memory/3380-2-0x0000000000000000-mapping.dmp

Download
memory/3380-9-0x00000000023E0000-0x000000000241A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads