qakbot | 80947a0b71c1d5bd8dffea16cf74df36baaf3b9870c1ab56a5982cf564f2fac5

General

Target

vwvzyn.exe
Size

1.9MB
MD5

d74dfd2e10c364c7cd13c925e8101824
SHA1

0e6dbf19f980642ea10826be199bfc518be93975
SHA256

80947a0b71c1d5bd8dffea16cf74df36baaf3b9870c1ab56a5982cf564f2fac5
SHA512

04f7c61025853bd5198406ceb09a90d1ad1c286efabefd9b782fcd82be2bdcf851f5661d633a6d70241120500b5852929d24e406b6ef2956b6fcce3269b4dd14

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

cgoit.execgoit.exe

pid process

4296 cgoit.exe
2604 cgoit.exe

pid	process
4296	cgoit.exe
2604	cgoit.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

cgoit.exevwvzyn.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	cgoit.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	vwvzyn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	vwvzyn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	cgoit.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	vwvzyn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	cgoit.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	cgoit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	cgoit.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	cgoit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	vwvzyn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	vwvzyn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	vwvzyn.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4288 schtasks.exe

pid	process
4288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

vwvzyn.exevwvzyn.execgoit.execgoit.exeexplorer.exevwvzyn.exe

pid	process
4800	vwvzyn.exe
4800	vwvzyn.exe
820	vwvzyn.exe
820	vwvzyn.exe
820	vwvzyn.exe
820	vwvzyn.exe
4296	cgoit.exe
4296	cgoit.exe
2604	cgoit.exe
2604	cgoit.exe
2604	cgoit.exe
2604	cgoit.exe
592	explorer.exe
592	explorer.exe
592	explorer.exe
592	explorer.exe
8	vwvzyn.exe
8	vwvzyn.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

cgoit.exe

pid process

4296 cgoit.exe

pid	process
4296	cgoit.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

vwvzyn.execgoit.exe

description	pid	process	target process
PID 4800 wrote to memory of 820	4800	vwvzyn.exe	vwvzyn.exe
PID 4800 wrote to memory of 820	4800	vwvzyn.exe	vwvzyn.exe
PID 4800 wrote to memory of 820	4800	vwvzyn.exe	vwvzyn.exe
PID 4800 wrote to memory of 4296	4800	vwvzyn.exe	cgoit.exe
PID 4800 wrote to memory of 4296	4800	vwvzyn.exe	cgoit.exe
PID 4800 wrote to memory of 4296	4800	vwvzyn.exe	cgoit.exe
PID 4800 wrote to memory of 4288	4800	vwvzyn.exe	schtasks.exe
PID 4800 wrote to memory of 4288	4800	vwvzyn.exe	schtasks.exe
PID 4800 wrote to memory of 4288	4800	vwvzyn.exe	schtasks.exe
PID 4296 wrote to memory of 2604	4296	cgoit.exe	cgoit.exe
PID 4296 wrote to memory of 2604	4296	cgoit.exe	cgoit.exe
PID 4296 wrote to memory of 2604	4296	cgoit.exe	cgoit.exe
PID 4296 wrote to memory of 592	4296	cgoit.exe	explorer.exe
PID 4296 wrote to memory of 592	4296	cgoit.exe	explorer.exe
PID 4296 wrote to memory of 592	4296	cgoit.exe	explorer.exe
PID 4296 wrote to memory of 592	4296	cgoit.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\vwvzyn.exe
"C:\Users\Admin\AppData\Local\Temp\vwvzyn.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4800

C:\Users\Admin\AppData\Local\Temp\vwvzyn.exe
C:\Users\Admin\AppData\Local\Temp\vwvzyn.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:820

C:\Users\Admin\AppData\Roaming\Microsoft\Ektzlwwyyhw\cgoit.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ektzlwwyyhw\cgoit.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4296

C:\Users\Admin\AppData\Roaming\Microsoft\Ektzlwwyyhw\cgoit.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ektzlwwyyhw\cgoit.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:2604

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:592

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qfynykoc /tr "\"C:\Users\Admin\AppData\Local\Temp\vwvzyn.exe\" /I qfynykoc" /SC ONCE /Z /ST 03:29 /ET 03:41
2⤵
- Creates scheduled task(s)
PID:4288

C:\Users\Admin\AppData\Local\Temp\vwvzyn.exe
C:\Users\Admin\AppData\Local\Temp\vwvzyn.exe /I qfynykoc
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:8

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Ektzlwwyyhw\cgoit.dat
MD5
178c42ad558e6821539149c87c520ebf

SHA1
25a5211b8dced9d7033a869e2c3a242a036ea232

SHA256
1869263816749b9c061c72ebc4b0bf0a1d69017304c7d25553f4f500362c9735

SHA512
6107d998aba7227ce84c317203f9e8c964aa346ff27821d91be9368bd18afe42de1edae03db09ab069d1829c58fdac1d5f2ee05dce530b9a2ea67019927ec0c6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ektzlwwyyhw\cgoit.exe
MD5
d74dfd2e10c364c7cd13c925e8101824

SHA1
0e6dbf19f980642ea10826be199bfc518be93975

SHA256
80947a0b71c1d5bd8dffea16cf74df36baaf3b9870c1ab56a5982cf564f2fac5

SHA512
04f7c61025853bd5198406ceb09a90d1ad1c286efabefd9b782fcd82be2bdcf851f5661d633a6d70241120500b5852929d24e406b6ef2956b6fcce3269b4dd14

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ektzlwwyyhw\cgoit.exe
MD5
d74dfd2e10c364c7cd13c925e8101824

SHA1
0e6dbf19f980642ea10826be199bfc518be93975

SHA256
80947a0b71c1d5bd8dffea16cf74df36baaf3b9870c1ab56a5982cf564f2fac5

SHA512
04f7c61025853bd5198406ceb09a90d1ad1c286efabefd9b782fcd82be2bdcf851f5661d633a6d70241120500b5852929d24e406b6ef2956b6fcce3269b4dd14

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ektzlwwyyhw\cgoit.exe
MD5
d74dfd2e10c364c7cd13c925e8101824

SHA1
0e6dbf19f980642ea10826be199bfc518be93975

SHA256
80947a0b71c1d5bd8dffea16cf74df36baaf3b9870c1ab56a5982cf564f2fac5

SHA512
04f7c61025853bd5198406ceb09a90d1ad1c286efabefd9b782fcd82be2bdcf851f5661d633a6d70241120500b5852929d24e406b6ef2956b6fcce3269b4dd14

Download Submit
memory/592-10-0x0000000000000000-mapping.dmp

Download
memory/820-0-0x0000000000000000-mapping.dmp

Download
memory/820-1-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/2604-6-0x0000000000000000-mapping.dmp

Download
memory/2604-8-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/4288-5-0x0000000000000000-mapping.dmp

Download
memory/4296-2-0x0000000000000000-mapping.dmp

Download
memory/4296-9-0x00000000007B0000-0x00000000007EA000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads