qakbot | 7220c2dcc32049845837c3dd79dd43f5fa97589d66718cfae8ac78c01cc28f5a

General

Target

eylkgv.exe
Size

1.9MB
MD5

ffddebc27c33783e53b466743ac403d1
SHA1

f5aa0325ac5070b1d72459c86e66f7f7098ce6cc
SHA256

7220c2dcc32049845837c3dd79dd43f5fa97589d66718cfae8ac78c01cc28f5a
SHA512

5961f30ce479087823721e30e4226aae500abeb356bbdc56c60ea800c4d40cb919fe81d6731fcccded33b0a3516a0f67fdd4ba935a322497354bf458f5e5327b

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

cgoit.execgoit.exe

pid process

4276 cgoit.exe
532 cgoit.exe

pid	process
4276	cgoit.exe
532	cgoit.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

eylkgv.execgoit.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	eylkgv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	cgoit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	eylkgv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	eylkgv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	eylkgv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	cgoit.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	cgoit.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	cgoit.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	cgoit.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	eylkgv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	eylkgv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	cgoit.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4280 schtasks.exe

pid	process
4280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

eylkgv.exeeylkgv.execgoit.execgoit.exeexplorer.exeeylkgv.exe

pid	process
4796	eylkgv.exe
4796	eylkgv.exe
4312	eylkgv.exe
4312	eylkgv.exe
4312	eylkgv.exe
4312	eylkgv.exe
4276	cgoit.exe
4276	cgoit.exe
532	cgoit.exe
532	cgoit.exe
532	cgoit.exe
532	cgoit.exe
840	explorer.exe
840	explorer.exe
840	explorer.exe
840	explorer.exe
1204	eylkgv.exe
1204	eylkgv.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

cgoit.exe

pid process

4276 cgoit.exe

pid	process
4276	cgoit.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

eylkgv.execgoit.exe

description	pid	process	target process
PID 4796 wrote to memory of 4312	4796	eylkgv.exe	eylkgv.exe
PID 4796 wrote to memory of 4312	4796	eylkgv.exe	eylkgv.exe
PID 4796 wrote to memory of 4312	4796	eylkgv.exe	eylkgv.exe
PID 4796 wrote to memory of 4276	4796	eylkgv.exe	cgoit.exe
PID 4796 wrote to memory of 4276	4796	eylkgv.exe	cgoit.exe
PID 4796 wrote to memory of 4276	4796	eylkgv.exe	cgoit.exe
PID 4796 wrote to memory of 4280	4796	eylkgv.exe	schtasks.exe
PID 4796 wrote to memory of 4280	4796	eylkgv.exe	schtasks.exe
PID 4796 wrote to memory of 4280	4796	eylkgv.exe	schtasks.exe
PID 4276 wrote to memory of 532	4276	cgoit.exe	cgoit.exe
PID 4276 wrote to memory of 532	4276	cgoit.exe	cgoit.exe
PID 4276 wrote to memory of 532	4276	cgoit.exe	cgoit.exe
PID 4276 wrote to memory of 840	4276	cgoit.exe	explorer.exe
PID 4276 wrote to memory of 840	4276	cgoit.exe	explorer.exe
PID 4276 wrote to memory of 840	4276	cgoit.exe	explorer.exe
PID 4276 wrote to memory of 840	4276	cgoit.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\eylkgv.exe
"C:\Users\Admin\AppData\Local\Temp\eylkgv.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4796

C:\Users\Admin\AppData\Local\Temp\eylkgv.exe
C:\Users\Admin\AppData\Local\Temp\eylkgv.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:4312

C:\Users\Admin\AppData\Roaming\Microsoft\Ektzlwwyyhw\cgoit.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ektzlwwyyhw\cgoit.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4276

C:\Users\Admin\AppData\Roaming\Microsoft\Ektzlwwyyhw\cgoit.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ektzlwwyyhw\cgoit.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:532

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:840

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wcyshhalk /tr "\"C:\Users\Admin\AppData\Local\Temp\eylkgv.exe\" /I wcyshhalk" /SC ONCE /Z /ST 04:01 /ET 04:13
2⤵
- Creates scheduled task(s)
PID:4280

C:\Users\Admin\AppData\Local\Temp\eylkgv.exe
C:\Users\Admin\AppData\Local\Temp\eylkgv.exe /I wcyshhalk
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1204

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Ektzlwwyyhw\cgoit.dat
MD5
41a2a06a1e3783bbd492118e58695647

SHA1
a83635aa258b708f83d3433708268e5adcc62284

SHA256
4b04293751426c6d149852cb787fe80c3a7b142db894aa5a0da9e87f09de64a9

SHA512
3ec5737fdcc7df75fc04a2b2972c13b0c9ed7a66048c6f1149876657df514cabed980d321e8a37dabcbdf52ca0b3127754e8987a912847d2115028cc33b61c37

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ektzlwwyyhw\cgoit.exe
MD5
ffddebc27c33783e53b466743ac403d1

SHA1
f5aa0325ac5070b1d72459c86e66f7f7098ce6cc

SHA256
7220c2dcc32049845837c3dd79dd43f5fa97589d66718cfae8ac78c01cc28f5a

SHA512
5961f30ce479087823721e30e4226aae500abeb356bbdc56c60ea800c4d40cb919fe81d6731fcccded33b0a3516a0f67fdd4ba935a322497354bf458f5e5327b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ektzlwwyyhw\cgoit.exe
MD5
ffddebc27c33783e53b466743ac403d1

SHA1
f5aa0325ac5070b1d72459c86e66f7f7098ce6cc

SHA256
7220c2dcc32049845837c3dd79dd43f5fa97589d66718cfae8ac78c01cc28f5a

SHA512
5961f30ce479087823721e30e4226aae500abeb356bbdc56c60ea800c4d40cb919fe81d6731fcccded33b0a3516a0f67fdd4ba935a322497354bf458f5e5327b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ektzlwwyyhw\cgoit.exe
MD5
ffddebc27c33783e53b466743ac403d1

SHA1
f5aa0325ac5070b1d72459c86e66f7f7098ce6cc

SHA256
7220c2dcc32049845837c3dd79dd43f5fa97589d66718cfae8ac78c01cc28f5a

SHA512
5961f30ce479087823721e30e4226aae500abeb356bbdc56c60ea800c4d40cb919fe81d6731fcccded33b0a3516a0f67fdd4ba935a322497354bf458f5e5327b

Download Submit
memory/532-6-0x0000000000000000-mapping.dmp

Download
memory/532-8-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/840-10-0x0000000000000000-mapping.dmp

Download
memory/4276-2-0x0000000000000000-mapping.dmp

Download
memory/4276-9-0x00000000022A0000-0x00000000022DA000-memory.dmp

Filesize
232KB

Download
memory/4280-5-0x0000000000000000-mapping.dmp

Download
memory/4312-0-0x0000000000000000-mapping.dmp

Download
memory/4312-1-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads