qakbot | 4da30234fef2af8d98e0d365240f61757ed4c142d8878121d04b89738356abc7

General

Target

aapkic.exe
Size

1.9MB
MD5

aedb72b02acba53eeb7fbdd25005b1cd
SHA1

6654565f6fad2a8397d4a28c59924084e2dfacff
SHA256

4da30234fef2af8d98e0d365240f61757ed4c142d8878121d04b89738356abc7
SHA512

752fcc532bbbc9c98359294c438be360bb57a5e740b0d2fad0399b3a7375222285231aef0e5d91a054aa5ea690fb16c95d7054e29885f131f0268dc1e8f3d19b

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

comeylol.execomeylol.exe

pid process

2992 comeylol.exe
2748 comeylol.exe

pid	process
2992	comeylol.exe
2748	comeylol.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

aapkic.execomeylol.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	aapkic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	aapkic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	comeylol.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	comeylol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	comeylol.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	comeylol.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	comeylol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	aapkic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	aapkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	aapkic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	aapkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	comeylol.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

700 schtasks.exe

pid	process
700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

aapkic.exeaapkic.execomeylol.execomeylol.exeexplorer.exeaapkic.exe

pid	process
3372	aapkic.exe
3372	aapkic.exe
3880	aapkic.exe
3880	aapkic.exe
3880	aapkic.exe
3880	aapkic.exe
2992	comeylol.exe
2992	comeylol.exe
2748	comeylol.exe
2748	comeylol.exe
2748	comeylol.exe
2748	comeylol.exe
1488	explorer.exe
1488	explorer.exe
1488	explorer.exe
1488	explorer.exe
2064	aapkic.exe
2064	aapkic.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

comeylol.exe

pid process

2992 comeylol.exe

pid	process
2992	comeylol.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

aapkic.execomeylol.exe

description	pid	process	target process
PID 3372 wrote to memory of 3880	3372	aapkic.exe	aapkic.exe
PID 3372 wrote to memory of 3880	3372	aapkic.exe	aapkic.exe
PID 3372 wrote to memory of 3880	3372	aapkic.exe	aapkic.exe
PID 3372 wrote to memory of 2992	3372	aapkic.exe	comeylol.exe
PID 3372 wrote to memory of 2992	3372	aapkic.exe	comeylol.exe
PID 3372 wrote to memory of 2992	3372	aapkic.exe	comeylol.exe
PID 3372 wrote to memory of 700	3372	aapkic.exe	schtasks.exe
PID 3372 wrote to memory of 700	3372	aapkic.exe	schtasks.exe
PID 3372 wrote to memory of 700	3372	aapkic.exe	schtasks.exe
PID 2992 wrote to memory of 2748	2992	comeylol.exe	comeylol.exe
PID 2992 wrote to memory of 2748	2992	comeylol.exe	comeylol.exe
PID 2992 wrote to memory of 2748	2992	comeylol.exe	comeylol.exe
PID 2992 wrote to memory of 1488	2992	comeylol.exe	explorer.exe
PID 2992 wrote to memory of 1488	2992	comeylol.exe	explorer.exe
PID 2992 wrote to memory of 1488	2992	comeylol.exe	explorer.exe
PID 2992 wrote to memory of 1488	2992	comeylol.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\aapkic.exe
"C:\Users\Admin\AppData\Local\Temp\aapkic.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3372

C:\Users\Admin\AppData\Local\Temp\aapkic.exe
C:\Users\Admin\AppData\Local\Temp\aapkic.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3880

C:\Users\Admin\AppData\Roaming\Microsoft\Ivrodje\comeylol.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ivrodje\comeylol.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2992

C:\Users\Admin\AppData\Roaming\Microsoft\Ivrodje\comeylol.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ivrodje\comeylol.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:2748

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1488

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mwqbvlu /tr "\"C:\Users\Admin\AppData\Local\Temp\aapkic.exe\" /I mwqbvlu" /SC ONCE /Z /ST 05:01 /ET 05:13
2⤵
- Creates scheduled task(s)
PID:700

C:\Users\Admin\AppData\Local\Temp\aapkic.exe
C:\Users\Admin\AppData\Local\Temp\aapkic.exe /I mwqbvlu
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2064

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Ivrodje\comeylol.dat
MD5
e70a944c5889303880f9a951afaf19c9

SHA1
9c58d4cabc01a2dab66bf0bf97a619a46c87479b

SHA256
eb6a04d45ee1951777691d0359584d48b48354638a7be9bf40044cf5eab137ff

SHA512
08a72b18443a11ebc57b4d2ec018480baad00d212163ff246df1d53f1dc71292b02edfe2c2102585ec1b368221a7a3ebb8606575c596511acf8833d8f24c3ebd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ivrodje\comeylol.exe
MD5
aedb72b02acba53eeb7fbdd25005b1cd

SHA1
6654565f6fad2a8397d4a28c59924084e2dfacff

SHA256
4da30234fef2af8d98e0d365240f61757ed4c142d8878121d04b89738356abc7

SHA512
752fcc532bbbc9c98359294c438be360bb57a5e740b0d2fad0399b3a7375222285231aef0e5d91a054aa5ea690fb16c95d7054e29885f131f0268dc1e8f3d19b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ivrodje\comeylol.exe
MD5
aedb72b02acba53eeb7fbdd25005b1cd

SHA1
6654565f6fad2a8397d4a28c59924084e2dfacff

SHA256
4da30234fef2af8d98e0d365240f61757ed4c142d8878121d04b89738356abc7

SHA512
752fcc532bbbc9c98359294c438be360bb57a5e740b0d2fad0399b3a7375222285231aef0e5d91a054aa5ea690fb16c95d7054e29885f131f0268dc1e8f3d19b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ivrodje\comeylol.exe
MD5
aedb72b02acba53eeb7fbdd25005b1cd

SHA1
6654565f6fad2a8397d4a28c59924084e2dfacff

SHA256
4da30234fef2af8d98e0d365240f61757ed4c142d8878121d04b89738356abc7

SHA512
752fcc532bbbc9c98359294c438be360bb57a5e740b0d2fad0399b3a7375222285231aef0e5d91a054aa5ea690fb16c95d7054e29885f131f0268dc1e8f3d19b

Download Submit
memory/700-5-0x0000000000000000-mapping.dmp

Download
memory/1488-10-0x0000000000000000-mapping.dmp

Download
memory/2748-6-0x0000000000000000-mapping.dmp

Download
memory/2748-8-0x00000000028D0000-0x00000000028D1000-memory.dmp

Filesize
4KB

Download
memory/2992-2-0x0000000000000000-mapping.dmp

Download
memory/2992-9-0x0000000002180000-0x00000000021BA000-memory.dmp

Filesize
232KB

Download
memory/3880-0-0x0000000000000000-mapping.dmp

Download
memory/3880-1-0x00000000029B0000-0x00000000029B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads