qakbot | f135cb54cc49b06b0a661d52c50894ea6e42140a5e0316dc721e47c105b4043b

General

Target

nosto.exe
Size

1.3MB
MD5

c5b92b47eeb6372edb232deae1bf47d7
SHA1

7034a52f0ebc2fd0b38c130b229902e33a02c5ed
SHA256

6f5801587baf461e5a67f49bc6f4b400a8f458dc223f4d3ec9e2eafd9b062f5f
SHA512

e82535143ad12e85ee58b515c536f43a60c6324b79bfad304ac9f19c77ebb6eabd1604cf5d7fb0b8f7bb557ca2cfa11d564bf1d86063c662f3b124eb9c31f9ce

Score

10^/10

qakbot abc023 1603362336 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

abc023

Campaign

1603362336

C2

207.246.75.201:443

93.86.1.140:995

78.96.199.79:443

185.246.9.69:995

80.14.209.42:2222

72.186.1.237:443

92.59.35.196:2222

45.32.154.10:443

74.129.26.119:443

186.6.196.12:443

5.13.69.214:443

80.240.26.178:443

203.198.96.200:443

108.31.15.10:995

86.98.89.139:2222

156.213.186.133:443

72.36.59.46:2222

5.193.181.221:2078

59.99.39.32:443

108.46.145.30:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

guloxsjd.exeguloxsjd.exe

pid process

872 guloxsjd.exe
1824 guloxsjd.exe
Loads dropped DLL 2 IoCs

Processes:

nosto.exe

pid process

1992 nosto.exe
1992 nosto.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1656 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

nosto.exenosto.exeguloxsjd.exeguloxsjd.exeexplorer.exenosto.exe

pid process

1992 nosto.exe
796 nosto.exe
796 nosto.exe
872 guloxsjd.exe
1824 guloxsjd.exe
1824 guloxsjd.exe
368 explorer.exe
368 explorer.exe
1672 nosto.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

guloxsjd.exe

pid process

872 guloxsjd.exe

pid	process
872	guloxsjd.exe
1824	guloxsjd.exe

pid	process
1992	nosto.exe
1992	nosto.exe

pid	process
1656	schtasks.exe

pid	process
1992	nosto.exe
796	nosto.exe
796	nosto.exe
872	guloxsjd.exe
1824	guloxsjd.exe
1824	guloxsjd.exe
368	explorer.exe
368	explorer.exe
1672	nosto.exe

pid	process
872	guloxsjd.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

nosto.exeguloxsjd.exetaskeng.exe

description	pid	process	target process
PID 1992 wrote to memory of 796	1992	nosto.exe	nosto.exe
PID 1992 wrote to memory of 796	1992	nosto.exe	nosto.exe
PID 1992 wrote to memory of 796	1992	nosto.exe	nosto.exe
PID 1992 wrote to memory of 796	1992	nosto.exe	nosto.exe
PID 1992 wrote to memory of 872	1992	nosto.exe	guloxsjd.exe
PID 1992 wrote to memory of 872	1992	nosto.exe	guloxsjd.exe
PID 1992 wrote to memory of 872	1992	nosto.exe	guloxsjd.exe
PID 1992 wrote to memory of 872	1992	nosto.exe	guloxsjd.exe
PID 1992 wrote to memory of 1656	1992	nosto.exe	schtasks.exe
PID 1992 wrote to memory of 1656	1992	nosto.exe	schtasks.exe
PID 1992 wrote to memory of 1656	1992	nosto.exe	schtasks.exe
PID 1992 wrote to memory of 1656	1992	nosto.exe	schtasks.exe
PID 872 wrote to memory of 1824	872	guloxsjd.exe	guloxsjd.exe
PID 872 wrote to memory of 1824	872	guloxsjd.exe	guloxsjd.exe
PID 872 wrote to memory of 1824	872	guloxsjd.exe	guloxsjd.exe
PID 872 wrote to memory of 1824	872	guloxsjd.exe	guloxsjd.exe
PID 872 wrote to memory of 368	872	guloxsjd.exe	explorer.exe
PID 872 wrote to memory of 368	872	guloxsjd.exe	explorer.exe
PID 872 wrote to memory of 368	872	guloxsjd.exe	explorer.exe
PID 872 wrote to memory of 368	872	guloxsjd.exe	explorer.exe
PID 872 wrote to memory of 368	872	guloxsjd.exe	explorer.exe
PID 328 wrote to memory of 1672	328	taskeng.exe	nosto.exe
PID 328 wrote to memory of 1672	328	taskeng.exe	nosto.exe
PID 328 wrote to memory of 1672	328	taskeng.exe	nosto.exe
PID 328 wrote to memory of 1672	328	taskeng.exe	nosto.exe

C:\Users\Admin\AppData\Local\Temp\nosto.exe
"C:\Users\Admin\AppData\Local\Temp\nosto.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992

C:\Users\Admin\AppData\Local\Temp\nosto.exe
C:\Users\Admin\AppData\Local\Temp\nosto.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:796

C:\Users\Admin\AppData\Roaming\Microsoft\Lveqazndyy\guloxsjd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Lveqazndyy\guloxsjd.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:872

C:\Users\Admin\AppData\Roaming\Microsoft\Lveqazndyy\guloxsjd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Lveqazndyy\guloxsjd.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1824

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:368

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yscdasrdfw /tr "\"C:\Users\Admin\AppData\Local\Temp\nosto.exe\" /I yscdasrdfw" /SC ONCE /Z /ST 09:19 /ET 09:31
2⤵
- Creates scheduled task(s)
PID:1656

C:\Windows\system32\taskeng.exe
taskeng.exe {FC4192AE-54FF-4723-885C-0EF58C0C1059} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:328

C:\Users\Admin\AppData\Local\Temp\nosto.exe
C:\Users\Admin\AppData\Local\Temp\nosto.exe /I yscdasrdfw
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1672

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Lveqazndyy\guloxsjd.dat
MD5
c1bbdf1f3ab0ba87ab2af4c91c90ffc2

SHA1
45badd7b70d9722e0a92233d93277ddf8e21329e

SHA256
0288119280a9f9cbf91c0aa397e47f7312d3ac0b8b78019271aa93ed5089910a

SHA512
ae56366e69d73fef7f97e9367c99907a20e6053a0bb0a525fbb4f732ebfbadcd043cdde7d0b0ad80437c6ccff65ec270e5e94989e8a53b855097a8b00a6bd2e4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lveqazndyy\guloxsjd.exe
MD5
c5b92b47eeb6372edb232deae1bf47d7

SHA1
7034a52f0ebc2fd0b38c130b229902e33a02c5ed

SHA256
6f5801587baf461e5a67f49bc6f4b400a8f458dc223f4d3ec9e2eafd9b062f5f

SHA512
e82535143ad12e85ee58b515c536f43a60c6324b79bfad304ac9f19c77ebb6eabd1604cf5d7fb0b8f7bb557ca2cfa11d564bf1d86063c662f3b124eb9c31f9ce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lveqazndyy\guloxsjd.exe
MD5
c5b92b47eeb6372edb232deae1bf47d7

SHA1
7034a52f0ebc2fd0b38c130b229902e33a02c5ed

SHA256
6f5801587baf461e5a67f49bc6f4b400a8f458dc223f4d3ec9e2eafd9b062f5f

SHA512
e82535143ad12e85ee58b515c536f43a60c6324b79bfad304ac9f19c77ebb6eabd1604cf5d7fb0b8f7bb557ca2cfa11d564bf1d86063c662f3b124eb9c31f9ce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lveqazndyy\guloxsjd.exe
MD5
c5b92b47eeb6372edb232deae1bf47d7

SHA1
7034a52f0ebc2fd0b38c130b229902e33a02c5ed

SHA256
6f5801587baf461e5a67f49bc6f4b400a8f458dc223f4d3ec9e2eafd9b062f5f

SHA512
e82535143ad12e85ee58b515c536f43a60c6324b79bfad304ac9f19c77ebb6eabd1604cf5d7fb0b8f7bb557ca2cfa11d564bf1d86063c662f3b124eb9c31f9ce

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Lveqazndyy\guloxsjd.exe
MD5
c5b92b47eeb6372edb232deae1bf47d7

SHA1
7034a52f0ebc2fd0b38c130b229902e33a02c5ed

SHA256
6f5801587baf461e5a67f49bc6f4b400a8f458dc223f4d3ec9e2eafd9b062f5f

SHA512
e82535143ad12e85ee58b515c536f43a60c6324b79bfad304ac9f19c77ebb6eabd1604cf5d7fb0b8f7bb557ca2cfa11d564bf1d86063c662f3b124eb9c31f9ce

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Lveqazndyy\guloxsjd.exe
MD5
c5b92b47eeb6372edb232deae1bf47d7

SHA1
7034a52f0ebc2fd0b38c130b229902e33a02c5ed

SHA256
6f5801587baf461e5a67f49bc6f4b400a8f458dc223f4d3ec9e2eafd9b062f5f

SHA512
e82535143ad12e85ee58b515c536f43a60c6324b79bfad304ac9f19c77ebb6eabd1604cf5d7fb0b8f7bb557ca2cfa11d564bf1d86063c662f3b124eb9c31f9ce

Download Submit
memory/368-13-0x0000000000000000-mapping.dmp

Download
memory/796-0-0x0000000000000000-mapping.dmp

Download
memory/796-1-0x0000000002A70000-0x0000000002A81000-memory.dmp

Filesize
68KB

Download
memory/872-12-0x0000000000390000-0x00000000003C7000-memory.dmp

Filesize
220KB

Download
memory/872-4-0x0000000000000000-mapping.dmp

Download
memory/1656-6-0x0000000000000000-mapping.dmp

Download
memory/1672-15-0x0000000000000000-mapping.dmp

Download
memory/1824-11-0x00000000027C0000-0x00000000027D1000-memory.dmp

Filesize
68KB

Download
memory/1824-8-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads