qakbot | 3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033

General

Target

xyjsca.exe
Size

3.4MB
MD5

abddab5ff34dbfae92c8fca7a524a06f
SHA1

6deec6f703c76e34cd415e83e8a574ac2c97751d
SHA256

3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033
SHA512

29d5b76ccf268bd92d48f79c86c2b037a1fa95c72e0289bfe5d7396f87fe1c5ba0872bc9b15255591f379bab63eab0100b523fb5c7f12fdf0255eb7a01491298

Score

10^/10

qakbot notset 1596817234 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1596817234

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

47.44.217.98:443

86.97.146.204:2222

65.60.228.130:443

216.201.162.158:443

94.59.24.79:995

108.46.145.30:443

24.139.132.70:443

47.206.174.82:443

188.52.106.206:20

72.204.242.138:6881

173.173.72.199:443

71.163.224.206:443

63.155.9.141:995

100.34.195.237:443

47.39.177.171:2222

96.20.108.17:2222

115.21.224.117:443

70.164.39.91:443

45.47.65.191:443

207.155.107.111:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

ixllyf.exeixllyf.exe

pid process

1872 ixllyf.exe
2360 ixllyf.exe

pid	process
1872	ixllyf.exe
2360	ixllyf.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

xyjsca.exeixllyf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	xyjsca.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	xyjsca.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	xyjsca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	ixllyf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	ixllyf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	ixllyf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	ixllyf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	xyjsca.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	ixllyf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	ixllyf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	xyjsca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	xyjsca.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2452 schtasks.exe

pid	process
2452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

xyjsca.exexyjsca.exeixllyf.exeixllyf.exeexplorer.exe

pid	process
1032	xyjsca.exe
1032	xyjsca.exe
940	xyjsca.exe
940	xyjsca.exe
940	xyjsca.exe
940	xyjsca.exe
1872	ixllyf.exe
1872	ixllyf.exe
2360	ixllyf.exe
2360	ixllyf.exe
2360	ixllyf.exe
2360	ixllyf.exe
812	explorer.exe
812	explorer.exe
812	explorer.exe
812	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ixllyf.exe

pid process

1872 ixllyf.exe

pid	process
1872	ixllyf.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

xyjsca.exeixllyf.exe

description	pid	process	target process
PID 1032 wrote to memory of 940	1032	xyjsca.exe	xyjsca.exe
PID 1032 wrote to memory of 940	1032	xyjsca.exe	xyjsca.exe
PID 1032 wrote to memory of 940	1032	xyjsca.exe	xyjsca.exe
PID 1032 wrote to memory of 1872	1032	xyjsca.exe	ixllyf.exe
PID 1032 wrote to memory of 1872	1032	xyjsca.exe	ixllyf.exe
PID 1032 wrote to memory of 1872	1032	xyjsca.exe	ixllyf.exe
PID 1032 wrote to memory of 2452	1032	xyjsca.exe	schtasks.exe
PID 1032 wrote to memory of 2452	1032	xyjsca.exe	schtasks.exe
PID 1032 wrote to memory of 2452	1032	xyjsca.exe	schtasks.exe
PID 1872 wrote to memory of 2360	1872	ixllyf.exe	ixllyf.exe
PID 1872 wrote to memory of 2360	1872	ixllyf.exe	ixllyf.exe
PID 1872 wrote to memory of 2360	1872	ixllyf.exe	ixllyf.exe
PID 1872 wrote to memory of 812	1872	ixllyf.exe	explorer.exe
PID 1872 wrote to memory of 812	1872	ixllyf.exe	explorer.exe
PID 1872 wrote to memory of 812	1872	ixllyf.exe	explorer.exe
PID 1872 wrote to memory of 812	1872	ixllyf.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\xyjsca.exe
"C:\Users\Admin\AppData\Local\Temp\xyjsca.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1032

C:\Users\Admin\AppData\Local\Temp\xyjsca.exe
C:\Users\Admin\AppData\Local\Temp\xyjsca.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:940

C:\Users\Admin\AppData\Roaming\Microsoft\Mfyprkyioch\ixllyf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Mfyprkyioch\ixllyf.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1872

C:\Users\Admin\AppData\Roaming\Microsoft\Mfyprkyioch\ixllyf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Mfyprkyioch\ixllyf.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:2360

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:812

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hrslanbnsu /tr "\"C:\Users\Admin\AppData\Local\Temp\xyjsca.exe\" /I hrslanbnsu" /SC ONCE /Z /ST 16:01 /ET 16:13
2⤵
- Creates scheduled task(s)
PID:2452

C:\Users\Admin\AppData\Local\Temp\xyjsca.exe
C:\Users\Admin\AppData\Local\Temp\xyjsca.exe /I hrslanbnsu
1⤵
PID:668

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Mfyprkyioch\ixllyf.dat
MD5
8b098c5c9d40d138ba4369285675c784

SHA1
6442e2d9ceda25e30bf93777d3a9a8da9f027348

SHA256
abad6007f48c7b34e4e5ad28062b3b5c1c7e826e51eae540ab739302d384b3ae

SHA512
819de11c6836e202d6056720bfdd42818495b6f196791119053ca097deab72f5cfa8a6cba4376e3cdc8e33b01a0ed5489de967faf6639c1fc3d567b2cfe1c705

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Mfyprkyioch\ixllyf.exe
MD5
abddab5ff34dbfae92c8fca7a524a06f

SHA1
6deec6f703c76e34cd415e83e8a574ac2c97751d

SHA256
3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033

SHA512
29d5b76ccf268bd92d48f79c86c2b037a1fa95c72e0289bfe5d7396f87fe1c5ba0872bc9b15255591f379bab63eab0100b523fb5c7f12fdf0255eb7a01491298

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Mfyprkyioch\ixllyf.exe
MD5
abddab5ff34dbfae92c8fca7a524a06f

SHA1
6deec6f703c76e34cd415e83e8a574ac2c97751d

SHA256
3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033

SHA512
29d5b76ccf268bd92d48f79c86c2b037a1fa95c72e0289bfe5d7396f87fe1c5ba0872bc9b15255591f379bab63eab0100b523fb5c7f12fdf0255eb7a01491298

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Mfyprkyioch\ixllyf.exe
MD5
abddab5ff34dbfae92c8fca7a524a06f

SHA1
6deec6f703c76e34cd415e83e8a574ac2c97751d

SHA256
3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033

SHA512
29d5b76ccf268bd92d48f79c86c2b037a1fa95c72e0289bfe5d7396f87fe1c5ba0872bc9b15255591f379bab63eab0100b523fb5c7f12fdf0255eb7a01491298

Download Submit
memory/812-19-0x0000000000000000-mapping.dmp

Download
memory/812-21-0x0000000003410000-0x0000000003447000-memory.dmp

Filesize
220KB

Download
memory/812-20-0x0000000000CD0000-0x0000000000D17000-memory.dmp

Filesize
284KB

Download
memory/940-7-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/940-4-0x0000000000000000-mapping.dmp

Download
memory/1032-2-0x0000000002490000-0x00000000024D4000-memory.dmp

Filesize
272KB

Download
memory/1032-3-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1872-8-0x0000000000000000-mapping.dmp

Download
memory/2360-14-0x0000000000000000-mapping.dmp

Download
memory/2360-18-0x0000000002A20000-0x0000000002A21000-memory.dmp

Filesize
4KB

Download
memory/2452-11-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads