qakbot | f87b5e13cd21c82b7f719060459462f23c9781bd869109c22ecbb40a623cb05d

General

Target

ahozoma.exe
Size

346KB
MD5

05acdb1f87143d3cbfb43459a75e3044
SHA1

17cab0abb42b241d96d2ae037a443c26f9db7a2b
SHA256

f87b5e13cd21c82b7f719060459462f23c9781bd869109c22ecbb40a623cb05d
SHA512

6aa53ee3a52fbd1bbd1fa448ca592f0e0be550b636bf524eee0e5bacca0427a6a5f9c4953d5fc2593f7d3584002508ced6dee86265f6402428a79620cd89d73e

Score

10^/10

qakbot notset 1596817234 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.42

Botnet

notset

Campaign

1596817234

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

47.44.217.98:443

86.97.146.204:2222

65.60.228.130:443

216.201.162.158:443

94.59.24.79:995

108.46.145.30:443

24.139.132.70:443

47.206.174.82:443

188.52.106.206:20

72.204.242.138:6881

173.173.72.199:443

71.163.224.206:443

63.155.9.141:995

100.34.195.237:443

47.39.177.171:2222

96.20.108.17:2222

115.21.224.117:443

70.164.39.91:443

45.47.65.191:443

207.155.107.111:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

vvjsaxr.exevvjsaxr.exe

pid process

3168 vvjsaxr.exe
1464 vvjsaxr.exe

pid	process
3168	vvjsaxr.exe
1464	vvjsaxr.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vvjsaxr.exeahozoma.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	vvjsaxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	ahozoma.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	ahozoma.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	ahozoma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	vvjsaxr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	vvjsaxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	vvjsaxr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	vvjsaxr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	vvjsaxr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	ahozoma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	ahozoma.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	ahozoma.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1848 schtasks.exe

pid	process
1848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

ahozoma.exeahozoma.exevvjsaxr.exevvjsaxr.exeexplorer.exeahozoma.exe

pid	process
808	ahozoma.exe
808	ahozoma.exe
1148	ahozoma.exe
1148	ahozoma.exe
1148	ahozoma.exe
1148	ahozoma.exe
3168	vvjsaxr.exe
3168	vvjsaxr.exe
1464	vvjsaxr.exe
1464	vvjsaxr.exe
1464	vvjsaxr.exe
1464	vvjsaxr.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
3112	ahozoma.exe
3112	ahozoma.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

vvjsaxr.exe

pid process

3168 vvjsaxr.exe

pid	process
3168	vvjsaxr.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

ahozoma.exevvjsaxr.exe

description	pid	process	target process
PID 808 wrote to memory of 1148	808	ahozoma.exe	ahozoma.exe
PID 808 wrote to memory of 1148	808	ahozoma.exe	ahozoma.exe
PID 808 wrote to memory of 1148	808	ahozoma.exe	ahozoma.exe
PID 808 wrote to memory of 3168	808	ahozoma.exe	vvjsaxr.exe
PID 808 wrote to memory of 3168	808	ahozoma.exe	vvjsaxr.exe
PID 808 wrote to memory of 3168	808	ahozoma.exe	vvjsaxr.exe
PID 808 wrote to memory of 1848	808	ahozoma.exe	schtasks.exe
PID 808 wrote to memory of 1848	808	ahozoma.exe	schtasks.exe
PID 808 wrote to memory of 1848	808	ahozoma.exe	schtasks.exe
PID 3168 wrote to memory of 1464	3168	vvjsaxr.exe	vvjsaxr.exe
PID 3168 wrote to memory of 1464	3168	vvjsaxr.exe	vvjsaxr.exe
PID 3168 wrote to memory of 1464	3168	vvjsaxr.exe	vvjsaxr.exe
PID 3168 wrote to memory of 2700	3168	vvjsaxr.exe	explorer.exe
PID 3168 wrote to memory of 2700	3168	vvjsaxr.exe	explorer.exe
PID 3168 wrote to memory of 2700	3168	vvjsaxr.exe	explorer.exe
PID 3168 wrote to memory of 2700	3168	vvjsaxr.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\ahozoma.exe
"C:\Users\Admin\AppData\Local\Temp\ahozoma.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:808

C:\Users\Admin\AppData\Local\Temp\ahozoma.exe
C:\Users\Admin\AppData\Local\Temp\ahozoma.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1148

C:\Users\Admin\AppData\Roaming\Microsoft\Kbxmkg\vvjsaxr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Kbxmkg\vvjsaxr.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3168

C:\Users\Admin\AppData\Roaming\Microsoft\Kbxmkg\vvjsaxr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Kbxmkg\vvjsaxr.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1464

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2700

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn axyagkao /tr "\"C:\Users\Admin\AppData\Local\Temp\ahozoma.exe\" /I axyagkao" /SC ONCE /Z /ST 17:47 /ET 17:59
2⤵
- Creates scheduled task(s)
PID:1848

C:\Users\Admin\AppData\Local\Temp\ahozoma.exe
C:\Users\Admin\AppData\Local\Temp\ahozoma.exe /I axyagkao
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3112

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Kbxmkg\vvjsaxr.dat
MD5
c608e9df539a23d5738845676a4f1924

SHA1
0d98789938c663d9009002553beca797317e158b

SHA256
f39f2caf5bfeb61430c596c3b5ba85f409dfec8b09ee8bb56724b32edbadfde5

SHA512
7cab51be84a2c4fbfd435cf1458197920e9a374ba06cfa25f23558667f159a6ca95e54396900cf200342de58e1affd4c6e21fef8b18f30ddbac5fc816bfcbe47

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Kbxmkg\vvjsaxr.exe
MD5
05acdb1f87143d3cbfb43459a75e3044

SHA1
17cab0abb42b241d96d2ae037a443c26f9db7a2b

SHA256
f87b5e13cd21c82b7f719060459462f23c9781bd869109c22ecbb40a623cb05d

SHA512
6aa53ee3a52fbd1bbd1fa448ca592f0e0be550b636bf524eee0e5bacca0427a6a5f9c4953d5fc2593f7d3584002508ced6dee86265f6402428a79620cd89d73e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Kbxmkg\vvjsaxr.exe
MD5
05acdb1f87143d3cbfb43459a75e3044

SHA1
17cab0abb42b241d96d2ae037a443c26f9db7a2b

SHA256
f87b5e13cd21c82b7f719060459462f23c9781bd869109c22ecbb40a623cb05d

SHA512
6aa53ee3a52fbd1bbd1fa448ca592f0e0be550b636bf524eee0e5bacca0427a6a5f9c4953d5fc2593f7d3584002508ced6dee86265f6402428a79620cd89d73e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Kbxmkg\vvjsaxr.exe
MD5
05acdb1f87143d3cbfb43459a75e3044

SHA1
17cab0abb42b241d96d2ae037a443c26f9db7a2b

SHA256
f87b5e13cd21c82b7f719060459462f23c9781bd869109c22ecbb40a623cb05d

SHA512
6aa53ee3a52fbd1bbd1fa448ca592f0e0be550b636bf524eee0e5bacca0427a6a5f9c4953d5fc2593f7d3584002508ced6dee86265f6402428a79620cd89d73e

Download Submit
memory/808-115-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/808-114-0x00000000006D0000-0x0000000000714000-memory.dmp

Filesize
272KB

Download
memory/1148-116-0x0000000000000000-mapping.dmp

Download
memory/1464-125-0x0000000000000000-mapping.dmp

Download
memory/1848-122-0x0000000000000000-mapping.dmp

Download
memory/2700-129-0x0000000000000000-mapping.dmp

Download
memory/2700-130-0x0000000000A60000-0x0000000000AA7000-memory.dmp

Filesize
284KB

Download
memory/2700-131-0x0000000003290000-0x00000000033C6000-memory.dmp

Filesize
1.2MB

Download
memory/3112-133-0x0000000000460000-0x00000000005AA000-memory.dmp

Filesize
1.3MB

Download
memory/3168-123-0x0000000000460000-0x00000000005AA000-memory.dmp

Filesize
1.3MB

Download
memory/3168-119-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads