qakbot | ae3c8cc59fa270b406f4dc7cfed2fc45677a745ce4465d04c98b915edc16a899

General

Target

sample_1.exe
Size

520KB
MD5

15c181df90fd532443e7cbbd9335241c
SHA1

fbc16d6ae1a8c2a1910f4b544b2d2e17c5d762f3
SHA256

ae3c8cc59fa270b406f4dc7cfed2fc45677a745ce4465d04c98b915edc16a899
SHA512

c8e46beb7b300036b796cb0e0da185a2ca8bb320fda976bf855d2a71ea20b66e4e9a8c0d269d21ae6dbb4ac401ebcb7022f2ba85104741dea78eaf3aedc9fd0d

Score

10^/10

qakbot spx114 1588852466 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

324.141

Botnet

spx114

Campaign

1588852466

C2

72.196.114.129:443

69.88.211.123:443

47.232.26.181:443

173.172.205.216:443

72.36.59.46:2222

208.126.142.17:443

184.98.104.7:995

72.204.242.138:6881

50.244.112.106:443

47.214.144.253:443

5.182.39.156:443

47.146.169.85:443

73.210.114.187:443

77.159.149.74:443

71.80.66.107:443

31.5.189.71:443

73.163.242.114:443

74.56.167.31:443

24.110.96.149:443

172.78.87.180:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

sample_1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	sample_1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	sample_1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	sample_1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	sample_1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	sample_1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	sample_1.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

sample_1.exesample_1.exe

pid process

716 sample_1.exe
716 sample_1.exe
3564 sample_1.exe
3564 sample_1.exe
3564 sample_1.exe
3564 sample_1.exe
3564 sample_1.exe
3564 sample_1.exe

pid	process
716	sample_1.exe
716	sample_1.exe
3564	sample_1.exe
3564	sample_1.exe
3564	sample_1.exe
3564	sample_1.exe
3564	sample_1.exe
3564	sample_1.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

sample_1.exe

description	pid	process	target process
PID 716 wrote to memory of 3564	716	sample_1.exe	sample_1.exe
PID 716 wrote to memory of 3564	716	sample_1.exe	sample_1.exe
PID 716 wrote to memory of 3564	716	sample_1.exe	sample_1.exe

C:\Users\Admin\AppData\Local\Temp\sample_1.exe
"C:\Users\Admin\AppData\Local\Temp\sample_1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:716

C:\Users\Admin\AppData\Local\Temp\sample_1.exe
C:\Users\Admin\AppData\Local\Temp\sample_1.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3564

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/716-116-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/716-115-0x00000000004E0000-0x0000000000517000-memory.dmp

Filesize
220KB

Download
memory/3564-117-0x0000000000000000-mapping.dmp

Download
memory/3564-119-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3564-118-0x0000000000490000-0x00000000005DA000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing