qakbot | 112a64190b9a0f356880eebf05e195f4c16407032bf89fa843fd136da6f5d515

General

Target

sj.exe
Size

2.6MB
MD5

bce0df8721504d50f4497c0a0a2c090d
SHA1

2c5b190d19f0f58e156bd1b28434701cea09cc23
SHA256

112a64190b9a0f356880eebf05e195f4c16407032bf89fa843fd136da6f5d515
SHA512

8eca2571399782952e984b4d7c8f525a9c0092396ac8dc592d98acd0efdf2b6959a4b1272bcfb7e3a38060d269deabfd676b1fef2e830df3baab43e206d2f7fc
SSDEEP

12288:qlQq2wwLHqpVxTp5WK1QAPPAV/Ykfgn6ggKh:u2wwT45xQwkfg93h

Score

10^/10

qakbot spx143 1592482956 banker cryptone packer stealer trojan

Malware Config

Extracted

Family

qakbot

Version

324.142

Botnet

spx143

Campaign

1592482956

C2

39.36.254.179:995

24.139.132.70:443

24.202.42.48:2222

72.204.242.138:443

172.242.156.50:995

72.204.242.138:20

68.174.15.223:443

74.193.197.246:443

96.56.237.174:990

64.19.74.29:995

70.168.130.172:443

189.236.166.167:443

68.4.137.211:443

76.187.8.160:443

76.86.57.179:2222

73.226.220.56:443

67.250.184.157:443

75.183.171.155:3389

173.172.205.216:443

173.3.132.17:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

CryptOne packer 6 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Microsoft\Tsubv\jmutsmtv.exe	cryptone
\Users\Admin\AppData\Roaming\Microsoft\Tsubv\jmutsmtv.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Tsubv\jmutsmtv.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Tsubv\jmutsmtv.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Tsubv\jmutsmtv.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Tsubv\jmutsmtv.exe	cryptone

Executes dropped EXE 2 IoCs

Processes:

jmutsmtv.exejmutsmtv.exe

pid process

740 jmutsmtv.exe
1724 jmutsmtv.exe
Loads dropped DLL 2 IoCs

Processes:

sj.exe

pid process

2016 sj.exe
2016 sj.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1204 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

sj.exesj.exejmutsmtv.exejmutsmtv.exeexplorer.exeexplorer.exemobsync.exe

pid process

2016 sj.exe
1988 sj.exe
1988 sj.exe
740 jmutsmtv.exe
1724 jmutsmtv.exe
1724 jmutsmtv.exe
1316 explorer.exe
744 explorer.exe
1236 mobsync.exe
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

jmutsmtv.exe

pid process

740 jmutsmtv.exe
740 jmutsmtv.exe
740 jmutsmtv.exe

pid	process
740	jmutsmtv.exe
1724	jmutsmtv.exe

pid	process
2016	sj.exe
2016	sj.exe

pid	process
1204	schtasks.exe

pid	process
2016	sj.exe
1988	sj.exe
1988	sj.exe
740	jmutsmtv.exe
1724	jmutsmtv.exe
1724	jmutsmtv.exe
1316	explorer.exe
744	explorer.exe
1236	mobsync.exe

pid	process
740	jmutsmtv.exe
740	jmutsmtv.exe
740	jmutsmtv.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

sj.exejmutsmtv.exe

description	pid	process	target process
PID 2016 wrote to memory of 1988	2016	sj.exe	sj.exe
PID 2016 wrote to memory of 1988	2016	sj.exe	sj.exe
PID 2016 wrote to memory of 1988	2016	sj.exe	sj.exe
PID 2016 wrote to memory of 1988	2016	sj.exe	sj.exe
PID 2016 wrote to memory of 740	2016	sj.exe	jmutsmtv.exe
PID 2016 wrote to memory of 740	2016	sj.exe	jmutsmtv.exe
PID 2016 wrote to memory of 740	2016	sj.exe	jmutsmtv.exe
PID 2016 wrote to memory of 740	2016	sj.exe	jmutsmtv.exe
PID 2016 wrote to memory of 1204	2016	sj.exe	schtasks.exe
PID 2016 wrote to memory of 1204	2016	sj.exe	schtasks.exe
PID 2016 wrote to memory of 1204	2016	sj.exe	schtasks.exe
PID 2016 wrote to memory of 1204	2016	sj.exe	schtasks.exe
PID 740 wrote to memory of 1724	740	jmutsmtv.exe	jmutsmtv.exe
PID 740 wrote to memory of 1724	740	jmutsmtv.exe	jmutsmtv.exe
PID 740 wrote to memory of 1724	740	jmutsmtv.exe	jmutsmtv.exe
PID 740 wrote to memory of 1724	740	jmutsmtv.exe	jmutsmtv.exe
PID 740 wrote to memory of 1316	740	jmutsmtv.exe	explorer.exe
PID 740 wrote to memory of 1316	740	jmutsmtv.exe	explorer.exe
PID 740 wrote to memory of 1316	740	jmutsmtv.exe	explorer.exe
PID 740 wrote to memory of 1316	740	jmutsmtv.exe	explorer.exe
PID 740 wrote to memory of 1316	740	jmutsmtv.exe	explorer.exe
PID 740 wrote to memory of 744	740	jmutsmtv.exe	explorer.exe
PID 740 wrote to memory of 744	740	jmutsmtv.exe	explorer.exe
PID 740 wrote to memory of 744	740	jmutsmtv.exe	explorer.exe
PID 740 wrote to memory of 744	740	jmutsmtv.exe	explorer.exe
PID 740 wrote to memory of 744	740	jmutsmtv.exe	explorer.exe
PID 740 wrote to memory of 1236	740	jmutsmtv.exe	mobsync.exe
PID 740 wrote to memory of 1236	740	jmutsmtv.exe	mobsync.exe
PID 740 wrote to memory of 1236	740	jmutsmtv.exe	mobsync.exe
PID 740 wrote to memory of 1236	740	jmutsmtv.exe	mobsync.exe
PID 740 wrote to memory of 1236	740	jmutsmtv.exe	mobsync.exe

C:\Users\Admin\AppData\Local\Temp\sj.exe
"C:\Users\Admin\AppData\Local\Temp\sj.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\AppData\Local\Temp\sj.exe
C:\Users\Admin\AppData\Local\Temp\sj.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1988

C:\Users\Admin\AppData\Roaming\Microsoft\Tsubv\jmutsmtv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Tsubv\jmutsmtv.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:740

C:\Users\Admin\AppData\Roaming\Microsoft\Tsubv\jmutsmtv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Tsubv\jmutsmtv.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1724

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1316

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:744

C:\Windows\SysWOW64\mobsync.exe
C:\Windows\SysWOW64\mobsync.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1236

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cccleozz /tr "\"C:\Users\Admin\AppData\Local\Temp\sj.exe\" /I cccleozz" /SC ONCE /Z /ST 19:47 /ET 19:59
2⤵
- Creates scheduled task(s)
PID:1204

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Tsubv\jmutsmtv.exe
Filesize
2.6MB

MD5
bce0df8721504d50f4497c0a0a2c090d

SHA1
2c5b190d19f0f58e156bd1b28434701cea09cc23

SHA256
112a64190b9a0f356880eebf05e195f4c16407032bf89fa843fd136da6f5d515

SHA512
8eca2571399782952e984b4d7c8f525a9c0092396ac8dc592d98acd0efdf2b6959a4b1272bcfb7e3a38060d269deabfd676b1fef2e830df3baab43e206d2f7fc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Tsubv\jmutsmtv.exe
Filesize
2.6MB

MD5
bce0df8721504d50f4497c0a0a2c090d

SHA1
2c5b190d19f0f58e156bd1b28434701cea09cc23

SHA256
112a64190b9a0f356880eebf05e195f4c16407032bf89fa843fd136da6f5d515

SHA512
8eca2571399782952e984b4d7c8f525a9c0092396ac8dc592d98acd0efdf2b6959a4b1272bcfb7e3a38060d269deabfd676b1fef2e830df3baab43e206d2f7fc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Tsubv\jmutsmtv.exe
Filesize
2.6MB

MD5
bce0df8721504d50f4497c0a0a2c090d

SHA1
2c5b190d19f0f58e156bd1b28434701cea09cc23

SHA256
112a64190b9a0f356880eebf05e195f4c16407032bf89fa843fd136da6f5d515

SHA512
8eca2571399782952e984b4d7c8f525a9c0092396ac8dc592d98acd0efdf2b6959a4b1272bcfb7e3a38060d269deabfd676b1fef2e830df3baab43e206d2f7fc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Tsubv\jmutsmtv.exe
Filesize
2.6MB

MD5
bce0df8721504d50f4497c0a0a2c090d

SHA1
2c5b190d19f0f58e156bd1b28434701cea09cc23

SHA256
112a64190b9a0f356880eebf05e195f4c16407032bf89fa843fd136da6f5d515

SHA512
8eca2571399782952e984b4d7c8f525a9c0092396ac8dc592d98acd0efdf2b6959a4b1272bcfb7e3a38060d269deabfd676b1fef2e830df3baab43e206d2f7fc

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Tsubv\jmutsmtv.exe
Filesize
2.6MB

MD5
bce0df8721504d50f4497c0a0a2c090d

SHA1
2c5b190d19f0f58e156bd1b28434701cea09cc23

SHA256
112a64190b9a0f356880eebf05e195f4c16407032bf89fa843fd136da6f5d515

SHA512
8eca2571399782952e984b4d7c8f525a9c0092396ac8dc592d98acd0efdf2b6959a4b1272bcfb7e3a38060d269deabfd676b1fef2e830df3baab43e206d2f7fc

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Tsubv\jmutsmtv.exe
Filesize
2.6MB

MD5
bce0df8721504d50f4497c0a0a2c090d

SHA1
2c5b190d19f0f58e156bd1b28434701cea09cc23

SHA256
112a64190b9a0f356880eebf05e195f4c16407032bf89fa843fd136da6f5d515

SHA512
8eca2571399782952e984b4d7c8f525a9c0092396ac8dc592d98acd0efdf2b6959a4b1272bcfb7e3a38060d269deabfd676b1fef2e830df3baab43e206d2f7fc

Download Submit
memory/740-78-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/740-86-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/740-75-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/744-87-0x0000000000080000-0x00000000000BA000-memory.dmp

Filesize
232KB

Download
memory/744-88-0x00000000005A0000-0x00000000005D3000-memory.dmp

Filesize
204KB

Download
memory/1236-90-0x0000000000120000-0x000000000015A000-memory.dmp

Filesize
232KB

Download
memory/1236-91-0x00000000001D0000-0x0000000000203000-memory.dmp

Filesize
204KB

Download
memory/1316-84-0x0000000000080000-0x00000000000BA000-memory.dmp

Filesize
232KB

Download
memory/1316-85-0x0000000000180000-0x00000000001B3000-memory.dmp

Filesize
204KB

Download
memory/1724-79-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/1724-83-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/1988-62-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/1988-58-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/2016-74-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/2016-65-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/2016-54-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/2016-57-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/2016-56-0x0000000000400000-0x00000000006A6000-memory.dmp

Filesize
2.6MB

Download
memory/2016-55-0x0000000000220000-0x0000000000257000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads