qakbot | f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

Resubmissions

20-03-2023 20:10

230320-yx3gcafc24 10

20-03-2023 10:43

230320-msm1bafa5t 10

20-03-2023 10:23

230320-me3hvach68 10

18-03-2023 10:19

230318-mcwyaaea3z 10

Analysis

max time kernel
59s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-03-2023 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

quak.exe
Size

216KB
MD5

58e1c32eeb0130da19625e55ee48cf1e
SHA1

00ae1c5066f67e5e71285de99bea8d8b67085743
SHA256

f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790
SHA512

31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2
SSDEEP

3072:4FCXMfyhFPZ8H7kJiIceKozOMeNJwOUJCfUfWcxQvAKChQztvWZZOtyFb8e:lXPFP6HWriMeN2rJCyWVDhM55

Score

10^/10

qakbot spx143 1592482956 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

324.142

Botnet

spx143

Campaign

1592482956

39.36.254.179:995

24.139.132.70:443

24.202.42.48:2222

72.204.242.138:443

172.242.156.50:995

72.204.242.138:20

68.174.15.223:443

74.193.197.246:443

96.56.237.174:990

64.19.74.29:995

70.168.130.172:443

189.236.166.167:443

68.4.137.211:443

76.187.8.160:443

76.86.57.179:2222

73.226.220.56:443

67.250.184.157:443

75.183.171.155:3389

173.172.205.216:443

173.3.132.17:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

ueqokozi.exeueqokozi.exe

pid process

852 ueqokozi.exe
268 ueqokozi.exe
Loads dropped DLL 2 IoCs

Processes:

quak.exe

pid process

1212 quak.exe
1212 quak.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1144 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

quak.exequak.exeueqokozi.exeueqokozi.exe

pid process

1212 quak.exe
2040 quak.exe
2040 quak.exe
852 ueqokozi.exe
268 ueqokozi.exe

pid	process
852	ueqokozi.exe
268	ueqokozi.exe

pid	process
1212	quak.exe
1212	quak.exe

pid	process
1144	schtasks.exe

pid	process
1212	quak.exe
2040	quak.exe
2040	quak.exe
852	ueqokozi.exe
268	ueqokozi.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

quak.exeueqokozi.exe

description	pid	process	target process
PID 1212 wrote to memory of 2040	1212	quak.exe	quak.exe
PID 1212 wrote to memory of 2040	1212	quak.exe	quak.exe
PID 1212 wrote to memory of 2040	1212	quak.exe	quak.exe
PID 1212 wrote to memory of 2040	1212	quak.exe	quak.exe
PID 1212 wrote to memory of 852	1212	quak.exe	ueqokozi.exe
PID 1212 wrote to memory of 852	1212	quak.exe	ueqokozi.exe
PID 1212 wrote to memory of 852	1212	quak.exe	ueqokozi.exe
PID 1212 wrote to memory of 852	1212	quak.exe	ueqokozi.exe
PID 1212 wrote to memory of 1144	1212	quak.exe	schtasks.exe
PID 1212 wrote to memory of 1144	1212	quak.exe	schtasks.exe
PID 1212 wrote to memory of 1144	1212	quak.exe	schtasks.exe
PID 1212 wrote to memory of 1144	1212	quak.exe	schtasks.exe
PID 852 wrote to memory of 268	852	ueqokozi.exe	ueqokozi.exe
PID 852 wrote to memory of 268	852	ueqokozi.exe	ueqokozi.exe
PID 852 wrote to memory of 268	852	ueqokozi.exe	ueqokozi.exe
PID 852 wrote to memory of 268	852	ueqokozi.exe	ueqokozi.exe

C:\Users\Admin\AppData\Local\Temp\quak.exe
"C:\Users\Admin\AppData\Local\Temp\quak.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1212

C:\Users\Admin\AppData\Local\Temp\quak.exe
C:\Users\Admin\AppData\Local\Temp\quak.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040

C:\Users\Admin\AppData\Roaming\Microsoft\Vaaratqbea\ueqokozi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Vaaratqbea\ueqokozi.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:852

C:\Users\Admin\AppData\Roaming\Microsoft\Vaaratqbea\ueqokozi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Vaaratqbea\ueqokozi.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:268

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn oyhprrnxq /tr "\"C:\Users\Admin\AppData\Local\Temp\quak.exe\" /I oyhprrnxq" /SC ONCE /Z /ST 11:26 /ET 11:38
2⤵
- Creates scheduled task(s)
PID:1144

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Vaaratqbea\ueqokozi.exe
Filesize
216KB

MD5
58e1c32eeb0130da19625e55ee48cf1e

SHA1
00ae1c5066f67e5e71285de99bea8d8b67085743

SHA256
f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

SHA512
31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Vaaratqbea\ueqokozi.exe
Filesize
216KB

MD5
58e1c32eeb0130da19625e55ee48cf1e

SHA1
00ae1c5066f67e5e71285de99bea8d8b67085743

SHA256
f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

SHA512
31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Vaaratqbea\ueqokozi.exe
Filesize
216KB

MD5
58e1c32eeb0130da19625e55ee48cf1e

SHA1
00ae1c5066f67e5e71285de99bea8d8b67085743

SHA256
f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

SHA512
31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Vaaratqbea\ueqokozi.exe
Filesize
216KB

MD5
58e1c32eeb0130da19625e55ee48cf1e

SHA1
00ae1c5066f67e5e71285de99bea8d8b67085743

SHA256
f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

SHA512
31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Vaaratqbea\ueqokozi.exe
Filesize
216KB

MD5
58e1c32eeb0130da19625e55ee48cf1e

SHA1
00ae1c5066f67e5e71285de99bea8d8b67085743

SHA256
f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

SHA512
31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Vaaratqbea\ueqokozi.exe
Filesize
216KB

MD5
58e1c32eeb0130da19625e55ee48cf1e

SHA1
00ae1c5066f67e5e71285de99bea8d8b67085743

SHA256
f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

SHA512
31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads