qakbot | f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

General

Target

quak.exe
Size

216KB
MD5

58e1c32eeb0130da19625e55ee48cf1e
SHA1

00ae1c5066f67e5e71285de99bea8d8b67085743
SHA256

f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790
SHA512

31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2
SSDEEP

3072:4FCXMfyhFPZ8H7kJiIceKozOMeNJwOUJCfUfWcxQvAKChQztvWZZOtyFb8e:lXPFP6HWriMeN2rJCyWVDhM55

Score

10^/10

qakbot spx143 1592482956 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

324.142

Botnet

spx143

Campaign

1592482956

C2

39.36.254.179:995

24.139.132.70:443

24.202.42.48:2222

72.204.242.138:443

172.242.156.50:995

72.204.242.138:20

68.174.15.223:443

74.193.197.246:443

96.56.237.174:990

64.19.74.29:995

70.168.130.172:443

189.236.166.167:443

68.4.137.211:443

76.187.8.160:443

76.86.57.179:2222

73.226.220.56:443

67.250.184.157:443

75.183.171.155:3389

173.172.205.216:443

173.3.132.17:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

qbqgaf.exeqbqgaf.exe

pid process

4328 qbqgaf.exe
4592 qbqgaf.exe

pid	process
4328	qbqgaf.exe
4592	qbqgaf.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

quak.exeqbqgaf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	quak.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	qbqgaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	qbqgaf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	qbqgaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	qbqgaf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	qbqgaf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	qbqgaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	quak.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	quak.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	quak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	quak.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	quak.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1600 schtasks.exe

pid	process
1600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

quak.exequak.exeqbqgaf.exeqbqgaf.exeexplorer.exe

pid	process
3760	quak.exe
3760	quak.exe
540	quak.exe
540	quak.exe
540	quak.exe
540	quak.exe
4328	qbqgaf.exe
4328	qbqgaf.exe
4592	qbqgaf.exe
4592	qbqgaf.exe
4592	qbqgaf.exe
4592	qbqgaf.exe
3496	explorer.exe
3496	explorer.exe
3496	explorer.exe
3496	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

qbqgaf.exe

pid process

4328 qbqgaf.exe

pid	process
4328	qbqgaf.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

quak.exeqbqgaf.exe

description	pid	process	target process
PID 3760 wrote to memory of 540	3760	quak.exe	quak.exe
PID 3760 wrote to memory of 540	3760	quak.exe	quak.exe
PID 3760 wrote to memory of 540	3760	quak.exe	quak.exe
PID 3760 wrote to memory of 4328	3760	quak.exe	qbqgaf.exe
PID 3760 wrote to memory of 4328	3760	quak.exe	qbqgaf.exe
PID 3760 wrote to memory of 4328	3760	quak.exe	qbqgaf.exe
PID 3760 wrote to memory of 1600	3760	quak.exe	schtasks.exe
PID 3760 wrote to memory of 1600	3760	quak.exe	schtasks.exe
PID 3760 wrote to memory of 1600	3760	quak.exe	schtasks.exe
PID 4328 wrote to memory of 4592	4328	qbqgaf.exe	qbqgaf.exe
PID 4328 wrote to memory of 4592	4328	qbqgaf.exe	qbqgaf.exe
PID 4328 wrote to memory of 4592	4328	qbqgaf.exe	qbqgaf.exe
PID 4328 wrote to memory of 3496	4328	qbqgaf.exe	explorer.exe
PID 4328 wrote to memory of 3496	4328	qbqgaf.exe	explorer.exe
PID 4328 wrote to memory of 3496	4328	qbqgaf.exe	explorer.exe
PID 4328 wrote to memory of 3496	4328	qbqgaf.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\quak.exe
"C:\Users\Admin\AppData\Local\Temp\quak.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3760

C:\Users\Admin\AppData\Local\Temp\quak.exe
C:\Users\Admin\AppData\Local\Temp\quak.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:540

C:\Users\Admin\AppData\Roaming\Microsoft\Muqjaoqm\qbqgaf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Muqjaoqm\qbqgaf.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4328

C:\Users\Admin\AppData\Roaming\Microsoft\Muqjaoqm\qbqgaf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Muqjaoqm\qbqgaf.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:4592

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3496

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ysellaluhr /tr "\"C:\Users\Admin\AppData\Local\Temp\quak.exe\" /I ysellaluhr" /SC ONCE /Z /ST 11:46 /ET 11:58
2⤵
- Creates scheduled task(s)
PID:1600

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Muqjaoqm\qbqgaf.dat
Filesize
63B

MD5
093f6c587c04cbd5e2099fe676d3b0d8

SHA1
0295dc2818f5c8609c1297e15d8f205fcee2e74f

SHA256
bdd55b0f5fc4fda04ddb498c4533e11bc1c677ac77fbf20b6a58b4f6b99338bb

SHA512
1d72a3c5475e6147d0c9c3be6a8c130d6af23706602e15697cf28bd65372775d2e7498cab1029f9bfbf7afd201cd76d56ee1fea006dec6a6a486e10a25957a8f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Muqjaoqm\qbqgaf.exe
Filesize
216KB

MD5
58e1c32eeb0130da19625e55ee48cf1e

SHA1
00ae1c5066f67e5e71285de99bea8d8b67085743

SHA256
f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

SHA512
31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Muqjaoqm\qbqgaf.exe
Filesize
216KB

MD5
58e1c32eeb0130da19625e55ee48cf1e

SHA1
00ae1c5066f67e5e71285de99bea8d8b67085743

SHA256
f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

SHA512
31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Muqjaoqm\qbqgaf.exe
Filesize
216KB

MD5
58e1c32eeb0130da19625e55ee48cf1e

SHA1
00ae1c5066f67e5e71285de99bea8d8b67085743

SHA256
f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

SHA512
31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2

Download Submit
memory/3496-140-0x0000000000AD0000-0x0000000000B0A000-memory.dmp

Filesize
232KB

Download
memory/3496-141-0x0000000000EB0000-0x0000000000EE3000-memory.dmp

Filesize
204KB

Download
memory/3496-142-0x0000000000EB0000-0x0000000000EE3000-memory.dmp

Filesize
204KB

Download
memory/3496-144-0x0000000000EB0000-0x0000000000EE3000-memory.dmp

Filesize
204KB

Download
memory/3496-145-0x0000000000EB0000-0x0000000000EE3000-memory.dmp

Filesize
204KB

Download
memory/3496-147-0x0000000000EB0000-0x0000000000EE3000-memory.dmp

Filesize
204KB

Download
memory/3496-150-0x0000000000AD0000-0x0000000000B0A000-memory.dmp

Filesize
232KB

Download
memory/3496-151-0x0000000000EB0000-0x0000000000EE3000-memory.dmp

Filesize
204KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads