qakbot | b92c0aafb4e9b0fc2b023dbb14d7e848249f29e02b0e4cd8624ce27e55c9ac4c

General

Target

qakbot.exe
Size

2.7MB
MD5

6f9e304b289770a66e089ae2be83952c
SHA1

629c55b8e3e4fd9a6c0a4463ef5d30ceda133eb8
SHA256

b92c0aafb4e9b0fc2b023dbb14d7e848249f29e02b0e4cd8624ce27e55c9ac4c
SHA512

c621eb4c8f51bae2e75cbffd53db8173d91340e2987cccd15453a2a2c048d9820b26b64e0d51fbfb441e5dbf4f9108cfbe46bda872f2980491028d93fcb33f94
SSDEEP

12288:hmJnJHUrcxNxDxfxNxnxNxIWxNxsyRxNxRxNx0xNxrjG8zme:w5cir

Score

10^/10

qakbot spx156 1597661994 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

spx156

Campaign

1597661994

C2

98.26.50.62:995

46.53.40.244:443

86.98.89.40:2222

108.30.125.94:443

189.130.26.216:443

96.37.113.36:993

216.201.162.158:443

24.37.178.158:443

73.228.1.246:443

175.111.128.234:443

95.77.144.238:443

41.36.58.89:995

84.247.55.190:443

66.215.32.224:443

67.6.3.51:443

197.37.219.90:993

144.202.48.107:443

49.191.130.48:443

73.214.248.17:995

24.44.142.213:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

uudahu.exeuudahu.exe

pid process

3212 uudahu.exe
4272 uudahu.exe

pid	process
3212	uudahu.exe
4272	uudahu.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

qakbot.exeuudahu.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	qakbot.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	qakbot.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	uudahu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	uudahu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	qakbot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	qakbot.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	qakbot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	uudahu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	uudahu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	uudahu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	uudahu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	qakbot.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1064 schtasks.exe

pid	process
1064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

qakbot.exeqakbot.exeuudahu.exeuudahu.exeexplorer.exe

pid	process
3360	qakbot.exe
3360	qakbot.exe
3636	qakbot.exe
3636	qakbot.exe
3636	qakbot.exe
3636	qakbot.exe
3212	uudahu.exe
3212	uudahu.exe
4272	uudahu.exe
4272	uudahu.exe
4272	uudahu.exe
4272	uudahu.exe
4116	explorer.exe
4116	explorer.exe
4116	explorer.exe
4116	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

uudahu.exe

pid process

3212 uudahu.exe

pid	process
3212	uudahu.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

qakbot.exeuudahu.exe

description	pid	process	target process
PID 3360 wrote to memory of 3636	3360	qakbot.exe	qakbot.exe
PID 3360 wrote to memory of 3636	3360	qakbot.exe	qakbot.exe
PID 3360 wrote to memory of 3636	3360	qakbot.exe	qakbot.exe
PID 3360 wrote to memory of 3212	3360	qakbot.exe	uudahu.exe
PID 3360 wrote to memory of 3212	3360	qakbot.exe	uudahu.exe
PID 3360 wrote to memory of 3212	3360	qakbot.exe	uudahu.exe
PID 3360 wrote to memory of 1064	3360	qakbot.exe	schtasks.exe
PID 3360 wrote to memory of 1064	3360	qakbot.exe	schtasks.exe
PID 3360 wrote to memory of 1064	3360	qakbot.exe	schtasks.exe
PID 3212 wrote to memory of 4272	3212	uudahu.exe	uudahu.exe
PID 3212 wrote to memory of 4272	3212	uudahu.exe	uudahu.exe
PID 3212 wrote to memory of 4272	3212	uudahu.exe	uudahu.exe
PID 3212 wrote to memory of 4116	3212	uudahu.exe	explorer.exe
PID 3212 wrote to memory of 4116	3212	uudahu.exe	explorer.exe
PID 3212 wrote to memory of 4116	3212	uudahu.exe	explorer.exe
PID 3212 wrote to memory of 4116	3212	uudahu.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\qakbot.exe
"C:\Users\Admin\AppData\Local\Temp\qakbot.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\Temp\qakbot.exe
  C:\Users\Admin\AppData\Local\Temp\qakbot.exe /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:3636
- C:\Users\Admin\AppData\Roaming\Microsoft\Qksor\uudahu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Qksor\uudahu.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Users\Admin\AppData\Roaming\Microsoft\Qksor\uudahu.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Qksor\uudahu.exe /C
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:4272
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4116
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pkdmgule /tr "\"C:\Users\Admin\AppData\Local\Temp\qakbot.exe\" /I pkdmgule" /SC ONCE /Z /ST 16:40 /ET 16:52
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3988,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
1⤵
PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Qksor\uudahu.dat

Filesize
63B

MD5
bde78563aa77fc18c3273e1c95c2f192

SHA1
168c54d6a7514da9851644be5de66d59aeea3545

SHA256
4d33cf7f81be8aba128b842d913a9b629ff5a80662d5d6ec6a90a2438ec6b815

SHA512
589a695fd642999ea81e481e02633f85f12ff3013130c8f2df356736d6f61ea897fb223aa870a3255774ba593d420722e744de077ae8e13e77a72a3a20e4b9a2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Qksor\uudahu.exe

Filesize
2.7MB

MD5
6f9e304b289770a66e089ae2be83952c

SHA1
629c55b8e3e4fd9a6c0a4463ef5d30ceda133eb8

SHA256
b92c0aafb4e9b0fc2b023dbb14d7e848249f29e02b0e4cd8624ce27e55c9ac4c

SHA512
c621eb4c8f51bae2e75cbffd53db8173d91340e2987cccd15453a2a2c048d9820b26b64e0d51fbfb441e5dbf4f9108cfbe46bda872f2980491028d93fcb33f94

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3212-26-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/3212-19-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/3212-17-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/3212-16-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/3360-9-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3360-2-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/3360-14-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/3360-8-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/3360-0-0x0000000002330000-0x0000000002364000-memory.dmp

Filesize
208KB

Download
memory/3360-1-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3360-15-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3636-4-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/3636-5-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/4116-24-0x0000000000A50000-0x0000000000A7E000-memory.dmp

Filesize
184KB

Download
memory/4116-30-0x0000000000A50000-0x0000000000A7E000-memory.dmp

Filesize
184KB

Download
memory/4116-28-0x0000000000A50000-0x0000000000A7E000-memory.dmp

Filesize
184KB

Download
memory/4116-27-0x0000000000A50000-0x0000000000A7E000-memory.dmp

Filesize
184KB

Download
memory/4272-22-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/4272-23-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads