qakbot | 9e2864977d0e2bf7e8def198db7d3022188cd764519c2f385797a7ca394c2283

General

Target

Wong_B.vbs
Size

1.9MB
MD5

32432f63ce811f734d1938060fe83b4c
SHA1

e768c6bf965a548f8e8e79413d67998ee5173364
SHA256

798e44b2af6329ac38f144d816096b72889009f44c9d74aefa36c11dbdc5522a
SHA512

d41328ae22eb0768c70567c7759ed9164112c47f4c81ffb3c3b387c0f8fe33b29725d25cd5b8b390c9feca405d9f426cb823ed8ec5b91d7a139ae5de742e9351
SSDEEP

49152:bs87tFIYKrGSBUsthSxelQwz1w9r+U32mIXzTmCc4iMVWS:k

Score

10^/10

qakbot spx04 1568039940 banker evasion persistence stealer trojan

Malware Config

Extracted

Family

qakbot

Version

323.79

Botnet

spx04

Campaign

1568039940

C2

190.120.196.18:443

70.169.2.228:21

189.160.191.239:443

174.48.72.160:443

99.231.208.9:443

12.5.37.3:443

173.178.129.3:443

189.236.138.168:443

67.41.197.173:2078

173.172.205.216:443

76.69.181.244:995

70.164.39.91:443

75.131.72.82:443

189.236.214.160:995

199.126.92.231:995

98.224.57.108:443

72.142.106.198:995

98.186.90.192:995

72.36.14.160:443

75.177.172.209:6882

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Fyeut = "0"	reg.exe

Executes dropped EXE 7 IoCs

Processes:

FrWqwyW.exeFrWqwyW.exefkxsnuzc.exefkxsnuzc.exeFrWqwyW.exefkxsnuzc.exefkxsnuzc.exe

pid process

2728 FrWqwyW.exe
2840 FrWqwyW.exe
2188 fkxsnuzc.exe
2512 fkxsnuzc.exe
288 FrWqwyW.exe
2848 fkxsnuzc.exe
420 fkxsnuzc.exe
Loads dropped DLL 2 IoCs

Processes:

FrWqwyW.exe

pid process

2728 FrWqwyW.exe
2728 FrWqwyW.exe

pid	process
2728	FrWqwyW.exe
2840	FrWqwyW.exe
2188	fkxsnuzc.exe
2512	fkxsnuzc.exe
288	FrWqwyW.exe
2848	fkxsnuzc.exe
420	fkxsnuzc.exe

pid	process
2728	FrWqwyW.exe
2728	FrWqwyW.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\lndzkre = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Fyeut\\fkxsnuzc.exe\""	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2440 schtasks.exe

pid	process
2440	schtasks.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

FrWqwyW.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	FrWqwyW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	FrWqwyW.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	FrWqwyW.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1088 PING.EXE
Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

FrWqwyW.exeFrWqwyW.exefkxsnuzc.exefkxsnuzc.exeexplorer.exeFrWqwyW.exefkxsnuzc.exefkxsnuzc.exe

pid process

2728 FrWqwyW.exe
2840 FrWqwyW.exe
2840 FrWqwyW.exe
2188 fkxsnuzc.exe
2512 fkxsnuzc.exe
2512 fkxsnuzc.exe
2936 explorer.exe
2936 explorer.exe
288 FrWqwyW.exe
2848 fkxsnuzc.exe
420 fkxsnuzc.exe
420 fkxsnuzc.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

fkxsnuzc.exe

pid process

2188 fkxsnuzc.exe

pid	process
1088	PING.EXE

pid	process
2728	FrWqwyW.exe
2840	FrWqwyW.exe
2840	FrWqwyW.exe
2188	fkxsnuzc.exe
2512	fkxsnuzc.exe
2512	fkxsnuzc.exe
2936	explorer.exe
2936	explorer.exe
288	FrWqwyW.exe
2848	fkxsnuzc.exe
420	fkxsnuzc.exe
420	fkxsnuzc.exe

pid	process
2188	fkxsnuzc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

FrWqwyW.exefkxsnuzc.exetaskeng.exeFrWqwyW.exe

description	pid	process	target process
PID 2728 wrote to memory of 2840	2728	FrWqwyW.exe	FrWqwyW.exe
PID 2728 wrote to memory of 2840	2728	FrWqwyW.exe	FrWqwyW.exe
PID 2728 wrote to memory of 2840	2728	FrWqwyW.exe	FrWqwyW.exe
PID 2728 wrote to memory of 2840	2728	FrWqwyW.exe	FrWqwyW.exe
PID 2728 wrote to memory of 2188	2728	FrWqwyW.exe	fkxsnuzc.exe
PID 2728 wrote to memory of 2188	2728	FrWqwyW.exe	fkxsnuzc.exe
PID 2728 wrote to memory of 2188	2728	FrWqwyW.exe	fkxsnuzc.exe
PID 2728 wrote to memory of 2188	2728	FrWqwyW.exe	fkxsnuzc.exe
PID 2728 wrote to memory of 2440	2728	FrWqwyW.exe	schtasks.exe
PID 2728 wrote to memory of 2440	2728	FrWqwyW.exe	schtasks.exe
PID 2728 wrote to memory of 2440	2728	FrWqwyW.exe	schtasks.exe
PID 2728 wrote to memory of 2440	2728	FrWqwyW.exe	schtasks.exe
PID 2188 wrote to memory of 2512	2188	fkxsnuzc.exe	fkxsnuzc.exe
PID 2188 wrote to memory of 2512	2188	fkxsnuzc.exe	fkxsnuzc.exe
PID 2188 wrote to memory of 2512	2188	fkxsnuzc.exe	fkxsnuzc.exe
PID 2188 wrote to memory of 2512	2188	fkxsnuzc.exe	fkxsnuzc.exe
PID 2188 wrote to memory of 2936	2188	fkxsnuzc.exe	explorer.exe
PID 2188 wrote to memory of 2936	2188	fkxsnuzc.exe	explorer.exe
PID 2188 wrote to memory of 2936	2188	fkxsnuzc.exe	explorer.exe
PID 2188 wrote to memory of 2936	2188	fkxsnuzc.exe	explorer.exe
PID 2188 wrote to memory of 2936	2188	fkxsnuzc.exe	explorer.exe
PID 816 wrote to memory of 288	816	taskeng.exe	FrWqwyW.exe
PID 816 wrote to memory of 288	816	taskeng.exe	FrWqwyW.exe
PID 816 wrote to memory of 288	816	taskeng.exe	FrWqwyW.exe
PID 816 wrote to memory of 288	816	taskeng.exe	FrWqwyW.exe
PID 288 wrote to memory of 1252	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 1252	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 1252	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 1252	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2964	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2964	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2964	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2964	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 1236	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 1236	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 1236	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 1236	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 1772	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 1772	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 1772	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 1772	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2480	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2480	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2480	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2480	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2952	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2952	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2952	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2952	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2204	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2204	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2204	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2204	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2260	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2260	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2260	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2260	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 3048	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 3048	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 3048	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 3048	288	FrWqwyW.exe	reg.exe
PID 288 wrote to memory of 2848	288	FrWqwyW.exe	fkxsnuzc.exe
PID 288 wrote to memory of 2848	288	FrWqwyW.exe	fkxsnuzc.exe
PID 288 wrote to memory of 2848	288	FrWqwyW.exe	fkxsnuzc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Wong_B.vbs"
1⤵
PID:2128

C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2728

C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe /C
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2840

C:\Users\Admin\AppData\Roaming\Microsoft\Fyeut\fkxsnuzc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Fyeut\fkxsnuzc.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2188

C:\Users\Admin\AppData\Roaming\Microsoft\Fyeut\fkxsnuzc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Fyeut\fkxsnuzc.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2512

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2936

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn csfpfvmwpu /tr "\"C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe\" /I csfpfvmwpu" /SC ONCE /Z /ST 01:55 /ET 02:07
2⤵
- Creates scheduled task(s)
PID:2440

C:\Windows\system32\taskeng.exe
taskeng.exe {F5A9182C-A393-46BC-9960-5DDF7333C9D8} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:816

C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe /I csfpfvmwpu
2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:288

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
3⤵
PID:1252

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
3⤵
PID:2964

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
3⤵
PID:1236

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
3⤵
PID:1772

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
3⤵
PID:2480

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
3⤵
PID:2952

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
3⤵
PID:2204

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
3⤵
PID:2260

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Fyeut" /d "0"
3⤵
- Windows security bypass
PID:3048

C:\Users\Admin\AppData\Roaming\Microsoft\Fyeut\fkxsnuzc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Fyeut\fkxsnuzc.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2848

C:\Users\Admin\AppData\Roaming\Microsoft\Fyeut\fkxsnuzc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Fyeut\fkxsnuzc.exe /C
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:420

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe"
3⤵
PID:2420

C:\Windows\system32\PING.EXE
ping.exe -n 6 127.0.0.1
4⤵
- Runs ping.exe
PID:1088

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /DELETE /F /TN csfpfvmwpu
3⤵
PID:1868

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
Filesize
660KB

MD5
048a451e99556b0f90576c2a976073d7

SHA1
1d3bc3472ec2313038f120020e3ce54db3db72f3

SHA256
f5d56d68b93516d18564a7862f2494e99827a0bd9071476e0585a2a345e7879a

SHA512
eb2aff455619c4dda5ed02f1b46a36a065d26671b55a8c94c8d47cd50419288b3937ebc014c9a5fc3dc3bc8a7223e5bfa54b963575cda0606b2f611e4ad9f3d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Fyeut\fkxsnuzc.dat
Filesize
63B

MD5
1b4a763f765761920a550947572b2dae

SHA1
2c3f396e20d23a381a3a008b89acacef49466a42

SHA256
e686e9eb4b839efa05bd09673f3b7c8483eee1117acce92149fd414091cfd0c5

SHA512
c3223121030c8421237ebadc3ebd269dee68ceab3b675f1342b9844492f76877fe89156c6f15347720d20163b1c5c3011c71d5ff5c29018e812fc2b24e6a458d

Download Submit
memory/288-54-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/288-46-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/420-60-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2188-22-0x0000000001DB0000-0x0000000001E41000-memory.dmp

Filesize
580KB

Download
memory/2188-39-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2512-32-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2728-26-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2728-3-0x00000000007A0000-0x0000000000831000-memory.dmp

Filesize
580KB

Download
memory/2728-4-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2840-14-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2840-13-0x0000000001C70000-0x0000000001D01000-memory.dmp

Filesize
580KB

Download
memory/2848-61-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2936-35-0x0000000000080000-0x0000000000111000-memory.dmp

Filesize
580KB

Download
memory/2936-40-0x00000000004E0000-0x0000000000520000-memory.dmp

Filesize
256KB

Download
memory/2936-42-0x00000000004E0000-0x0000000000520000-memory.dmp

Filesize
256KB

Download
memory/2936-38-0x00000000004E0000-0x0000000000520000-memory.dmp

Filesize
256KB

Download
memory/2936-36-0x00000000004E0000-0x0000000000520000-memory.dmp

Filesize
256KB

Download
memory/2936-37-0x0000000000080000-0x0000000000111000-memory.dmp

Filesize
580KB

Download
memory/2936-33-0x0000000000080000-0x0000000000111000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads