qakbot | c499664ef142e70f6d2fc01580ce180ebf2438ff9a2df4d609854138510d60fd

General

Target

8888888.exe
Size

1.1MB
MD5

699cf093ec4d952ba1e65c6bfa479954
SHA1

1af411ab00addbd9004561ed3b317e1894736038
SHA256

c499664ef142e70f6d2fc01580ce180ebf2438ff9a2df4d609854138510d60fd
SHA512

f1ba6c5699ed9b164c2447c8d1eff5d701743a81d980f07604cdcc26ae98c031f3da0ab313b256386d2f9787a14a6c9e7a594da2c834f95264bc2cff4cf15465

Score

10^/10

trojan banker stealer qakbot

Malware Config

Extracted

Family

qakbot

Botnet

spx135

Campaign

1591627649

C2

89.32.216.156:443

74.222.204.82:443

24.183.39.93:443

97.93.211.17:443

80.14.209.42:2222

96.35.170.82:2222

151.73.124.242:443

98.110.231.63:443

108.227.161.27:995

173.3.132.17:995

31.5.41.52:443

24.122.228.88:443

5.107.208.94:2222

76.185.136.58:443

50.29.166.232:995

73.210.114.187:443

92.114.107.193:995

24.43.22.220:993

50.247.230.33:995

72.142.106.198:465

Signatures

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1564 schtasks.exe
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

8888888.exe8888888.exedfsjuj.exedfsjuj.exeexplorer.exe

pid process

1500 8888888.exe
476 8888888.exe
476 8888888.exe
1644 dfsjuj.exe
1868 dfsjuj.exe
1868 dfsjuj.exe
1772 explorer.exe
1772 explorer.exe

pid	process
1564	schtasks.exe

pid	process
1500	8888888.exe
476	8888888.exe
476	8888888.exe
1644	dfsjuj.exe
1868	dfsjuj.exe
1868	dfsjuj.exe
1772	explorer.exe
1772	explorer.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

8888888.exedfsjuj.exetaskeng.exe

description	pid	process	target process
PID 1500 wrote to memory of 476	1500	8888888.exe	8888888.exe
PID 1500 wrote to memory of 476	1500	8888888.exe	8888888.exe
PID 1500 wrote to memory of 476	1500	8888888.exe	8888888.exe
PID 1500 wrote to memory of 476	1500	8888888.exe	8888888.exe
PID 1500 wrote to memory of 1644	1500	8888888.exe	dfsjuj.exe
PID 1500 wrote to memory of 1644	1500	8888888.exe	dfsjuj.exe
PID 1500 wrote to memory of 1644	1500	8888888.exe	dfsjuj.exe
PID 1500 wrote to memory of 1644	1500	8888888.exe	dfsjuj.exe
PID 1500 wrote to memory of 1564	1500	8888888.exe	schtasks.exe
PID 1500 wrote to memory of 1564	1500	8888888.exe	schtasks.exe
PID 1500 wrote to memory of 1564	1500	8888888.exe	schtasks.exe
PID 1500 wrote to memory of 1564	1500	8888888.exe	schtasks.exe
PID 1644 wrote to memory of 1868	1644	dfsjuj.exe	dfsjuj.exe
PID 1644 wrote to memory of 1868	1644	dfsjuj.exe	dfsjuj.exe
PID 1644 wrote to memory of 1868	1644	dfsjuj.exe	dfsjuj.exe
PID 1644 wrote to memory of 1868	1644	dfsjuj.exe	dfsjuj.exe
PID 1644 wrote to memory of 1772	1644	dfsjuj.exe	explorer.exe
PID 1644 wrote to memory of 1772	1644	dfsjuj.exe	explorer.exe
PID 1644 wrote to memory of 1772	1644	dfsjuj.exe	explorer.exe
PID 1644 wrote to memory of 1772	1644	dfsjuj.exe	explorer.exe
PID 1644 wrote to memory of 1772	1644	dfsjuj.exe	explorer.exe
PID 1124 wrote to memory of 1636	1124	taskeng.exe	8888888.exe
PID 1124 wrote to memory of 1636	1124	taskeng.exe	8888888.exe
PID 1124 wrote to memory of 1636	1124	taskeng.exe	8888888.exe
PID 1124 wrote to memory of 1636	1124	taskeng.exe	8888888.exe

Loads dropped DLL 2 IoCs

Processes:

8888888.exe

pid process

1500 8888888.exe
1500 8888888.exe
Executes dropped EXE 2 IoCs

Processes:

dfsjuj.exedfsjuj.exe

pid process

1644 dfsjuj.exe
1868 dfsjuj.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

dfsjuj.exe

pid process

1644 dfsjuj.exe

pid	process
1500	8888888.exe
1500	8888888.exe

pid	process
1644	dfsjuj.exe
1868	dfsjuj.exe

pid	process
1644	dfsjuj.exe

C:\Users\Admin\AppData\Local\Temp\8888888.exe
"C:\Users\Admin\AppData\Local\Temp\8888888.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1500

C:\Users\Admin\AppData\Local\Temp\8888888.exe
C:\Users\Admin\AppData\Local\Temp\8888888.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:476

C:\Users\Admin\AppData\Roaming\Microsoft\Euuijr\dfsjuj.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Euuijr\dfsjuj.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:1644

C:\Users\Admin\AppData\Roaming\Microsoft\Euuijr\dfsjuj.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Euuijr\dfsjuj.exe /C
3⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:1868

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1772

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn uoybszwe /tr "\"C:\Users\Admin\AppData\Local\Temp\8888888.exe\" /I uoybszwe" /SC ONCE /Z /ST 17:37 /ET 17:49
2⤵
- Creates scheduled task(s)
PID:1564

C:\Windows\system32\taskeng.exe
taskeng.exe {4D60605D-A3AF-43B9-A498-2EAB4B22C2CF} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1124

C:\Users\Admin\AppData\Local\Temp\8888888.exe
C:\Users\Admin\AppData\Local\Temp\8888888.exe /I uoybszwe
2⤵
PID:1636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Euuijr\dfsjuj.dat

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Euuijr\dfsjuj.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Euuijr\dfsjuj.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Euuijr\dfsjuj.exe

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Euuijr\dfsjuj.exe

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Euuijr\dfsjuj.exe

Download Submit
memory/476-0-0x00000000023C0000-0x00000000023D1000-memory.dmp

Filesize
68KB

Download
memory/1644-7-0x0000000000570000-0x00000000005AA000-memory.dmp

Filesize
232KB

Download
memory/1868-6-0x0000000002290000-0x00000000022A1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads