qakbot | 6f73175bb9feeaac9f21105e0dda5ebd24924ba82274f0e852ac000fa0807636

General

Target

iqigbr.exe
Size

311KB
MD5

8e4f7e6407ab8d00a27abf1ec997a213
SHA1

bc01920d201bc743e8e34135c52a2189c98e4c15
SHA256

6f73175bb9feeaac9f21105e0dda5ebd24924ba82274f0e852ac000fa0807636
SHA512

4d724f34af326a514c364663b9dca15ffc161f49362b6079dd90ea0149bf37b19afdf531c002f1303939d50650e2d51c4912bb74beef5f164ba4736e56d1ea4e

Score

10^/10

qakbot notset 1596817234 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1596817234

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

47.44.217.98:443

86.97.146.204:2222

65.60.228.130:443

216.201.162.158:443

94.59.24.79:995

108.46.145.30:443

24.139.132.70:443

47.206.174.82:443

188.52.106.206:20

72.204.242.138:6881

173.173.72.199:443

71.163.224.206:443

63.155.9.141:995

100.34.195.237:443

47.39.177.171:2222

96.20.108.17:2222

115.21.224.117:443

70.164.39.91:443

45.47.65.191:443

207.155.107.111:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

eafvo.exeeafvo.exe

pid process

1848 eafvo.exe
2024 eafvo.exe
Loads dropped DLL 2 IoCs

Processes:

iqigbr.exe

pid process

2036 iqigbr.exe
2036 iqigbr.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1652 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

iqigbr.exeiqigbr.exeeafvo.exeeafvo.exeexplorer.exeiqigbr.exe

pid process

2036 iqigbr.exe
648 iqigbr.exe
648 iqigbr.exe
1848 eafvo.exe
2024 eafvo.exe
2024 eafvo.exe
428 explorer.exe
428 explorer.exe
1060 iqigbr.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

eafvo.exe

pid process

1848 eafvo.exe

pid	process
1848	eafvo.exe
2024	eafvo.exe

pid	process
2036	iqigbr.exe
2036	iqigbr.exe

pid	process
1652	schtasks.exe

pid	process
2036	iqigbr.exe
648	iqigbr.exe
648	iqigbr.exe
1848	eafvo.exe
2024	eafvo.exe
2024	eafvo.exe
428	explorer.exe
428	explorer.exe
1060	iqigbr.exe

pid	process
1848	eafvo.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

iqigbr.exeeafvo.exetaskeng.exe

description	pid	process	target process
PID 2036 wrote to memory of 648	2036	iqigbr.exe	iqigbr.exe
PID 2036 wrote to memory of 648	2036	iqigbr.exe	iqigbr.exe
PID 2036 wrote to memory of 648	2036	iqigbr.exe	iqigbr.exe
PID 2036 wrote to memory of 648	2036	iqigbr.exe	iqigbr.exe
PID 2036 wrote to memory of 1848	2036	iqigbr.exe	eafvo.exe
PID 2036 wrote to memory of 1848	2036	iqigbr.exe	eafvo.exe
PID 2036 wrote to memory of 1848	2036	iqigbr.exe	eafvo.exe
PID 2036 wrote to memory of 1848	2036	iqigbr.exe	eafvo.exe
PID 2036 wrote to memory of 1652	2036	iqigbr.exe	schtasks.exe
PID 2036 wrote to memory of 1652	2036	iqigbr.exe	schtasks.exe
PID 2036 wrote to memory of 1652	2036	iqigbr.exe	schtasks.exe
PID 2036 wrote to memory of 1652	2036	iqigbr.exe	schtasks.exe
PID 1848 wrote to memory of 2024	1848	eafvo.exe	eafvo.exe
PID 1848 wrote to memory of 2024	1848	eafvo.exe	eafvo.exe
PID 1848 wrote to memory of 2024	1848	eafvo.exe	eafvo.exe
PID 1848 wrote to memory of 2024	1848	eafvo.exe	eafvo.exe
PID 1848 wrote to memory of 428	1848	eafvo.exe	explorer.exe
PID 1848 wrote to memory of 428	1848	eafvo.exe	explorer.exe
PID 1848 wrote to memory of 428	1848	eafvo.exe	explorer.exe
PID 1848 wrote to memory of 428	1848	eafvo.exe	explorer.exe
PID 1848 wrote to memory of 428	1848	eafvo.exe	explorer.exe
PID 1512 wrote to memory of 1060	1512	taskeng.exe	iqigbr.exe
PID 1512 wrote to memory of 1060	1512	taskeng.exe	iqigbr.exe
PID 1512 wrote to memory of 1060	1512	taskeng.exe	iqigbr.exe
PID 1512 wrote to memory of 1060	1512	taskeng.exe	iqigbr.exe

C:\Users\Admin\AppData\Local\Temp\iqigbr.exe
"C:\Users\Admin\AppData\Local\Temp\iqigbr.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036

C:\Users\Admin\AppData\Local\Temp\iqigbr.exe
C:\Users\Admin\AppData\Local\Temp\iqigbr.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:648

C:\Users\Admin\AppData\Roaming\Microsoft\Qfvvt\eafvo.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Qfvvt\eafvo.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1848

C:\Users\Admin\AppData\Roaming\Microsoft\Qfvvt\eafvo.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Qfvvt\eafvo.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2024

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:428

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jfbdfip /tr "\"C:\Users\Admin\AppData\Local\Temp\iqigbr.exe\" /I jfbdfip" /SC ONCE /Z /ST 08:17 /ET 08:29
2⤵
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\taskeng.exe
taskeng.exe {C901BE7C-45BC-4D75-B3AB-C5EBB2A24A74} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\Users\Admin\AppData\Local\Temp\iqigbr.exe
C:\Users\Admin\AppData\Local\Temp\iqigbr.exe /I jfbdfip
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1060

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Qfvvt\eafvo.dat
MD5
6974d20f4e9f8d2fd6a24231594d6179

SHA1
6706c948a3c1f38a7e117358acfa684d4996b9fc

SHA256
b81cb045927afee798981981ad86521ee5a965457e8b0834edac862141346fe0

SHA512
be28db0a61a867a44ee52a201f8eec88806cf6752a54e62948f481e72a52d8feccb55b3129240677e06f5ac4e369e4ff0611cabdf693cc11c7f598017976a76c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Qfvvt\eafvo.exe
MD5
8e4f7e6407ab8d00a27abf1ec997a213

SHA1
bc01920d201bc743e8e34135c52a2189c98e4c15

SHA256
6f73175bb9feeaac9f21105e0dda5ebd24924ba82274f0e852ac000fa0807636

SHA512
4d724f34af326a514c364663b9dca15ffc161f49362b6079dd90ea0149bf37b19afdf531c002f1303939d50650e2d51c4912bb74beef5f164ba4736e56d1ea4e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Qfvvt\eafvo.exe
MD5
8e4f7e6407ab8d00a27abf1ec997a213

SHA1
bc01920d201bc743e8e34135c52a2189c98e4c15

SHA256
6f73175bb9feeaac9f21105e0dda5ebd24924ba82274f0e852ac000fa0807636

SHA512
4d724f34af326a514c364663b9dca15ffc161f49362b6079dd90ea0149bf37b19afdf531c002f1303939d50650e2d51c4912bb74beef5f164ba4736e56d1ea4e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Qfvvt\eafvo.exe
MD5
8e4f7e6407ab8d00a27abf1ec997a213

SHA1
bc01920d201bc743e8e34135c52a2189c98e4c15

SHA256
6f73175bb9feeaac9f21105e0dda5ebd24924ba82274f0e852ac000fa0807636

SHA512
4d724f34af326a514c364663b9dca15ffc161f49362b6079dd90ea0149bf37b19afdf531c002f1303939d50650e2d51c4912bb74beef5f164ba4736e56d1ea4e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Qfvvt\eafvo.exe
MD5
8e4f7e6407ab8d00a27abf1ec997a213

SHA1
bc01920d201bc743e8e34135c52a2189c98e4c15

SHA256
6f73175bb9feeaac9f21105e0dda5ebd24924ba82274f0e852ac000fa0807636

SHA512
4d724f34af326a514c364663b9dca15ffc161f49362b6079dd90ea0149bf37b19afdf531c002f1303939d50650e2d51c4912bb74beef5f164ba4736e56d1ea4e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Qfvvt\eafvo.exe
MD5
8e4f7e6407ab8d00a27abf1ec997a213

SHA1
bc01920d201bc743e8e34135c52a2189c98e4c15

SHA256
6f73175bb9feeaac9f21105e0dda5ebd24924ba82274f0e852ac000fa0807636

SHA512
4d724f34af326a514c364663b9dca15ffc161f49362b6079dd90ea0149bf37b19afdf531c002f1303939d50650e2d51c4912bb74beef5f164ba4736e56d1ea4e

Download Submit
memory/428-12-0x0000000000000000-mapping.dmp

Download
memory/648-0-0x0000000000000000-mapping.dmp

Download
memory/648-1-0x0000000002480000-0x0000000002491000-memory.dmp

Filesize
68KB

Download
memory/1060-14-0x0000000000000000-mapping.dmp

Download
memory/1652-6-0x0000000000000000-mapping.dmp

Download
memory/1848-4-0x0000000000000000-mapping.dmp

Download
memory/1848-11-0x0000000000890000-0x00000000008D7000-memory.dmp

Filesize
284KB

Download
memory/2024-8-0x0000000000000000-mapping.dmp

Download
memory/2024-10-0x00000000024E0000-0x00000000024F1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads