qakbot | ba57db3890e62c8410f2900b2af306457c52755c2a27e9b4af511eb65425fed2

General

Target

cwgmzb.exe
Size

288KB
MD5

dfa445747f6178c9276158327e11061a
SHA1

4d6be320a1e8c89148ea3635adc5b74430ec24ac
SHA256

ba57db3890e62c8410f2900b2af306457c52755c2a27e9b4af511eb65425fed2
SHA512

349f4b394d41c35472cb5c1326499b423d1968b4c3da2da89d8321022093895d8a681636a6ae8cb9ba7486c9a788e942cbac2e7ea535637e84b1b1f142de630f

Score

10^/10

qakbot notset 1596817234 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1596817234

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

47.44.217.98:443

86.97.146.204:2222

65.60.228.130:443

216.201.162.158:443

94.59.24.79:995

108.46.145.30:443

24.139.132.70:443

47.206.174.82:443

188.52.106.206:20

72.204.242.138:6881

173.173.72.199:443

71.163.224.206:443

63.155.9.141:995

100.34.195.237:443

47.39.177.171:2222

96.20.108.17:2222

115.21.224.117:443

70.164.39.91:443

45.47.65.191:443

207.155.107.111:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

xmrbrgd.exexmrbrgd.exe

pid process

1188 xmrbrgd.exe
848 xmrbrgd.exe
Loads dropped DLL 2 IoCs

Processes:

cwgmzb.exe

pid process

1004 cwgmzb.exe
1004 cwgmzb.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2036 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

cwgmzb.execwgmzb.exexmrbrgd.exexmrbrgd.exeexplorer.execwgmzb.exe

pid process

1004 cwgmzb.exe
1696 cwgmzb.exe
1696 cwgmzb.exe
1188 xmrbrgd.exe
848 xmrbrgd.exe
848 xmrbrgd.exe
1708 explorer.exe
1708 explorer.exe
1516 cwgmzb.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

xmrbrgd.exe

pid process

1188 xmrbrgd.exe

pid	process
1188	xmrbrgd.exe
848	xmrbrgd.exe

pid	process
1004	cwgmzb.exe
1004	cwgmzb.exe

pid	process
2036	schtasks.exe

pid	process
1004	cwgmzb.exe
1696	cwgmzb.exe
1696	cwgmzb.exe
1188	xmrbrgd.exe
848	xmrbrgd.exe
848	xmrbrgd.exe
1708	explorer.exe
1708	explorer.exe
1516	cwgmzb.exe

pid	process
1188	xmrbrgd.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

cwgmzb.exexmrbrgd.exetaskeng.exe

description	pid	process	target process
PID 1004 wrote to memory of 1696	1004	cwgmzb.exe	cwgmzb.exe
PID 1004 wrote to memory of 1696	1004	cwgmzb.exe	cwgmzb.exe
PID 1004 wrote to memory of 1696	1004	cwgmzb.exe	cwgmzb.exe
PID 1004 wrote to memory of 1696	1004	cwgmzb.exe	cwgmzb.exe
PID 1004 wrote to memory of 1188	1004	cwgmzb.exe	xmrbrgd.exe
PID 1004 wrote to memory of 1188	1004	cwgmzb.exe	xmrbrgd.exe
PID 1004 wrote to memory of 1188	1004	cwgmzb.exe	xmrbrgd.exe
PID 1004 wrote to memory of 1188	1004	cwgmzb.exe	xmrbrgd.exe
PID 1004 wrote to memory of 2036	1004	cwgmzb.exe	schtasks.exe
PID 1004 wrote to memory of 2036	1004	cwgmzb.exe	schtasks.exe
PID 1004 wrote to memory of 2036	1004	cwgmzb.exe	schtasks.exe
PID 1004 wrote to memory of 2036	1004	cwgmzb.exe	schtasks.exe
PID 1188 wrote to memory of 848	1188	xmrbrgd.exe	xmrbrgd.exe
PID 1188 wrote to memory of 848	1188	xmrbrgd.exe	xmrbrgd.exe
PID 1188 wrote to memory of 848	1188	xmrbrgd.exe	xmrbrgd.exe
PID 1188 wrote to memory of 848	1188	xmrbrgd.exe	xmrbrgd.exe
PID 1188 wrote to memory of 1708	1188	xmrbrgd.exe	explorer.exe
PID 1188 wrote to memory of 1708	1188	xmrbrgd.exe	explorer.exe
PID 1188 wrote to memory of 1708	1188	xmrbrgd.exe	explorer.exe
PID 1188 wrote to memory of 1708	1188	xmrbrgd.exe	explorer.exe
PID 1188 wrote to memory of 1708	1188	xmrbrgd.exe	explorer.exe
PID 1264 wrote to memory of 1516	1264	taskeng.exe	cwgmzb.exe
PID 1264 wrote to memory of 1516	1264	taskeng.exe	cwgmzb.exe
PID 1264 wrote to memory of 1516	1264	taskeng.exe	cwgmzb.exe
PID 1264 wrote to memory of 1516	1264	taskeng.exe	cwgmzb.exe

C:\Users\Admin\AppData\Local\Temp\cwgmzb.exe
"C:\Users\Admin\AppData\Local\Temp\cwgmzb.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1004

C:\Users\Admin\AppData\Local\Temp\cwgmzb.exe
C:\Users\Admin\AppData\Local\Temp\cwgmzb.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1696

C:\Users\Admin\AppData\Roaming\Microsoft\Uyzcj\xmrbrgd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Uyzcj\xmrbrgd.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1188

C:\Users\Admin\AppData\Roaming\Microsoft\Uyzcj\xmrbrgd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Uyzcj\xmrbrgd.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:848

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1708

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn khgjnpbm /tr "\"C:\Users\Admin\AppData\Local\Temp\cwgmzb.exe\" /I khgjnpbm" /SC ONCE /Z /ST 09:25 /ET 09:37
2⤵
- Creates scheduled task(s)
PID:2036

C:\Windows\system32\taskeng.exe
taskeng.exe {A6203F57-43CF-4B9E-882F-8FF84168B096} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1264

C:\Users\Admin\AppData\Local\Temp\cwgmzb.exe
C:\Users\Admin\AppData\Local\Temp\cwgmzb.exe /I khgjnpbm
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1516

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Uyzcj\xmrbrgd.dat
MD5
b05dc527c4c7371dc0d4c937cce1bb15

SHA1
efab85a6ca967a52ba2cd16b28ba5e794438b409

SHA256
5960983cd233266cd6cd077f190ca49e754b7096127490608cde776d1589bd42

SHA512
157149a06cb66ddfc2596c2e4bdb1e3c2cfbaf9e0b9b1df390fad93966ed9cefda4ff2f2ecac7957edd0284ead0451db4b6fbbd724d4e4ff41ddd7f7159bfe4b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Uyzcj\xmrbrgd.exe
MD5
dfa445747f6178c9276158327e11061a

SHA1
4d6be320a1e8c89148ea3635adc5b74430ec24ac

SHA256
ba57db3890e62c8410f2900b2af306457c52755c2a27e9b4af511eb65425fed2

SHA512
349f4b394d41c35472cb5c1326499b423d1968b4c3da2da89d8321022093895d8a681636a6ae8cb9ba7486c9a788e942cbac2e7ea535637e84b1b1f142de630f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Uyzcj\xmrbrgd.exe
MD5
dfa445747f6178c9276158327e11061a

SHA1
4d6be320a1e8c89148ea3635adc5b74430ec24ac

SHA256
ba57db3890e62c8410f2900b2af306457c52755c2a27e9b4af511eb65425fed2

SHA512
349f4b394d41c35472cb5c1326499b423d1968b4c3da2da89d8321022093895d8a681636a6ae8cb9ba7486c9a788e942cbac2e7ea535637e84b1b1f142de630f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Uyzcj\xmrbrgd.exe
MD5
dfa445747f6178c9276158327e11061a

SHA1
4d6be320a1e8c89148ea3635adc5b74430ec24ac

SHA256
ba57db3890e62c8410f2900b2af306457c52755c2a27e9b4af511eb65425fed2

SHA512
349f4b394d41c35472cb5c1326499b423d1968b4c3da2da89d8321022093895d8a681636a6ae8cb9ba7486c9a788e942cbac2e7ea535637e84b1b1f142de630f

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Uyzcj\xmrbrgd.exe
MD5
dfa445747f6178c9276158327e11061a

SHA1
4d6be320a1e8c89148ea3635adc5b74430ec24ac

SHA256
ba57db3890e62c8410f2900b2af306457c52755c2a27e9b4af511eb65425fed2

SHA512
349f4b394d41c35472cb5c1326499b423d1968b4c3da2da89d8321022093895d8a681636a6ae8cb9ba7486c9a788e942cbac2e7ea535637e84b1b1f142de630f

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Uyzcj\xmrbrgd.exe
MD5
dfa445747f6178c9276158327e11061a

SHA1
4d6be320a1e8c89148ea3635adc5b74430ec24ac

SHA256
ba57db3890e62c8410f2900b2af306457c52755c2a27e9b4af511eb65425fed2

SHA512
349f4b394d41c35472cb5c1326499b423d1968b4c3da2da89d8321022093895d8a681636a6ae8cb9ba7486c9a788e942cbac2e7ea535637e84b1b1f142de630f

Download Submit
memory/848-8-0x0000000000000000-mapping.dmp

Download
memory/848-10-0x00000000024D0000-0x00000000024E1000-memory.dmp

Filesize
68KB

Download
memory/1188-4-0x0000000000000000-mapping.dmp

Download
memory/1188-11-0x0000000000450000-0x0000000000497000-memory.dmp

Filesize
284KB

Download
memory/1516-14-0x0000000000000000-mapping.dmp

Download
memory/1696-0-0x0000000000000000-mapping.dmp

Download
memory/1696-1-0x00000000024C0000-0x00000000024D1000-memory.dmp

Filesize
68KB

Download
memory/1708-12-0x0000000000000000-mapping.dmp

Download
memory/2036-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads