qakbot | 4df5cd5441ddcc5ded6bf4d096d45606baaa4e613786ae999200887e8b12f9bb

General

Target

test.bin.exe
Size

275KB
MD5

d3bb30bfb5961a4d53bb322d22a9b9f0
SHA1

52ea2d102ef7b7432b4c6d4924e5a856cb32682f
SHA256

4df5cd5441ddcc5ded6bf4d096d45606baaa4e613786ae999200887e8b12f9bb
SHA512

7629fd7d726144b883ab60eddeeca851b2030332606ae5238f342351051ca7de6b9b0d831546176650d60017964a77ecc8f13cf09025c44172cdfca332a64fe2

Score

10^/10

qakbot notset 1596817234 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1596817234

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

47.44.217.98:443

86.97.146.204:2222

65.60.228.130:443

216.201.162.158:443

94.59.24.79:995

108.46.145.30:443

24.139.132.70:443

47.206.174.82:443

188.52.106.206:20

72.204.242.138:6881

173.173.72.199:443

71.163.224.206:443

63.155.9.141:995

100.34.195.237:443

47.39.177.171:2222

96.20.108.17:2222

115.21.224.117:443

70.164.39.91:443

45.47.65.191:443

207.155.107.111:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

xiitid.exexiitid.exe

pid process

1860 xiitid.exe
1224 xiitid.exe
Loads dropped DLL 2 IoCs

Processes:

test.bin.exe

pid process

1360 test.bin.exe
1360 test.bin.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1924 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

test.bin.exetest.bin.exexiitid.exexiitid.exeexplorer.exetest.bin.exe

pid process

1360 test.bin.exe
1836 test.bin.exe
1836 test.bin.exe
1860 xiitid.exe
1224 xiitid.exe
1224 xiitid.exe
1132 explorer.exe
1132 explorer.exe
848 test.bin.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

xiitid.exe

pid process

1860 xiitid.exe

pid	process
1860	xiitid.exe
1224	xiitid.exe

pid	process
1360	test.bin.exe
1360	test.bin.exe

pid	process
1924	schtasks.exe

pid	process
1360	test.bin.exe
1836	test.bin.exe
1836	test.bin.exe
1860	xiitid.exe
1224	xiitid.exe
1224	xiitid.exe
1132	explorer.exe
1132	explorer.exe
848	test.bin.exe

pid	process
1860	xiitid.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

test.bin.exexiitid.exetaskeng.exe

description	pid	process	target process
PID 1360 wrote to memory of 1836	1360	test.bin.exe	test.bin.exe
PID 1360 wrote to memory of 1836	1360	test.bin.exe	test.bin.exe
PID 1360 wrote to memory of 1836	1360	test.bin.exe	test.bin.exe
PID 1360 wrote to memory of 1836	1360	test.bin.exe	test.bin.exe
PID 1360 wrote to memory of 1860	1360	test.bin.exe	xiitid.exe
PID 1360 wrote to memory of 1860	1360	test.bin.exe	xiitid.exe
PID 1360 wrote to memory of 1860	1360	test.bin.exe	xiitid.exe
PID 1360 wrote to memory of 1860	1360	test.bin.exe	xiitid.exe
PID 1360 wrote to memory of 1924	1360	test.bin.exe	schtasks.exe
PID 1360 wrote to memory of 1924	1360	test.bin.exe	schtasks.exe
PID 1360 wrote to memory of 1924	1360	test.bin.exe	schtasks.exe
PID 1360 wrote to memory of 1924	1360	test.bin.exe	schtasks.exe
PID 1860 wrote to memory of 1224	1860	xiitid.exe	xiitid.exe
PID 1860 wrote to memory of 1224	1860	xiitid.exe	xiitid.exe
PID 1860 wrote to memory of 1224	1860	xiitid.exe	xiitid.exe
PID 1860 wrote to memory of 1224	1860	xiitid.exe	xiitid.exe
PID 1860 wrote to memory of 1132	1860	xiitid.exe	explorer.exe
PID 1860 wrote to memory of 1132	1860	xiitid.exe	explorer.exe
PID 1860 wrote to memory of 1132	1860	xiitid.exe	explorer.exe
PID 1860 wrote to memory of 1132	1860	xiitid.exe	explorer.exe
PID 1860 wrote to memory of 1132	1860	xiitid.exe	explorer.exe
PID 1560 wrote to memory of 848	1560	taskeng.exe	test.bin.exe
PID 1560 wrote to memory of 848	1560	taskeng.exe	test.bin.exe
PID 1560 wrote to memory of 848	1560	taskeng.exe	test.bin.exe
PID 1560 wrote to memory of 848	1560	taskeng.exe	test.bin.exe

C:\Users\Admin\AppData\Local\Temp\test.bin.exe
"C:\Users\Admin\AppData\Local\Temp\test.bin.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1360

C:\Users\Admin\AppData\Local\Temp\test.bin.exe
C:\Users\Admin\AppData\Local\Temp\test.bin.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1836

C:\Users\Admin\AppData\Roaming\Microsoft\Xrcbz\xiitid.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Xrcbz\xiitid.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1860

C:\Users\Admin\AppData\Roaming\Microsoft\Xrcbz\xiitid.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Xrcbz\xiitid.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1224

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1132

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rnftguxfrm /tr "\"C:\Users\Admin\AppData\Local\Temp\test.bin.exe\" /I rnftguxfrm" /SC ONCE /Z /ST 12:56 /ET 13:08
2⤵
- Creates scheduled task(s)
PID:1924

C:\Windows\system32\taskeng.exe
taskeng.exe {D4BCD805-721F-4EF6-8C8C-3C4249EBC326} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1560

C:\Users\Admin\AppData\Local\Temp\test.bin.exe
C:\Users\Admin\AppData\Local\Temp\test.bin.exe /I rnftguxfrm
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:848

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Xrcbz\xiitid.dat
MD5
5d1aef410c8194941f6e549033988615

SHA1
5492e9ecb5e8f2fe4e28d89f4f844d8c18259bd5

SHA256
b5f01db0085763ac5b992aac3bdde6c8b0242942f204f0f0c4734d620b760f36

SHA512
1e83d5fd6c627457635601bb9682f7358a618a53ad982ed6c233075d41fbe6f3b9524c4fc57285b4f312108b5c5a2cccf633f78692916bd176ff23d6c9160c88

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Xrcbz\xiitid.exe
MD5
d3bb30bfb5961a4d53bb322d22a9b9f0

SHA1
52ea2d102ef7b7432b4c6d4924e5a856cb32682f

SHA256
4df5cd5441ddcc5ded6bf4d096d45606baaa4e613786ae999200887e8b12f9bb

SHA512
7629fd7d726144b883ab60eddeeca851b2030332606ae5238f342351051ca7de6b9b0d831546176650d60017964a77ecc8f13cf09025c44172cdfca332a64fe2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Xrcbz\xiitid.exe
MD5
d3bb30bfb5961a4d53bb322d22a9b9f0

SHA1
52ea2d102ef7b7432b4c6d4924e5a856cb32682f

SHA256
4df5cd5441ddcc5ded6bf4d096d45606baaa4e613786ae999200887e8b12f9bb

SHA512
7629fd7d726144b883ab60eddeeca851b2030332606ae5238f342351051ca7de6b9b0d831546176650d60017964a77ecc8f13cf09025c44172cdfca332a64fe2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Xrcbz\xiitid.exe
MD5
d3bb30bfb5961a4d53bb322d22a9b9f0

SHA1
52ea2d102ef7b7432b4c6d4924e5a856cb32682f

SHA256
4df5cd5441ddcc5ded6bf4d096d45606baaa4e613786ae999200887e8b12f9bb

SHA512
7629fd7d726144b883ab60eddeeca851b2030332606ae5238f342351051ca7de6b9b0d831546176650d60017964a77ecc8f13cf09025c44172cdfca332a64fe2

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Xrcbz\xiitid.exe
MD5
d3bb30bfb5961a4d53bb322d22a9b9f0

SHA1
52ea2d102ef7b7432b4c6d4924e5a856cb32682f

SHA256
4df5cd5441ddcc5ded6bf4d096d45606baaa4e613786ae999200887e8b12f9bb

SHA512
7629fd7d726144b883ab60eddeeca851b2030332606ae5238f342351051ca7de6b9b0d831546176650d60017964a77ecc8f13cf09025c44172cdfca332a64fe2

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Xrcbz\xiitid.exe
MD5
d3bb30bfb5961a4d53bb322d22a9b9f0

SHA1
52ea2d102ef7b7432b4c6d4924e5a856cb32682f

SHA256
4df5cd5441ddcc5ded6bf4d096d45606baaa4e613786ae999200887e8b12f9bb

SHA512
7629fd7d726144b883ab60eddeeca851b2030332606ae5238f342351051ca7de6b9b0d831546176650d60017964a77ecc8f13cf09025c44172cdfca332a64fe2

Download Submit
memory/848-15-0x0000000000000000-mapping.dmp

Download
memory/1132-12-0x0000000000000000-mapping.dmp

Download
memory/1224-8-0x0000000000000000-mapping.dmp

Download
memory/1224-10-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/1836-0-0x0000000000000000-mapping.dmp

Download
memory/1836-1-0x0000000002440000-0x0000000002451000-memory.dmp

Filesize
68KB

Download
memory/1860-11-0x0000000001D50000-0x0000000001D97000-memory.dmp

Filesize
284KB

Download
memory/1860-4-0x0000000000000000-mapping.dmp

Download
memory/1924-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads