qakbot | 27cd762e064044215a176dea68d19d65956cfd8acba85678b22dc7ef1e485013

General

Target

ggenrm.exe
Size

1.0MB
MD5

9c4a6237fae9898ae052ca2c0a934c1b
SHA1

7f152c3fda63931b620ad36df794edd9f5d2bced
SHA256

27cd762e064044215a176dea68d19d65956cfd8acba85678b22dc7ef1e485013
SHA512

7eb4f7386b6325cfdfe174c2b83452626e2d66377d356aef78a6210c3e0db8252457d0aae5370153b2ebdd59d90ec552c5ad896a64676785c3e6bf2b650d60e9

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

jmoziwue.exejmoziwue.exe

pid process

1588 jmoziwue.exe
280 jmoziwue.exe
Loads dropped DLL 2 IoCs

Processes:

ggenrm.exe

pid process

752 ggenrm.exe
752 ggenrm.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1540 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

ggenrm.exeggenrm.exejmoziwue.exejmoziwue.exeexplorer.exe

pid process

752 ggenrm.exe
1364 ggenrm.exe
1364 ggenrm.exe
1588 jmoziwue.exe
280 jmoziwue.exe
280 jmoziwue.exe
976 explorer.exe
976 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

jmoziwue.exe

pid process

1588 jmoziwue.exe

pid	process
1588	jmoziwue.exe
280	jmoziwue.exe

pid	process
752	ggenrm.exe
752	ggenrm.exe

pid	process
1540	schtasks.exe

pid	process
752	ggenrm.exe
1364	ggenrm.exe
1364	ggenrm.exe
1588	jmoziwue.exe
280	jmoziwue.exe
280	jmoziwue.exe
976	explorer.exe
976	explorer.exe

pid	process
1588	jmoziwue.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

ggenrm.exejmoziwue.exetaskeng.exe

description	pid	process	target process
PID 752 wrote to memory of 1364	752	ggenrm.exe	ggenrm.exe
PID 752 wrote to memory of 1364	752	ggenrm.exe	ggenrm.exe
PID 752 wrote to memory of 1364	752	ggenrm.exe	ggenrm.exe
PID 752 wrote to memory of 1364	752	ggenrm.exe	ggenrm.exe
PID 752 wrote to memory of 1588	752	ggenrm.exe	jmoziwue.exe
PID 752 wrote to memory of 1588	752	ggenrm.exe	jmoziwue.exe
PID 752 wrote to memory of 1588	752	ggenrm.exe	jmoziwue.exe
PID 752 wrote to memory of 1588	752	ggenrm.exe	jmoziwue.exe
PID 752 wrote to memory of 1540	752	ggenrm.exe	schtasks.exe
PID 752 wrote to memory of 1540	752	ggenrm.exe	schtasks.exe
PID 752 wrote to memory of 1540	752	ggenrm.exe	schtasks.exe
PID 752 wrote to memory of 1540	752	ggenrm.exe	schtasks.exe
PID 1588 wrote to memory of 280	1588	jmoziwue.exe	jmoziwue.exe
PID 1588 wrote to memory of 280	1588	jmoziwue.exe	jmoziwue.exe
PID 1588 wrote to memory of 280	1588	jmoziwue.exe	jmoziwue.exe
PID 1588 wrote to memory of 280	1588	jmoziwue.exe	jmoziwue.exe
PID 1588 wrote to memory of 976	1588	jmoziwue.exe	explorer.exe
PID 1588 wrote to memory of 976	1588	jmoziwue.exe	explorer.exe
PID 1588 wrote to memory of 976	1588	jmoziwue.exe	explorer.exe
PID 1588 wrote to memory of 976	1588	jmoziwue.exe	explorer.exe
PID 1588 wrote to memory of 976	1588	jmoziwue.exe	explorer.exe
PID 848 wrote to memory of 820	848	taskeng.exe	ggenrm.exe
PID 848 wrote to memory of 820	848	taskeng.exe	ggenrm.exe
PID 848 wrote to memory of 820	848	taskeng.exe	ggenrm.exe
PID 848 wrote to memory of 820	848	taskeng.exe	ggenrm.exe

C:\Users\Admin\AppData\Local\Temp\ggenrm.exe
"C:\Users\Admin\AppData\Local\Temp\ggenrm.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:752

C:\Users\Admin\AppData\Local\Temp\ggenrm.exe
C:\Users\Admin\AppData\Local\Temp\ggenrm.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1364

C:\Users\Admin\AppData\Roaming\Microsoft\Cczxg\jmoziwue.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Cczxg\jmoziwue.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1588

C:\Users\Admin\AppData\Roaming\Microsoft\Cczxg\jmoziwue.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Cczxg\jmoziwue.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:280

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:976

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vtawyrdw /tr "\"C:\Users\Admin\AppData\Local\Temp\ggenrm.exe\" /I vtawyrdw" /SC ONCE /Z /ST 14:45 /ET 14:57
2⤵
- Creates scheduled task(s)
PID:1540

C:\Windows\system32\taskeng.exe
taskeng.exe {B20F844D-E078-462D-9AE7-DAF46E4027A9} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Users\Admin\AppData\Local\Temp\ggenrm.exe
C:\Users\Admin\AppData\Local\Temp\ggenrm.exe /I vtawyrdw
2⤵
PID:820

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Cczxg\jmoziwue.dat
MD5
37ce8f01edd87e689489718d31033f9d

SHA1
787208172604228c5118b19b1db4560b3954fe21

SHA256
b5da3d70516783139294e8c5eeddc9649c11ec436a08bdc22a73d5c1191a75d8

SHA512
555545b2b413e32a026b03ef2c7ddd5b03c6405154f3d0cd86ae9c56ea1224c5b794ef039aae6ae3664e0b13a29d6831ed98e95e274e2ce061b418eced45d6af

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Cczxg\jmoziwue.exe
MD5
9c4a6237fae9898ae052ca2c0a934c1b

SHA1
7f152c3fda63931b620ad36df794edd9f5d2bced

SHA256
27cd762e064044215a176dea68d19d65956cfd8acba85678b22dc7ef1e485013

SHA512
7eb4f7386b6325cfdfe174c2b83452626e2d66377d356aef78a6210c3e0db8252457d0aae5370153b2ebdd59d90ec552c5ad896a64676785c3e6bf2b650d60e9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Cczxg\jmoziwue.exe
MD5
9c4a6237fae9898ae052ca2c0a934c1b

SHA1
7f152c3fda63931b620ad36df794edd9f5d2bced

SHA256
27cd762e064044215a176dea68d19d65956cfd8acba85678b22dc7ef1e485013

SHA512
7eb4f7386b6325cfdfe174c2b83452626e2d66377d356aef78a6210c3e0db8252457d0aae5370153b2ebdd59d90ec552c5ad896a64676785c3e6bf2b650d60e9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Cczxg\jmoziwue.exe
MD5
9c4a6237fae9898ae052ca2c0a934c1b

SHA1
7f152c3fda63931b620ad36df794edd9f5d2bced

SHA256
27cd762e064044215a176dea68d19d65956cfd8acba85678b22dc7ef1e485013

SHA512
7eb4f7386b6325cfdfe174c2b83452626e2d66377d356aef78a6210c3e0db8252457d0aae5370153b2ebdd59d90ec552c5ad896a64676785c3e6bf2b650d60e9

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Cczxg\jmoziwue.exe
MD5
9c4a6237fae9898ae052ca2c0a934c1b

SHA1
7f152c3fda63931b620ad36df794edd9f5d2bced

SHA256
27cd762e064044215a176dea68d19d65956cfd8acba85678b22dc7ef1e485013

SHA512
7eb4f7386b6325cfdfe174c2b83452626e2d66377d356aef78a6210c3e0db8252457d0aae5370153b2ebdd59d90ec552c5ad896a64676785c3e6bf2b650d60e9

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Cczxg\jmoziwue.exe
MD5
9c4a6237fae9898ae052ca2c0a934c1b

SHA1
7f152c3fda63931b620ad36df794edd9f5d2bced

SHA256
27cd762e064044215a176dea68d19d65956cfd8acba85678b22dc7ef1e485013

SHA512
7eb4f7386b6325cfdfe174c2b83452626e2d66377d356aef78a6210c3e0db8252457d0aae5370153b2ebdd59d90ec552c5ad896a64676785c3e6bf2b650d60e9

Download Submit
memory/280-8-0x0000000000000000-mapping.dmp

Download
memory/280-10-0x00000000024D0000-0x00000000024E1000-memory.dmp

Filesize
68KB

Download
memory/820-14-0x0000000000000000-mapping.dmp

Download
memory/976-12-0x0000000000000000-mapping.dmp

Download
memory/1364-0-0x0000000000000000-mapping.dmp

Download
memory/1364-1-0x00000000025E0000-0x00000000025F1000-memory.dmp

Filesize
68KB

Download
memory/1540-6-0x0000000000000000-mapping.dmp

Download
memory/1588-4-0x0000000000000000-mapping.dmp

Download
memory/1588-11-0x00000000024E0000-0x000000000251A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads