qakbot | 8893636ffa19c156a1dca90039203a3aba4cca4fb06296df93afc7c5d8016ff5

General

Target

fjvmec.exe
Size

1.0MB
MD5

07e6fa72f03cb8361653252d5c56a336
SHA1

fe64b0aaa04846f76f6c75443a67af67763c1962
SHA256

8893636ffa19c156a1dca90039203a3aba4cca4fb06296df93afc7c5d8016ff5
SHA512

f422dd3f11c89b252543be5337222d544ee4d9873cb87013cc1cd9e4b23a611244d74f5ee85e228441aaffb333d01947202955d6712c84ad74976b587c008337

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

ftiuw.exeftiuw.exe

pid process

1708 ftiuw.exe
1844 ftiuw.exe
Loads dropped DLL 2 IoCs

Processes:

fjvmec.exe

pid process

1900 fjvmec.exe
1900 fjvmec.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

800 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

fjvmec.exefjvmec.exeftiuw.exeftiuw.exeexplorer.exefjvmec.exe

pid process

1900 fjvmec.exe
1640 fjvmec.exe
1640 fjvmec.exe
1708 ftiuw.exe
1844 ftiuw.exe
1844 ftiuw.exe
804 explorer.exe
804 explorer.exe
1548 fjvmec.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ftiuw.exe

pid process

1708 ftiuw.exe

pid	process
1708	ftiuw.exe
1844	ftiuw.exe

pid	process
1900	fjvmec.exe
1900	fjvmec.exe

pid	process
800	schtasks.exe

pid	process
1900	fjvmec.exe
1640	fjvmec.exe
1640	fjvmec.exe
1708	ftiuw.exe
1844	ftiuw.exe
1844	ftiuw.exe
804	explorer.exe
804	explorer.exe
1548	fjvmec.exe

pid	process
1708	ftiuw.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

fjvmec.exeftiuw.exetaskeng.exe

description	pid	process	target process
PID 1900 wrote to memory of 1640	1900	fjvmec.exe	fjvmec.exe
PID 1900 wrote to memory of 1640	1900	fjvmec.exe	fjvmec.exe
PID 1900 wrote to memory of 1640	1900	fjvmec.exe	fjvmec.exe
PID 1900 wrote to memory of 1640	1900	fjvmec.exe	fjvmec.exe
PID 1900 wrote to memory of 1708	1900	fjvmec.exe	ftiuw.exe
PID 1900 wrote to memory of 1708	1900	fjvmec.exe	ftiuw.exe
PID 1900 wrote to memory of 1708	1900	fjvmec.exe	ftiuw.exe
PID 1900 wrote to memory of 1708	1900	fjvmec.exe	ftiuw.exe
PID 1900 wrote to memory of 800	1900	fjvmec.exe	schtasks.exe
PID 1900 wrote to memory of 800	1900	fjvmec.exe	schtasks.exe
PID 1900 wrote to memory of 800	1900	fjvmec.exe	schtasks.exe
PID 1900 wrote to memory of 800	1900	fjvmec.exe	schtasks.exe
PID 1708 wrote to memory of 1844	1708	ftiuw.exe	ftiuw.exe
PID 1708 wrote to memory of 1844	1708	ftiuw.exe	ftiuw.exe
PID 1708 wrote to memory of 1844	1708	ftiuw.exe	ftiuw.exe
PID 1708 wrote to memory of 1844	1708	ftiuw.exe	ftiuw.exe
PID 1708 wrote to memory of 804	1708	ftiuw.exe	explorer.exe
PID 1708 wrote to memory of 804	1708	ftiuw.exe	explorer.exe
PID 1708 wrote to memory of 804	1708	ftiuw.exe	explorer.exe
PID 1708 wrote to memory of 804	1708	ftiuw.exe	explorer.exe
PID 1708 wrote to memory of 804	1708	ftiuw.exe	explorer.exe
PID 332 wrote to memory of 1548	332	taskeng.exe	fjvmec.exe
PID 332 wrote to memory of 1548	332	taskeng.exe	fjvmec.exe
PID 332 wrote to memory of 1548	332	taskeng.exe	fjvmec.exe
PID 332 wrote to memory of 1548	332	taskeng.exe	fjvmec.exe

C:\Users\Admin\AppData\Local\Temp\fjvmec.exe
"C:\Users\Admin\AppData\Local\Temp\fjvmec.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1900

C:\Users\Admin\AppData\Local\Temp\fjvmec.exe
C:\Users\Admin\AppData\Local\Temp\fjvmec.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1640

C:\Users\Admin\AppData\Roaming\Microsoft\Aqubohm\ftiuw.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Aqubohm\ftiuw.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\AppData\Roaming\Microsoft\Aqubohm\ftiuw.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Aqubohm\ftiuw.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1844

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:804

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn owkzsetin /tr "\"C:\Users\Admin\AppData\Local\Temp\fjvmec.exe\" /I owkzsetin" /SC ONCE /Z /ST 14:44 /ET 14:56
2⤵
- Creates scheduled task(s)
PID:800

C:\Windows\system32\taskeng.exe
taskeng.exe {E6DE943B-517A-43C6-8B9E-F424DEF2C1EA} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:332

C:\Users\Admin\AppData\Local\Temp\fjvmec.exe
C:\Users\Admin\AppData\Local\Temp\fjvmec.exe /I owkzsetin
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1548

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Aqubohm\ftiuw.dat
MD5
dc51a436e3fc915465b0e0092468f26f

SHA1
83f2ef0eaa2bae1567880c447145327ac89ae543

SHA256
aeb0a64f5d9100f215ad0f4f6a33e477dc84427e24b79157bf08b77e09d746fe

SHA512
d909a67ab5f72592a589873f58127d09d1d8c5f03c21e74750bfb4c3652adee3af12d7b4aa730ac8be0a8c5eabe510ad5cff7502be09fc8fcd25d2374723fa7c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Aqubohm\ftiuw.exe
MD5
07e6fa72f03cb8361653252d5c56a336

SHA1
fe64b0aaa04846f76f6c75443a67af67763c1962

SHA256
8893636ffa19c156a1dca90039203a3aba4cca4fb06296df93afc7c5d8016ff5

SHA512
f422dd3f11c89b252543be5337222d544ee4d9873cb87013cc1cd9e4b23a611244d74f5ee85e228441aaffb333d01947202955d6712c84ad74976b587c008337

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Aqubohm\ftiuw.exe
MD5
07e6fa72f03cb8361653252d5c56a336

SHA1
fe64b0aaa04846f76f6c75443a67af67763c1962

SHA256
8893636ffa19c156a1dca90039203a3aba4cca4fb06296df93afc7c5d8016ff5

SHA512
f422dd3f11c89b252543be5337222d544ee4d9873cb87013cc1cd9e4b23a611244d74f5ee85e228441aaffb333d01947202955d6712c84ad74976b587c008337

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Aqubohm\ftiuw.exe
MD5
07e6fa72f03cb8361653252d5c56a336

SHA1
fe64b0aaa04846f76f6c75443a67af67763c1962

SHA256
8893636ffa19c156a1dca90039203a3aba4cca4fb06296df93afc7c5d8016ff5

SHA512
f422dd3f11c89b252543be5337222d544ee4d9873cb87013cc1cd9e4b23a611244d74f5ee85e228441aaffb333d01947202955d6712c84ad74976b587c008337

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Aqubohm\ftiuw.exe
MD5
07e6fa72f03cb8361653252d5c56a336

SHA1
fe64b0aaa04846f76f6c75443a67af67763c1962

SHA256
8893636ffa19c156a1dca90039203a3aba4cca4fb06296df93afc7c5d8016ff5

SHA512
f422dd3f11c89b252543be5337222d544ee4d9873cb87013cc1cd9e4b23a611244d74f5ee85e228441aaffb333d01947202955d6712c84ad74976b587c008337

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Aqubohm\ftiuw.exe
MD5
07e6fa72f03cb8361653252d5c56a336

SHA1
fe64b0aaa04846f76f6c75443a67af67763c1962

SHA256
8893636ffa19c156a1dca90039203a3aba4cca4fb06296df93afc7c5d8016ff5

SHA512
f422dd3f11c89b252543be5337222d544ee4d9873cb87013cc1cd9e4b23a611244d74f5ee85e228441aaffb333d01947202955d6712c84ad74976b587c008337

Download Submit
memory/800-6-0x0000000000000000-mapping.dmp

Download
memory/804-12-0x0000000000000000-mapping.dmp

Download
memory/1548-14-0x0000000000000000-mapping.dmp

Download
memory/1640-0-0x0000000000000000-mapping.dmp

Download
memory/1640-1-0x00000000025D0000-0x00000000025E1000-memory.dmp

Filesize
68KB

Download
memory/1708-4-0x0000000000000000-mapping.dmp

Download
memory/1708-11-0x00000000020A0000-0x00000000020DA000-memory.dmp

Filesize
232KB

Download
memory/1844-8-0x0000000000000000-mapping.dmp

Download
memory/1844-10-0x0000000002710000-0x0000000002721000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads