qakbot | b5316703c39a2dab22b44570ce262675af670354c2b68b03223f61f049ea2d60

General

Target

pfzdts.exe
Size

1.0MB
MD5

1731fd58a68498cdbec014dc9b89ac6f
SHA1

668e8169e4fc88b54a74ed4f10f150a7d4abc9f1
SHA256

b5316703c39a2dab22b44570ce262675af670354c2b68b03223f61f049ea2d60
SHA512

fb986832e67d160b2927e21f11f65601e1f923baa8237a2f295eb44c6b453c8094a19dfc1eb976b1d726180e72573a4536f3921f94694c12078a3f45807a9451

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

eaartykx.exeeaartykx.exe

pid process

1712 eaartykx.exe
1652 eaartykx.exe
Loads dropped DLL 2 IoCs

Processes:

pfzdts.exe

pid process

1876 pfzdts.exe
1876 pfzdts.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1660 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

pfzdts.exepfzdts.exeeaartykx.exeeaartykx.exeexplorer.exepfzdts.exe

pid process

1876 pfzdts.exe
1744 pfzdts.exe
1744 pfzdts.exe
1712 eaartykx.exe
1652 eaartykx.exe
1652 eaartykx.exe
1676 explorer.exe
1676 explorer.exe
1984 pfzdts.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

eaartykx.exe

pid process

1712 eaartykx.exe

pid	process
1712	eaartykx.exe
1652	eaartykx.exe

pid	process
1876	pfzdts.exe
1876	pfzdts.exe

pid	process
1660	schtasks.exe

pid	process
1876	pfzdts.exe
1744	pfzdts.exe
1744	pfzdts.exe
1712	eaartykx.exe
1652	eaartykx.exe
1652	eaartykx.exe
1676	explorer.exe
1676	explorer.exe
1984	pfzdts.exe

pid	process
1712	eaartykx.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

pfzdts.exeeaartykx.exetaskeng.exe

description	pid	process	target process
PID 1876 wrote to memory of 1744	1876	pfzdts.exe	pfzdts.exe
PID 1876 wrote to memory of 1744	1876	pfzdts.exe	pfzdts.exe
PID 1876 wrote to memory of 1744	1876	pfzdts.exe	pfzdts.exe
PID 1876 wrote to memory of 1744	1876	pfzdts.exe	pfzdts.exe
PID 1876 wrote to memory of 1712	1876	pfzdts.exe	eaartykx.exe
PID 1876 wrote to memory of 1712	1876	pfzdts.exe	eaartykx.exe
PID 1876 wrote to memory of 1712	1876	pfzdts.exe	eaartykx.exe
PID 1876 wrote to memory of 1712	1876	pfzdts.exe	eaartykx.exe
PID 1876 wrote to memory of 1660	1876	pfzdts.exe	schtasks.exe
PID 1876 wrote to memory of 1660	1876	pfzdts.exe	schtasks.exe
PID 1876 wrote to memory of 1660	1876	pfzdts.exe	schtasks.exe
PID 1876 wrote to memory of 1660	1876	pfzdts.exe	schtasks.exe
PID 1712 wrote to memory of 1652	1712	eaartykx.exe	eaartykx.exe
PID 1712 wrote to memory of 1652	1712	eaartykx.exe	eaartykx.exe
PID 1712 wrote to memory of 1652	1712	eaartykx.exe	eaartykx.exe
PID 1712 wrote to memory of 1652	1712	eaartykx.exe	eaartykx.exe
PID 1712 wrote to memory of 1676	1712	eaartykx.exe	explorer.exe
PID 1712 wrote to memory of 1676	1712	eaartykx.exe	explorer.exe
PID 1712 wrote to memory of 1676	1712	eaartykx.exe	explorer.exe
PID 1712 wrote to memory of 1676	1712	eaartykx.exe	explorer.exe
PID 1712 wrote to memory of 1676	1712	eaartykx.exe	explorer.exe
PID 928 wrote to memory of 1984	928	taskeng.exe	pfzdts.exe
PID 928 wrote to memory of 1984	928	taskeng.exe	pfzdts.exe
PID 928 wrote to memory of 1984	928	taskeng.exe	pfzdts.exe
PID 928 wrote to memory of 1984	928	taskeng.exe	pfzdts.exe

C:\Users\Admin\AppData\Local\Temp\pfzdts.exe
"C:\Users\Admin\AppData\Local\Temp\pfzdts.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1876

C:\Users\Admin\AppData\Local\Temp\pfzdts.exe
C:\Users\Admin\AppData\Local\Temp\pfzdts.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1744

C:\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1712

C:\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1652

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1676

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wrseyxv /tr "\"C:\Users\Admin\AppData\Local\Temp\pfzdts.exe\" /I wrseyxv" /SC ONCE /Z /ST 15:45 /ET 15:57
2⤵
- Creates scheduled task(s)
PID:1660

C:\Windows\system32\taskeng.exe
taskeng.exe {0B136589-92A8-4414-AE58-FA7B56F7A24A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:928

C:\Users\Admin\AppData\Local\Temp\pfzdts.exe
C:\Users\Admin\AppData\Local\Temp\pfzdts.exe /I wrseyxv
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1984

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.dat
MD5
51ace9938c6a45d38c533b2e62cdbe54

SHA1
4034125111726913e03980671d5c408e2267be15

SHA256
d2384477d7cb43c7879799fbd078338f5be37f8b7f6bf4a3138683b6b5cf8bc4

SHA512
f57b1f7108df8dbc2eb49e9600651257230c1595fe5464d8b1e20618a93149371e419865387cf3baff9e086f918940a597de210885768dae1b1e9397bb1c842b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe
MD5
1731fd58a68498cdbec014dc9b89ac6f

SHA1
668e8169e4fc88b54a74ed4f10f150a7d4abc9f1

SHA256
b5316703c39a2dab22b44570ce262675af670354c2b68b03223f61f049ea2d60

SHA512
fb986832e67d160b2927e21f11f65601e1f923baa8237a2f295eb44c6b453c8094a19dfc1eb976b1d726180e72573a4536f3921f94694c12078a3f45807a9451

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe
MD5
1731fd58a68498cdbec014dc9b89ac6f

SHA1
668e8169e4fc88b54a74ed4f10f150a7d4abc9f1

SHA256
b5316703c39a2dab22b44570ce262675af670354c2b68b03223f61f049ea2d60

SHA512
fb986832e67d160b2927e21f11f65601e1f923baa8237a2f295eb44c6b453c8094a19dfc1eb976b1d726180e72573a4536f3921f94694c12078a3f45807a9451

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe
MD5
1731fd58a68498cdbec014dc9b89ac6f

SHA1
668e8169e4fc88b54a74ed4f10f150a7d4abc9f1

SHA256
b5316703c39a2dab22b44570ce262675af670354c2b68b03223f61f049ea2d60

SHA512
fb986832e67d160b2927e21f11f65601e1f923baa8237a2f295eb44c6b453c8094a19dfc1eb976b1d726180e72573a4536f3921f94694c12078a3f45807a9451

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe
MD5
1731fd58a68498cdbec014dc9b89ac6f

SHA1
668e8169e4fc88b54a74ed4f10f150a7d4abc9f1

SHA256
b5316703c39a2dab22b44570ce262675af670354c2b68b03223f61f049ea2d60

SHA512
fb986832e67d160b2927e21f11f65601e1f923baa8237a2f295eb44c6b453c8094a19dfc1eb976b1d726180e72573a4536f3921f94694c12078a3f45807a9451

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe
MD5
1731fd58a68498cdbec014dc9b89ac6f

SHA1
668e8169e4fc88b54a74ed4f10f150a7d4abc9f1

SHA256
b5316703c39a2dab22b44570ce262675af670354c2b68b03223f61f049ea2d60

SHA512
fb986832e67d160b2927e21f11f65601e1f923baa8237a2f295eb44c6b453c8094a19dfc1eb976b1d726180e72573a4536f3921f94694c12078a3f45807a9451

Download Submit
memory/1652-10-0x00000000026B0000-0x00000000026C1000-memory.dmp

Filesize
68KB

Download
memory/1652-8-0x0000000000000000-mapping.dmp

Download
memory/1660-6-0x0000000000000000-mapping.dmp

Download
memory/1676-12-0x0000000000000000-mapping.dmp

Download
memory/1712-11-0x0000000000330000-0x000000000036A000-memory.dmp

Filesize
232KB

Download
memory/1712-4-0x0000000000000000-mapping.dmp

Download
memory/1744-0-0x0000000000000000-mapping.dmp

Download
memory/1744-1-0x0000000002570000-0x0000000002581000-memory.dmp

Filesize
68KB

Download
memory/1984-15-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads