qakbot | 051a094b6a885028ca710646cbd832ad83eaaeb2688df06d0db8e479acb6522e

General

Target

autyif.exe
Size

1.0MB
MD5

f20fd1e4b4ac73da6380284a63e2a028
SHA1

3987a8ddb99b9cb3ea6faeadfc4353abf1f61d37
SHA256

051a094b6a885028ca710646cbd832ad83eaaeb2688df06d0db8e479acb6522e
SHA512

6b16eefa696a1cd87de47e9aa7ed0d625d802c45f1ae17971a2d62a3ec1b8e89120fc15eac5fd05d0538050facd26ce8e2195450925b630f461999ceca9a85ad

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

xxujel.exexxujel.exe

pid process

1564 xxujel.exe
1344 xxujel.exe
Loads dropped DLL 2 IoCs

Processes:

autyif.exe

pid process

1688 autyif.exe
1688 autyif.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1584 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

autyif.exeautyif.exexxujel.exexxujel.exeexplorer.exeautyif.exe

pid process

1688 autyif.exe
1560 autyif.exe
1560 autyif.exe
1564 xxujel.exe
1344 xxujel.exe
1344 xxujel.exe
324 explorer.exe
324 explorer.exe
1516 autyif.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

xxujel.exe

pid process

1564 xxujel.exe

pid	process
1564	xxujel.exe
1344	xxujel.exe

pid	process
1688	autyif.exe
1688	autyif.exe

pid	process
1584	schtasks.exe

pid	process
1688	autyif.exe
1560	autyif.exe
1560	autyif.exe
1564	xxujel.exe
1344	xxujel.exe
1344	xxujel.exe
324	explorer.exe
324	explorer.exe
1516	autyif.exe

pid	process
1564	xxujel.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

autyif.exexxujel.exetaskeng.exe

description	pid	process	target process
PID 1688 wrote to memory of 1560	1688	autyif.exe	autyif.exe
PID 1688 wrote to memory of 1560	1688	autyif.exe	autyif.exe
PID 1688 wrote to memory of 1560	1688	autyif.exe	autyif.exe
PID 1688 wrote to memory of 1560	1688	autyif.exe	autyif.exe
PID 1688 wrote to memory of 1564	1688	autyif.exe	xxujel.exe
PID 1688 wrote to memory of 1564	1688	autyif.exe	xxujel.exe
PID 1688 wrote to memory of 1564	1688	autyif.exe	xxujel.exe
PID 1688 wrote to memory of 1564	1688	autyif.exe	xxujel.exe
PID 1688 wrote to memory of 1584	1688	autyif.exe	schtasks.exe
PID 1688 wrote to memory of 1584	1688	autyif.exe	schtasks.exe
PID 1688 wrote to memory of 1584	1688	autyif.exe	schtasks.exe
PID 1688 wrote to memory of 1584	1688	autyif.exe	schtasks.exe
PID 1564 wrote to memory of 1344	1564	xxujel.exe	xxujel.exe
PID 1564 wrote to memory of 1344	1564	xxujel.exe	xxujel.exe
PID 1564 wrote to memory of 1344	1564	xxujel.exe	xxujel.exe
PID 1564 wrote to memory of 1344	1564	xxujel.exe	xxujel.exe
PID 1564 wrote to memory of 324	1564	xxujel.exe	explorer.exe
PID 1564 wrote to memory of 324	1564	xxujel.exe	explorer.exe
PID 1564 wrote to memory of 324	1564	xxujel.exe	explorer.exe
PID 1564 wrote to memory of 324	1564	xxujel.exe	explorer.exe
PID 1564 wrote to memory of 324	1564	xxujel.exe	explorer.exe
PID 1548 wrote to memory of 1516	1548	taskeng.exe	autyif.exe
PID 1548 wrote to memory of 1516	1548	taskeng.exe	autyif.exe
PID 1548 wrote to memory of 1516	1548	taskeng.exe	autyif.exe
PID 1548 wrote to memory of 1516	1548	taskeng.exe	autyif.exe

C:\Users\Admin\AppData\Local\Temp\autyif.exe
"C:\Users\Admin\AppData\Local\Temp\autyif.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Admin\AppData\Local\Temp\autyif.exe
C:\Users\Admin\AppData\Local\Temp\autyif.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1560

C:\Users\Admin\AppData\Roaming\Microsoft\Kbgewjqgenx\xxujel.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Kbgewjqgenx\xxujel.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1564

C:\Users\Admin\AppData\Roaming\Microsoft\Kbgewjqgenx\xxujel.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Kbgewjqgenx\xxujel.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1344

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:324

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jimufju /tr "\"C:\Users\Admin\AppData\Local\Temp\autyif.exe\" /I jimufju" /SC ONCE /Z /ST 15:44 /ET 15:56
2⤵
- Creates scheduled task(s)
PID:1584

C:\Windows\system32\taskeng.exe
taskeng.exe {43250AD1-7F5D-4704-95FA-E4D3336CC468} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1548

C:\Users\Admin\AppData\Local\Temp\autyif.exe
C:\Users\Admin\AppData\Local\Temp\autyif.exe /I jimufju
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1516

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Kbgewjqgenx\xxujel.dat
MD5
5ba23a15406f24ce62cc379c311bdfde

SHA1
a5e0f2ec2c9ee2bc6c461ecdafc1733add4428d7

SHA256
6d48f269196367ec552c5a1a08f649bd0ab2e69be93fa07e2b907be7252c27b3

SHA512
51bf5790680e37abfa0361dd9fb018f72f2c284813858c20ae3357bebdaf0d53cc5a5c2332511965c4d84688af9a6f0777e14003173e531ecbfa3b0a71af7275

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Kbgewjqgenx\xxujel.exe
MD5
f20fd1e4b4ac73da6380284a63e2a028

SHA1
3987a8ddb99b9cb3ea6faeadfc4353abf1f61d37

SHA256
051a094b6a885028ca710646cbd832ad83eaaeb2688df06d0db8e479acb6522e

SHA512
6b16eefa696a1cd87de47e9aa7ed0d625d802c45f1ae17971a2d62a3ec1b8e89120fc15eac5fd05d0538050facd26ce8e2195450925b630f461999ceca9a85ad

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Kbgewjqgenx\xxujel.exe
MD5
f20fd1e4b4ac73da6380284a63e2a028

SHA1
3987a8ddb99b9cb3ea6faeadfc4353abf1f61d37

SHA256
051a094b6a885028ca710646cbd832ad83eaaeb2688df06d0db8e479acb6522e

SHA512
6b16eefa696a1cd87de47e9aa7ed0d625d802c45f1ae17971a2d62a3ec1b8e89120fc15eac5fd05d0538050facd26ce8e2195450925b630f461999ceca9a85ad

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Kbgewjqgenx\xxujel.exe
MD5
f20fd1e4b4ac73da6380284a63e2a028

SHA1
3987a8ddb99b9cb3ea6faeadfc4353abf1f61d37

SHA256
051a094b6a885028ca710646cbd832ad83eaaeb2688df06d0db8e479acb6522e

SHA512
6b16eefa696a1cd87de47e9aa7ed0d625d802c45f1ae17971a2d62a3ec1b8e89120fc15eac5fd05d0538050facd26ce8e2195450925b630f461999ceca9a85ad

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Kbgewjqgenx\xxujel.exe
MD5
f20fd1e4b4ac73da6380284a63e2a028

SHA1
3987a8ddb99b9cb3ea6faeadfc4353abf1f61d37

SHA256
051a094b6a885028ca710646cbd832ad83eaaeb2688df06d0db8e479acb6522e

SHA512
6b16eefa696a1cd87de47e9aa7ed0d625d802c45f1ae17971a2d62a3ec1b8e89120fc15eac5fd05d0538050facd26ce8e2195450925b630f461999ceca9a85ad

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Kbgewjqgenx\xxujel.exe
MD5
f20fd1e4b4ac73da6380284a63e2a028

SHA1
3987a8ddb99b9cb3ea6faeadfc4353abf1f61d37

SHA256
051a094b6a885028ca710646cbd832ad83eaaeb2688df06d0db8e479acb6522e

SHA512
6b16eefa696a1cd87de47e9aa7ed0d625d802c45f1ae17971a2d62a3ec1b8e89120fc15eac5fd05d0538050facd26ce8e2195450925b630f461999ceca9a85ad

Download Submit
memory/324-12-0x0000000000000000-mapping.dmp

Download
memory/1344-8-0x0000000000000000-mapping.dmp

Download
memory/1344-10-0x0000000002520000-0x0000000002531000-memory.dmp

Filesize
68KB

Download
memory/1516-14-0x0000000000000000-mapping.dmp

Download
memory/1560-0-0x0000000000000000-mapping.dmp

Download
memory/1560-1-0x00000000025C0000-0x00000000025D1000-memory.dmp

Filesize
68KB

Download
memory/1564-4-0x0000000000000000-mapping.dmp

Download
memory/1564-11-0x00000000006A0000-0x00000000006DA000-memory.dmp

Filesize
232KB

Download
memory/1584-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads