qakbot | ef7868b4214bd25a27789c6e55e7678d67068f067c09888c16f884fd5550aaac

General

Target

uwrmmp.exe
Size

1.0MB
MD5

be468a7eedab921f83b8d34cef84112b
SHA1

963b47880567d006eca39f8baf8250fa02049baa
SHA256

ef7868b4214bd25a27789c6e55e7678d67068f067c09888c16f884fd5550aaac
SHA512

1bbfe62f55110db02ec28b940c644998ab1edffaa0248b22d17ab4116b6bcc4030ae2cf82cc05f3a87a3624ea2b909d7b30d37e78bdde6ac93d3aae76688ad46

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

ouzlvbom.exeouzlvbom.exe

pid process

1232 ouzlvbom.exe
524 ouzlvbom.exe
Loads dropped DLL 2 IoCs

Processes:

uwrmmp.exe

pid process

684 uwrmmp.exe
684 uwrmmp.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1336 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

uwrmmp.exeuwrmmp.exeouzlvbom.exeouzlvbom.exeexplorer.exe

pid process

684 uwrmmp.exe
1316 uwrmmp.exe
1316 uwrmmp.exe
1232 ouzlvbom.exe
524 ouzlvbom.exe
524 ouzlvbom.exe
1672 explorer.exe
1672 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ouzlvbom.exe

pid process

1232 ouzlvbom.exe

pid	process
1232	ouzlvbom.exe
524	ouzlvbom.exe

pid	process
684	uwrmmp.exe
684	uwrmmp.exe

pid	process
1336	schtasks.exe

pid	process
684	uwrmmp.exe
1316	uwrmmp.exe
1316	uwrmmp.exe
1232	ouzlvbom.exe
524	ouzlvbom.exe
524	ouzlvbom.exe
1672	explorer.exe
1672	explorer.exe

pid	process
1232	ouzlvbom.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

uwrmmp.exeouzlvbom.exetaskeng.exe

description	pid	process	target process
PID 684 wrote to memory of 1316	684	uwrmmp.exe	uwrmmp.exe
PID 684 wrote to memory of 1316	684	uwrmmp.exe	uwrmmp.exe
PID 684 wrote to memory of 1316	684	uwrmmp.exe	uwrmmp.exe
PID 684 wrote to memory of 1316	684	uwrmmp.exe	uwrmmp.exe
PID 684 wrote to memory of 1232	684	uwrmmp.exe	ouzlvbom.exe
PID 684 wrote to memory of 1232	684	uwrmmp.exe	ouzlvbom.exe
PID 684 wrote to memory of 1232	684	uwrmmp.exe	ouzlvbom.exe
PID 684 wrote to memory of 1232	684	uwrmmp.exe	ouzlvbom.exe
PID 684 wrote to memory of 1336	684	uwrmmp.exe	schtasks.exe
PID 684 wrote to memory of 1336	684	uwrmmp.exe	schtasks.exe
PID 684 wrote to memory of 1336	684	uwrmmp.exe	schtasks.exe
PID 684 wrote to memory of 1336	684	uwrmmp.exe	schtasks.exe
PID 1232 wrote to memory of 524	1232	ouzlvbom.exe	ouzlvbom.exe
PID 1232 wrote to memory of 524	1232	ouzlvbom.exe	ouzlvbom.exe
PID 1232 wrote to memory of 524	1232	ouzlvbom.exe	ouzlvbom.exe
PID 1232 wrote to memory of 524	1232	ouzlvbom.exe	ouzlvbom.exe
PID 1232 wrote to memory of 1672	1232	ouzlvbom.exe	explorer.exe
PID 1232 wrote to memory of 1672	1232	ouzlvbom.exe	explorer.exe
PID 1232 wrote to memory of 1672	1232	ouzlvbom.exe	explorer.exe
PID 1232 wrote to memory of 1672	1232	ouzlvbom.exe	explorer.exe
PID 1232 wrote to memory of 1672	1232	ouzlvbom.exe	explorer.exe
PID 1028 wrote to memory of 584	1028	taskeng.exe	uwrmmp.exe
PID 1028 wrote to memory of 584	1028	taskeng.exe	uwrmmp.exe
PID 1028 wrote to memory of 584	1028	taskeng.exe	uwrmmp.exe
PID 1028 wrote to memory of 584	1028	taskeng.exe	uwrmmp.exe

C:\Users\Admin\AppData\Local\Temp\uwrmmp.exe
"C:\Users\Admin\AppData\Local\Temp\uwrmmp.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:684

C:\Users\Admin\AppData\Local\Temp\uwrmmp.exe
C:\Users\Admin\AppData\Local\Temp\uwrmmp.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1316

C:\Users\Admin\AppData\Roaming\Microsoft\Rumoadr\ouzlvbom.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Rumoadr\ouzlvbom.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1232

C:\Users\Admin\AppData\Roaming\Microsoft\Rumoadr\ouzlvbom.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Rumoadr\ouzlvbom.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:524

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1672

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn sglhxossmu /tr "\"C:\Users\Admin\AppData\Local\Temp\uwrmmp.exe\" /I sglhxossmu" /SC ONCE /Z /ST 15:45 /ET 15:57
2⤵
- Creates scheduled task(s)
PID:1336

C:\Windows\system32\taskeng.exe
taskeng.exe {F96DC4B1-793D-48C1-931E-7E476AA4EA47} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1028

C:\Users\Admin\AppData\Local\Temp\uwrmmp.exe
C:\Users\Admin\AppData\Local\Temp\uwrmmp.exe /I sglhxossmu
2⤵
PID:584

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Rumoadr\ouzlvbom.dat
MD5
63b620ebf240bb4b621aaf2ba7707f62

SHA1
e9d02fd306804fa22f1583be98b3320c284be2cb

SHA256
01a3cf02dcd5785bad678ac3cb6227c233c29827b2b0d6a3b8fef70d7a3f660f

SHA512
c4652c05c529cc2d98ec9c13521cd20c20b5f696dbc23d770c106df03055c3396d2d5e32de8b0b192bf79c756ad486f2253799fc4aed02ca40346127f162ea98

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Rumoadr\ouzlvbom.exe
MD5
be468a7eedab921f83b8d34cef84112b

SHA1
963b47880567d006eca39f8baf8250fa02049baa

SHA256
ef7868b4214bd25a27789c6e55e7678d67068f067c09888c16f884fd5550aaac

SHA512
1bbfe62f55110db02ec28b940c644998ab1edffaa0248b22d17ab4116b6bcc4030ae2cf82cc05f3a87a3624ea2b909d7b30d37e78bdde6ac93d3aae76688ad46

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Rumoadr\ouzlvbom.exe
MD5
be468a7eedab921f83b8d34cef84112b

SHA1
963b47880567d006eca39f8baf8250fa02049baa

SHA256
ef7868b4214bd25a27789c6e55e7678d67068f067c09888c16f884fd5550aaac

SHA512
1bbfe62f55110db02ec28b940c644998ab1edffaa0248b22d17ab4116b6bcc4030ae2cf82cc05f3a87a3624ea2b909d7b30d37e78bdde6ac93d3aae76688ad46

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Rumoadr\ouzlvbom.exe
MD5
be468a7eedab921f83b8d34cef84112b

SHA1
963b47880567d006eca39f8baf8250fa02049baa

SHA256
ef7868b4214bd25a27789c6e55e7678d67068f067c09888c16f884fd5550aaac

SHA512
1bbfe62f55110db02ec28b940c644998ab1edffaa0248b22d17ab4116b6bcc4030ae2cf82cc05f3a87a3624ea2b909d7b30d37e78bdde6ac93d3aae76688ad46

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Rumoadr\ouzlvbom.exe
MD5
be468a7eedab921f83b8d34cef84112b

SHA1
963b47880567d006eca39f8baf8250fa02049baa

SHA256
ef7868b4214bd25a27789c6e55e7678d67068f067c09888c16f884fd5550aaac

SHA512
1bbfe62f55110db02ec28b940c644998ab1edffaa0248b22d17ab4116b6bcc4030ae2cf82cc05f3a87a3624ea2b909d7b30d37e78bdde6ac93d3aae76688ad46

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Rumoadr\ouzlvbom.exe
MD5
be468a7eedab921f83b8d34cef84112b

SHA1
963b47880567d006eca39f8baf8250fa02049baa

SHA256
ef7868b4214bd25a27789c6e55e7678d67068f067c09888c16f884fd5550aaac

SHA512
1bbfe62f55110db02ec28b940c644998ab1edffaa0248b22d17ab4116b6bcc4030ae2cf82cc05f3a87a3624ea2b909d7b30d37e78bdde6ac93d3aae76688ad46

Download Submit
memory/524-10-0x0000000002760000-0x0000000002771000-memory.dmp

Filesize
68KB

Download
memory/524-8-0x0000000000000000-mapping.dmp

Download
memory/584-14-0x0000000000000000-mapping.dmp

Download
memory/1232-4-0x0000000000000000-mapping.dmp

Download
memory/1232-11-0x0000000002170000-0x00000000021AA000-memory.dmp

Filesize
232KB

Download
memory/1316-0-0x0000000000000000-mapping.dmp

Download
memory/1316-1-0x0000000002680000-0x0000000002691000-memory.dmp

Filesize
68KB

Download
memory/1336-6-0x0000000000000000-mapping.dmp

Download
memory/1672-12-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads