qakbot | 9f4febd4e0a469c49db13a02a79716de49044f3b9bf01ad2f6972bf3522f9fdd

General

Target

eaxkkg.exe
Size

1.0MB
MD5

4fa5ab6f95c720362e6b87aed616c382
SHA1

69f746490b8a17e65863d3594234d59416f16f88
SHA256

9f4febd4e0a469c49db13a02a79716de49044f3b9bf01ad2f6972bf3522f9fdd
SHA512

69dfc2e4f91bca6cc562a396d49f16abeae46143cfcafb26193338bc16ca03875aad0a52b69b78825243475b0364200a3bb83c0f80b53c032437da0d4ed53341

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

bajtov.exebajtov.exe

pid process

1444 bajtov.exe
668 bajtov.exe
Loads dropped DLL 2 IoCs

Processes:

eaxkkg.exe

pid process

1072 eaxkkg.exe
1072 eaxkkg.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1576 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

eaxkkg.exeeaxkkg.exebajtov.exebajtov.exeexplorer.exeeaxkkg.exe

pid process

1072 eaxkkg.exe
1688 eaxkkg.exe
1688 eaxkkg.exe
1444 bajtov.exe
668 bajtov.exe
668 bajtov.exe
1324 explorer.exe
1324 explorer.exe
812 eaxkkg.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

bajtov.exe

pid process

1444 bajtov.exe

pid	process
1444	bajtov.exe
668	bajtov.exe

pid	process
1072	eaxkkg.exe
1072	eaxkkg.exe

pid	process
1576	schtasks.exe

pid	process
1072	eaxkkg.exe
1688	eaxkkg.exe
1688	eaxkkg.exe
1444	bajtov.exe
668	bajtov.exe
668	bajtov.exe
1324	explorer.exe
1324	explorer.exe
812	eaxkkg.exe

pid	process
1444	bajtov.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

eaxkkg.exebajtov.exetaskeng.exe

description	pid	process	target process
PID 1072 wrote to memory of 1688	1072	eaxkkg.exe	eaxkkg.exe
PID 1072 wrote to memory of 1688	1072	eaxkkg.exe	eaxkkg.exe
PID 1072 wrote to memory of 1688	1072	eaxkkg.exe	eaxkkg.exe
PID 1072 wrote to memory of 1688	1072	eaxkkg.exe	eaxkkg.exe
PID 1072 wrote to memory of 1444	1072	eaxkkg.exe	bajtov.exe
PID 1072 wrote to memory of 1444	1072	eaxkkg.exe	bajtov.exe
PID 1072 wrote to memory of 1444	1072	eaxkkg.exe	bajtov.exe
PID 1072 wrote to memory of 1444	1072	eaxkkg.exe	bajtov.exe
PID 1072 wrote to memory of 1576	1072	eaxkkg.exe	schtasks.exe
PID 1072 wrote to memory of 1576	1072	eaxkkg.exe	schtasks.exe
PID 1072 wrote to memory of 1576	1072	eaxkkg.exe	schtasks.exe
PID 1072 wrote to memory of 1576	1072	eaxkkg.exe	schtasks.exe
PID 1444 wrote to memory of 668	1444	bajtov.exe	bajtov.exe
PID 1444 wrote to memory of 668	1444	bajtov.exe	bajtov.exe
PID 1444 wrote to memory of 668	1444	bajtov.exe	bajtov.exe
PID 1444 wrote to memory of 668	1444	bajtov.exe	bajtov.exe
PID 1444 wrote to memory of 1324	1444	bajtov.exe	explorer.exe
PID 1444 wrote to memory of 1324	1444	bajtov.exe	explorer.exe
PID 1444 wrote to memory of 1324	1444	bajtov.exe	explorer.exe
PID 1444 wrote to memory of 1324	1444	bajtov.exe	explorer.exe
PID 1444 wrote to memory of 1324	1444	bajtov.exe	explorer.exe
PID 380 wrote to memory of 812	380	taskeng.exe	eaxkkg.exe
PID 380 wrote to memory of 812	380	taskeng.exe	eaxkkg.exe
PID 380 wrote to memory of 812	380	taskeng.exe	eaxkkg.exe
PID 380 wrote to memory of 812	380	taskeng.exe	eaxkkg.exe

C:\Users\Admin\AppData\Local\Temp\eaxkkg.exe
"C:\Users\Admin\AppData\Local\Temp\eaxkkg.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1072

C:\Users\Admin\AppData\Local\Temp\eaxkkg.exe
C:\Users\Admin\AppData\Local\Temp\eaxkkg.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1688

C:\Users\Admin\AppData\Roaming\Microsoft\Fuvaismiaok\bajtov.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Fuvaismiaok\bajtov.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1444

C:\Users\Admin\AppData\Roaming\Microsoft\Fuvaismiaok\bajtov.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Fuvaismiaok\bajtov.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:668

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1324

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn oxzhwtzln /tr "\"C:\Users\Admin\AppData\Local\Temp\eaxkkg.exe\" /I oxzhwtzln" /SC ONCE /Z /ST 15:40 /ET 15:52
2⤵
- Creates scheduled task(s)
PID:1576

C:\Windows\system32\taskeng.exe
taskeng.exe {C496FC10-63D1-4DB7-B98A-2547121FA546} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:380

C:\Users\Admin\AppData\Local\Temp\eaxkkg.exe
C:\Users\Admin\AppData\Local\Temp\eaxkkg.exe /I oxzhwtzln
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:812

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Fuvaismiaok\bajtov.dat
MD5
1d2d76038084d21a8fed5c3019eba653

SHA1
86fa6cd9db9e7677de7a2054b8e1cf9b449d9152

SHA256
1068bb6b40a67bf9b90a5d6e5b8bbdfac997a29b2685b4b2b5724b8a094748e7

SHA512
4ebb8dea432cae1f6036534256fad8e0c6fa6500eae2584f88725a8fae4c59f0ac503bcb0704d7286e5088a1bdf9c5bff5fb5ecf8cb5431a5b97a6a0bf1ed3d2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Fuvaismiaok\bajtov.exe
MD5
4fa5ab6f95c720362e6b87aed616c382

SHA1
69f746490b8a17e65863d3594234d59416f16f88

SHA256
9f4febd4e0a469c49db13a02a79716de49044f3b9bf01ad2f6972bf3522f9fdd

SHA512
69dfc2e4f91bca6cc562a396d49f16abeae46143cfcafb26193338bc16ca03875aad0a52b69b78825243475b0364200a3bb83c0f80b53c032437da0d4ed53341

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Fuvaismiaok\bajtov.exe
MD5
4fa5ab6f95c720362e6b87aed616c382

SHA1
69f746490b8a17e65863d3594234d59416f16f88

SHA256
9f4febd4e0a469c49db13a02a79716de49044f3b9bf01ad2f6972bf3522f9fdd

SHA512
69dfc2e4f91bca6cc562a396d49f16abeae46143cfcafb26193338bc16ca03875aad0a52b69b78825243475b0364200a3bb83c0f80b53c032437da0d4ed53341

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Fuvaismiaok\bajtov.exe
MD5
4fa5ab6f95c720362e6b87aed616c382

SHA1
69f746490b8a17e65863d3594234d59416f16f88

SHA256
9f4febd4e0a469c49db13a02a79716de49044f3b9bf01ad2f6972bf3522f9fdd

SHA512
69dfc2e4f91bca6cc562a396d49f16abeae46143cfcafb26193338bc16ca03875aad0a52b69b78825243475b0364200a3bb83c0f80b53c032437da0d4ed53341

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Fuvaismiaok\bajtov.exe
MD5
4fa5ab6f95c720362e6b87aed616c382

SHA1
69f746490b8a17e65863d3594234d59416f16f88

SHA256
9f4febd4e0a469c49db13a02a79716de49044f3b9bf01ad2f6972bf3522f9fdd

SHA512
69dfc2e4f91bca6cc562a396d49f16abeae46143cfcafb26193338bc16ca03875aad0a52b69b78825243475b0364200a3bb83c0f80b53c032437da0d4ed53341

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Fuvaismiaok\bajtov.exe
MD5
4fa5ab6f95c720362e6b87aed616c382

SHA1
69f746490b8a17e65863d3594234d59416f16f88

SHA256
9f4febd4e0a469c49db13a02a79716de49044f3b9bf01ad2f6972bf3522f9fdd

SHA512
69dfc2e4f91bca6cc562a396d49f16abeae46143cfcafb26193338bc16ca03875aad0a52b69b78825243475b0364200a3bb83c0f80b53c032437da0d4ed53341

Download Submit
memory/668-10-0x00000000025C0000-0x00000000025D1000-memory.dmp

Filesize
68KB

Download
memory/668-8-0x0000000000000000-mapping.dmp

Download
memory/812-15-0x0000000000000000-mapping.dmp

Download
memory/1324-12-0x0000000000000000-mapping.dmp

Download
memory/1444-11-0x00000000021C0000-0x00000000021FA000-memory.dmp

Filesize
232KB

Download
memory/1444-4-0x0000000000000000-mapping.dmp

Download
memory/1576-6-0x0000000000000000-mapping.dmp

Download
memory/1688-0-0x0000000000000000-mapping.dmp

Download
memory/1688-1-0x00000000024D0000-0x00000000024E1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads