qakbot | b4caa3a2a69482fc9de880d0828a1f3496afebb1db88ffa7adee728c5b4cac3f

General

Target

inpvrb.exe
Size

1.0MB
MD5

996d91b8ed0113d6612a4ce1a6e127d0
SHA1

76e9a0a6fea686494d2ca99a4ed9c1f1bd5944bb
SHA256

b4caa3a2a69482fc9de880d0828a1f3496afebb1db88ffa7adee728c5b4cac3f
SHA512

fb85af1a5a46323bfbed3d04437f2e4d27a552ca1ba7886dfaee8fa85fe7d66b3cec17519f0402484df03887193b2488a7d4743b3efba60b361e2c6d816809b5

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

xeivgwga.exexeivgwga.exe

pid process

1316 xeivgwga.exe
1732 xeivgwga.exe
Loads dropped DLL 2 IoCs

Processes:

inpvrb.exe

pid process

1004 inpvrb.exe
1004 inpvrb.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1320 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

inpvrb.exeinpvrb.exexeivgwga.exexeivgwga.exeexplorer.exeinpvrb.exe

pid process

1004 inpvrb.exe
1756 inpvrb.exe
1756 inpvrb.exe
1316 xeivgwga.exe
1732 xeivgwga.exe
1732 xeivgwga.exe
1020 explorer.exe
1020 explorer.exe
524 inpvrb.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

xeivgwga.exe

pid process

1316 xeivgwga.exe

pid	process
1316	xeivgwga.exe
1732	xeivgwga.exe

pid	process
1004	inpvrb.exe
1004	inpvrb.exe

pid	process
1320	schtasks.exe

pid	process
1004	inpvrb.exe
1756	inpvrb.exe
1756	inpvrb.exe
1316	xeivgwga.exe
1732	xeivgwga.exe
1732	xeivgwga.exe
1020	explorer.exe
1020	explorer.exe
524	inpvrb.exe

pid	process
1316	xeivgwga.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

inpvrb.exexeivgwga.exetaskeng.exe

description	pid	process	target process
PID 1004 wrote to memory of 1756	1004	inpvrb.exe	inpvrb.exe
PID 1004 wrote to memory of 1756	1004	inpvrb.exe	inpvrb.exe
PID 1004 wrote to memory of 1756	1004	inpvrb.exe	inpvrb.exe
PID 1004 wrote to memory of 1756	1004	inpvrb.exe	inpvrb.exe
PID 1004 wrote to memory of 1316	1004	inpvrb.exe	xeivgwga.exe
PID 1004 wrote to memory of 1316	1004	inpvrb.exe	xeivgwga.exe
PID 1004 wrote to memory of 1316	1004	inpvrb.exe	xeivgwga.exe
PID 1004 wrote to memory of 1316	1004	inpvrb.exe	xeivgwga.exe
PID 1004 wrote to memory of 1320	1004	inpvrb.exe	schtasks.exe
PID 1004 wrote to memory of 1320	1004	inpvrb.exe	schtasks.exe
PID 1004 wrote to memory of 1320	1004	inpvrb.exe	schtasks.exe
PID 1004 wrote to memory of 1320	1004	inpvrb.exe	schtasks.exe
PID 1316 wrote to memory of 1732	1316	xeivgwga.exe	xeivgwga.exe
PID 1316 wrote to memory of 1732	1316	xeivgwga.exe	xeivgwga.exe
PID 1316 wrote to memory of 1732	1316	xeivgwga.exe	xeivgwga.exe
PID 1316 wrote to memory of 1732	1316	xeivgwga.exe	xeivgwga.exe
PID 1316 wrote to memory of 1020	1316	xeivgwga.exe	explorer.exe
PID 1316 wrote to memory of 1020	1316	xeivgwga.exe	explorer.exe
PID 1316 wrote to memory of 1020	1316	xeivgwga.exe	explorer.exe
PID 1316 wrote to memory of 1020	1316	xeivgwga.exe	explorer.exe
PID 1316 wrote to memory of 1020	1316	xeivgwga.exe	explorer.exe
PID 852 wrote to memory of 524	852	taskeng.exe	inpvrb.exe
PID 852 wrote to memory of 524	852	taskeng.exe	inpvrb.exe
PID 852 wrote to memory of 524	852	taskeng.exe	inpvrb.exe
PID 852 wrote to memory of 524	852	taskeng.exe	inpvrb.exe

C:\Users\Admin\AppData\Local\Temp\inpvrb.exe
"C:\Users\Admin\AppData\Local\Temp\inpvrb.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1004

C:\Users\Admin\AppData\Local\Temp\inpvrb.exe
C:\Users\Admin\AppData\Local\Temp\inpvrb.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1756

C:\Users\Admin\AppData\Roaming\Microsoft\Opzumfaa\xeivgwga.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Opzumfaa\xeivgwga.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1316

C:\Users\Admin\AppData\Roaming\Microsoft\Opzumfaa\xeivgwga.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Opzumfaa\xeivgwga.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1732

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1020

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zytbisjb /tr "\"C:\Users\Admin\AppData\Local\Temp\inpvrb.exe\" /I zytbisjb" /SC ONCE /Z /ST 15:39 /ET 15:51
2⤵
- Creates scheduled task(s)
PID:1320

C:\Windows\system32\taskeng.exe
taskeng.exe {A82F9133-BB7D-4655-BC90-4962B96EECA3} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:852

C:\Users\Admin\AppData\Local\Temp\inpvrb.exe
C:\Users\Admin\AppData\Local\Temp\inpvrb.exe /I zytbisjb
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:524

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Opzumfaa\xeivgwga.dat
MD5
b55f9f02930ee4c1fc3ee3d4a755928b

SHA1
c5df6478675adad145fe09b4078a62dd502e62dd

SHA256
9acb0aa87cddd5047850510be38111dfb59b252450f05b84a59df7f8b3817f2c

SHA512
d387f8473c21534734a8584f13ddf85d6dfbc9f6bab427fa0c351443801f15b9399b777effcbea08c8d86b307d0161808d0a6ac7687d9b49871948af11ec5af3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Opzumfaa\xeivgwga.exe
MD5
996d91b8ed0113d6612a4ce1a6e127d0

SHA1
76e9a0a6fea686494d2ca99a4ed9c1f1bd5944bb

SHA256
b4caa3a2a69482fc9de880d0828a1f3496afebb1db88ffa7adee728c5b4cac3f

SHA512
fb85af1a5a46323bfbed3d04437f2e4d27a552ca1ba7886dfaee8fa85fe7d66b3cec17519f0402484df03887193b2488a7d4743b3efba60b361e2c6d816809b5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Opzumfaa\xeivgwga.exe
MD5
996d91b8ed0113d6612a4ce1a6e127d0

SHA1
76e9a0a6fea686494d2ca99a4ed9c1f1bd5944bb

SHA256
b4caa3a2a69482fc9de880d0828a1f3496afebb1db88ffa7adee728c5b4cac3f

SHA512
fb85af1a5a46323bfbed3d04437f2e4d27a552ca1ba7886dfaee8fa85fe7d66b3cec17519f0402484df03887193b2488a7d4743b3efba60b361e2c6d816809b5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Opzumfaa\xeivgwga.exe
MD5
996d91b8ed0113d6612a4ce1a6e127d0

SHA1
76e9a0a6fea686494d2ca99a4ed9c1f1bd5944bb

SHA256
b4caa3a2a69482fc9de880d0828a1f3496afebb1db88ffa7adee728c5b4cac3f

SHA512
fb85af1a5a46323bfbed3d04437f2e4d27a552ca1ba7886dfaee8fa85fe7d66b3cec17519f0402484df03887193b2488a7d4743b3efba60b361e2c6d816809b5

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Opzumfaa\xeivgwga.exe
MD5
996d91b8ed0113d6612a4ce1a6e127d0

SHA1
76e9a0a6fea686494d2ca99a4ed9c1f1bd5944bb

SHA256
b4caa3a2a69482fc9de880d0828a1f3496afebb1db88ffa7adee728c5b4cac3f

SHA512
fb85af1a5a46323bfbed3d04437f2e4d27a552ca1ba7886dfaee8fa85fe7d66b3cec17519f0402484df03887193b2488a7d4743b3efba60b361e2c6d816809b5

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Opzumfaa\xeivgwga.exe
MD5
996d91b8ed0113d6612a4ce1a6e127d0

SHA1
76e9a0a6fea686494d2ca99a4ed9c1f1bd5944bb

SHA256
b4caa3a2a69482fc9de880d0828a1f3496afebb1db88ffa7adee728c5b4cac3f

SHA512
fb85af1a5a46323bfbed3d04437f2e4d27a552ca1ba7886dfaee8fa85fe7d66b3cec17519f0402484df03887193b2488a7d4743b3efba60b361e2c6d816809b5

Download Submit
memory/524-14-0x0000000000000000-mapping.dmp

Download
memory/1020-12-0x0000000000000000-mapping.dmp

Download
memory/1316-4-0x0000000000000000-mapping.dmp

Download
memory/1316-11-0x00000000006A0000-0x00000000006DA000-memory.dmp

Filesize
232KB

Download
memory/1320-6-0x0000000000000000-mapping.dmp

Download
memory/1732-8-0x0000000000000000-mapping.dmp

Download
memory/1732-10-0x0000000002610000-0x0000000002621000-memory.dmp

Filesize
68KB

Download
memory/1756-0-0x0000000000000000-mapping.dmp

Download
memory/1756-1-0x00000000025B0000-0x00000000025C1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads