qakbot | cad9cda467552b8effd791f19f626ab7a39c9f0e22560876478d2d445c887904

General

Target

oiubdh.exe
Size

1.0MB
MD5

2356c0896641edfe2917dd8afa0678ff
SHA1

9c86899731c0b4665ced59b35815b966dfdb384d
SHA256

cad9cda467552b8effd791f19f626ab7a39c9f0e22560876478d2d445c887904
SHA512

f809068aae348fb4d5836455305dd3411ad7ded14708aca163e1ec0dba2c5717dc135231c7f6ab901d6dba741046bcf9156039f88cff96b11921b7da29bf733a

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

oqrmymwu.exeoqrmymwu.exe

pid process

1540 oqrmymwu.exe
1696 oqrmymwu.exe
Loads dropped DLL 2 IoCs

Processes:

oiubdh.exe

pid process

1732 oiubdh.exe
1732 oiubdh.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

876 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

oiubdh.exeoiubdh.exeoqrmymwu.exeoqrmymwu.exeexplorer.exe

pid process

1732 oiubdh.exe
1308 oiubdh.exe
1308 oiubdh.exe
1540 oqrmymwu.exe
1696 oqrmymwu.exe
1696 oqrmymwu.exe
708 explorer.exe
708 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

oqrmymwu.exe

pid process

1540 oqrmymwu.exe

pid	process
1540	oqrmymwu.exe
1696	oqrmymwu.exe

pid	process
1732	oiubdh.exe
1732	oiubdh.exe

pid	process
876	schtasks.exe

pid	process
1732	oiubdh.exe
1308	oiubdh.exe
1308	oiubdh.exe
1540	oqrmymwu.exe
1696	oqrmymwu.exe
1696	oqrmymwu.exe
708	explorer.exe
708	explorer.exe

pid	process
1540	oqrmymwu.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

oiubdh.exeoqrmymwu.exe

description	pid	process	target process
PID 1732 wrote to memory of 1308	1732	oiubdh.exe	oiubdh.exe
PID 1732 wrote to memory of 1308	1732	oiubdh.exe	oiubdh.exe
PID 1732 wrote to memory of 1308	1732	oiubdh.exe	oiubdh.exe
PID 1732 wrote to memory of 1308	1732	oiubdh.exe	oiubdh.exe
PID 1732 wrote to memory of 1540	1732	oiubdh.exe	oqrmymwu.exe
PID 1732 wrote to memory of 1540	1732	oiubdh.exe	oqrmymwu.exe
PID 1732 wrote to memory of 1540	1732	oiubdh.exe	oqrmymwu.exe
PID 1732 wrote to memory of 1540	1732	oiubdh.exe	oqrmymwu.exe
PID 1732 wrote to memory of 876	1732	oiubdh.exe	schtasks.exe
PID 1732 wrote to memory of 876	1732	oiubdh.exe	schtasks.exe
PID 1732 wrote to memory of 876	1732	oiubdh.exe	schtasks.exe
PID 1732 wrote to memory of 876	1732	oiubdh.exe	schtasks.exe
PID 1540 wrote to memory of 1696	1540	oqrmymwu.exe	oqrmymwu.exe
PID 1540 wrote to memory of 1696	1540	oqrmymwu.exe	oqrmymwu.exe
PID 1540 wrote to memory of 1696	1540	oqrmymwu.exe	oqrmymwu.exe
PID 1540 wrote to memory of 1696	1540	oqrmymwu.exe	oqrmymwu.exe
PID 1540 wrote to memory of 708	1540	oqrmymwu.exe	explorer.exe
PID 1540 wrote to memory of 708	1540	oqrmymwu.exe	explorer.exe
PID 1540 wrote to memory of 708	1540	oqrmymwu.exe	explorer.exe
PID 1540 wrote to memory of 708	1540	oqrmymwu.exe	explorer.exe
PID 1540 wrote to memory of 708	1540	oqrmymwu.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\oiubdh.exe
"C:\Users\Admin\AppData\Local\Temp\oiubdh.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1732

C:\Users\Admin\AppData\Local\Temp\oiubdh.exe
C:\Users\Admin\AppData\Local\Temp\oiubdh.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1308

C:\Users\Admin\AppData\Roaming\Microsoft\Yrrkukautjd\oqrmymwu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Yrrkukautjd\oqrmymwu.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1540

C:\Users\Admin\AppData\Roaming\Microsoft\Yrrkukautjd\oqrmymwu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Yrrkukautjd\oqrmymwu.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1696

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:708

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kvzkqgou /tr "\"C:\Users\Admin\AppData\Local\Temp\oiubdh.exe\" /I kvzkqgou" /SC ONCE /Z /ST 14:45 /ET 14:57
2⤵
- Creates scheduled task(s)
PID:876

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Yrrkukautjd\oqrmymwu.dat
MD5
c0cba2c6fa11a39dfff513a5a6d28805

SHA1
26c42ad8597bbfdbd70702411d5d9291af7edbee

SHA256
d2ff18e16dcb6b4f498bad5fdbf17efee57e6339c4010686af48a31134c317ec

SHA512
8744c81ca3e329f8584875e52b63bb6908382c54e781ccf0d2a610ea7e9e5ce3cbe1a309b169fdc07df5494ec30cffedabb5c165cfd4ceeba1a68a4123925ab2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yrrkukautjd\oqrmymwu.exe
MD5
2356c0896641edfe2917dd8afa0678ff

SHA1
9c86899731c0b4665ced59b35815b966dfdb384d

SHA256
cad9cda467552b8effd791f19f626ab7a39c9f0e22560876478d2d445c887904

SHA512
f809068aae348fb4d5836455305dd3411ad7ded14708aca163e1ec0dba2c5717dc135231c7f6ab901d6dba741046bcf9156039f88cff96b11921b7da29bf733a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yrrkukautjd\oqrmymwu.exe
MD5
2356c0896641edfe2917dd8afa0678ff

SHA1
9c86899731c0b4665ced59b35815b966dfdb384d

SHA256
cad9cda467552b8effd791f19f626ab7a39c9f0e22560876478d2d445c887904

SHA512
f809068aae348fb4d5836455305dd3411ad7ded14708aca163e1ec0dba2c5717dc135231c7f6ab901d6dba741046bcf9156039f88cff96b11921b7da29bf733a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yrrkukautjd\oqrmymwu.exe
MD5
2356c0896641edfe2917dd8afa0678ff

SHA1
9c86899731c0b4665ced59b35815b966dfdb384d

SHA256
cad9cda467552b8effd791f19f626ab7a39c9f0e22560876478d2d445c887904

SHA512
f809068aae348fb4d5836455305dd3411ad7ded14708aca163e1ec0dba2c5717dc135231c7f6ab901d6dba741046bcf9156039f88cff96b11921b7da29bf733a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Yrrkukautjd\oqrmymwu.exe
MD5
2356c0896641edfe2917dd8afa0678ff

SHA1
9c86899731c0b4665ced59b35815b966dfdb384d

SHA256
cad9cda467552b8effd791f19f626ab7a39c9f0e22560876478d2d445c887904

SHA512
f809068aae348fb4d5836455305dd3411ad7ded14708aca163e1ec0dba2c5717dc135231c7f6ab901d6dba741046bcf9156039f88cff96b11921b7da29bf733a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Yrrkukautjd\oqrmymwu.exe
MD5
2356c0896641edfe2917dd8afa0678ff

SHA1
9c86899731c0b4665ced59b35815b966dfdb384d

SHA256
cad9cda467552b8effd791f19f626ab7a39c9f0e22560876478d2d445c887904

SHA512
f809068aae348fb4d5836455305dd3411ad7ded14708aca163e1ec0dba2c5717dc135231c7f6ab901d6dba741046bcf9156039f88cff96b11921b7da29bf733a

Download Submit
memory/708-12-0x0000000000000000-mapping.dmp

Download
memory/876-6-0x0000000000000000-mapping.dmp

Download
memory/1308-0-0x0000000000000000-mapping.dmp

Download
memory/1308-1-0x0000000002730000-0x0000000002741000-memory.dmp

Filesize
68KB

Download
memory/1540-11-0x00000000020D0000-0x000000000210A000-memory.dmp

Filesize
232KB

Download
memory/1540-4-0x0000000000000000-mapping.dmp

Download
memory/1696-8-0x0000000000000000-mapping.dmp

Download
memory/1696-10-0x00000000026A0000-0x00000000026B1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads