qakbot | 63e5dd41c80f7270dbc4550184f7a72f86a03ce73689de523b5f5caca4f426ed

General

Target

zbwvly.exe
Size

1.0MB
MD5

07f868d6a7eb64678d7422953b89da0b
SHA1

32b0595b9ae58beaf4e23f4441cbb26d685db7b0
SHA256

63e5dd41c80f7270dbc4550184f7a72f86a03ce73689de523b5f5caca4f426ed
SHA512

841a0f6530b3ce539e8ade943bb8a75940b27fd7d38d308aabbdc56d392a55a6b198b38e510810b655cfe05d3bcc0d0c6f29bd6b106c5f393088e15b117599b0

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

flaahv.exeflaahv.exe

pid process

1224 flaahv.exe
400 flaahv.exe
Loads dropped DLL 2 IoCs

Processes:

zbwvly.exe

pid process

1668 zbwvly.exe
1668 zbwvly.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

872 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

zbwvly.exezbwvly.exeflaahv.exeflaahv.exeexplorer.exezbwvly.exe

pid process

1668 zbwvly.exe
2004 zbwvly.exe
2004 zbwvly.exe
1224 flaahv.exe
400 flaahv.exe
400 flaahv.exe
1892 explorer.exe
1892 explorer.exe
520 zbwvly.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

flaahv.exe

pid process

1224 flaahv.exe

pid	process
1224	flaahv.exe
400	flaahv.exe

pid	process
1668	zbwvly.exe
1668	zbwvly.exe

pid	process
872	schtasks.exe

pid	process
1668	zbwvly.exe
2004	zbwvly.exe
2004	zbwvly.exe
1224	flaahv.exe
400	flaahv.exe
400	flaahv.exe
1892	explorer.exe
1892	explorer.exe
520	zbwvly.exe

pid	process
1224	flaahv.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

zbwvly.exeflaahv.exetaskeng.exe

description	pid	process	target process
PID 1668 wrote to memory of 2004	1668	zbwvly.exe	zbwvly.exe
PID 1668 wrote to memory of 2004	1668	zbwvly.exe	zbwvly.exe
PID 1668 wrote to memory of 2004	1668	zbwvly.exe	zbwvly.exe
PID 1668 wrote to memory of 2004	1668	zbwvly.exe	zbwvly.exe
PID 1668 wrote to memory of 1224	1668	zbwvly.exe	flaahv.exe
PID 1668 wrote to memory of 1224	1668	zbwvly.exe	flaahv.exe
PID 1668 wrote to memory of 1224	1668	zbwvly.exe	flaahv.exe
PID 1668 wrote to memory of 1224	1668	zbwvly.exe	flaahv.exe
PID 1668 wrote to memory of 872	1668	zbwvly.exe	schtasks.exe
PID 1668 wrote to memory of 872	1668	zbwvly.exe	schtasks.exe
PID 1668 wrote to memory of 872	1668	zbwvly.exe	schtasks.exe
PID 1668 wrote to memory of 872	1668	zbwvly.exe	schtasks.exe
PID 1224 wrote to memory of 400	1224	flaahv.exe	flaahv.exe
PID 1224 wrote to memory of 400	1224	flaahv.exe	flaahv.exe
PID 1224 wrote to memory of 400	1224	flaahv.exe	flaahv.exe
PID 1224 wrote to memory of 400	1224	flaahv.exe	flaahv.exe
PID 1224 wrote to memory of 1892	1224	flaahv.exe	explorer.exe
PID 1224 wrote to memory of 1892	1224	flaahv.exe	explorer.exe
PID 1224 wrote to memory of 1892	1224	flaahv.exe	explorer.exe
PID 1224 wrote to memory of 1892	1224	flaahv.exe	explorer.exe
PID 1224 wrote to memory of 1892	1224	flaahv.exe	explorer.exe
PID 344 wrote to memory of 520	344	taskeng.exe	zbwvly.exe
PID 344 wrote to memory of 520	344	taskeng.exe	zbwvly.exe
PID 344 wrote to memory of 520	344	taskeng.exe	zbwvly.exe
PID 344 wrote to memory of 520	344	taskeng.exe	zbwvly.exe

C:\Users\Admin\AppData\Local\Temp\zbwvly.exe
"C:\Users\Admin\AppData\Local\Temp\zbwvly.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\zbwvly.exe
C:\Users\Admin\AppData\Local\Temp\zbwvly.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2004

C:\Users\Admin\AppData\Roaming\Microsoft\Ooiiuabhbuqe\flaahv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ooiiuabhbuqe\flaahv.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1224

C:\Users\Admin\AppData\Roaming\Microsoft\Ooiiuabhbuqe\flaahv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ooiiuabhbuqe\flaahv.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:400

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1892

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kdmikrd /tr "\"C:\Users\Admin\AppData\Local\Temp\zbwvly.exe\" /I kdmikrd" /SC ONCE /Z /ST 14:44 /ET 14:56
2⤵
- Creates scheduled task(s)
PID:872

C:\Windows\system32\taskeng.exe
taskeng.exe {82A4D7DE-7B25-4196-B66A-C3F3DED839CD} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:344

C:\Users\Admin\AppData\Local\Temp\zbwvly.exe
C:\Users\Admin\AppData\Local\Temp\zbwvly.exe /I kdmikrd
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:520

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Ooiiuabhbuqe\flaahv.dat
MD5
3caaab5a5ea54a7dbb7e139dc2eca655

SHA1
c6245b3a8383d7acc86b5590baa1da1ac1f63c1c

SHA256
b4ed790c803071392fe9ca754ab470fe8d7a5c270d7a680e80ae998067ec5ebf

SHA512
ddb683b3a04206f98ffe3097337dd2650f52f541610cccf0d7ee620a11dba749636507688ec4f9573e8ed33a20c451b23d0a118c65e4da50ed3f73c741a0fe2d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ooiiuabhbuqe\flaahv.exe
MD5
07f868d6a7eb64678d7422953b89da0b

SHA1
32b0595b9ae58beaf4e23f4441cbb26d685db7b0

SHA256
63e5dd41c80f7270dbc4550184f7a72f86a03ce73689de523b5f5caca4f426ed

SHA512
841a0f6530b3ce539e8ade943bb8a75940b27fd7d38d308aabbdc56d392a55a6b198b38e510810b655cfe05d3bcc0d0c6f29bd6b106c5f393088e15b117599b0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ooiiuabhbuqe\flaahv.exe
MD5
07f868d6a7eb64678d7422953b89da0b

SHA1
32b0595b9ae58beaf4e23f4441cbb26d685db7b0

SHA256
63e5dd41c80f7270dbc4550184f7a72f86a03ce73689de523b5f5caca4f426ed

SHA512
841a0f6530b3ce539e8ade943bb8a75940b27fd7d38d308aabbdc56d392a55a6b198b38e510810b655cfe05d3bcc0d0c6f29bd6b106c5f393088e15b117599b0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ooiiuabhbuqe\flaahv.exe
MD5
07f868d6a7eb64678d7422953b89da0b

SHA1
32b0595b9ae58beaf4e23f4441cbb26d685db7b0

SHA256
63e5dd41c80f7270dbc4550184f7a72f86a03ce73689de523b5f5caca4f426ed

SHA512
841a0f6530b3ce539e8ade943bb8a75940b27fd7d38d308aabbdc56d392a55a6b198b38e510810b655cfe05d3bcc0d0c6f29bd6b106c5f393088e15b117599b0

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Ooiiuabhbuqe\flaahv.exe
MD5
07f868d6a7eb64678d7422953b89da0b

SHA1
32b0595b9ae58beaf4e23f4441cbb26d685db7b0

SHA256
63e5dd41c80f7270dbc4550184f7a72f86a03ce73689de523b5f5caca4f426ed

SHA512
841a0f6530b3ce539e8ade943bb8a75940b27fd7d38d308aabbdc56d392a55a6b198b38e510810b655cfe05d3bcc0d0c6f29bd6b106c5f393088e15b117599b0

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Ooiiuabhbuqe\flaahv.exe
MD5
07f868d6a7eb64678d7422953b89da0b

SHA1
32b0595b9ae58beaf4e23f4441cbb26d685db7b0

SHA256
63e5dd41c80f7270dbc4550184f7a72f86a03ce73689de523b5f5caca4f426ed

SHA512
841a0f6530b3ce539e8ade943bb8a75940b27fd7d38d308aabbdc56d392a55a6b198b38e510810b655cfe05d3bcc0d0c6f29bd6b106c5f393088e15b117599b0

Download Submit
memory/400-8-0x0000000000000000-mapping.dmp

Download
memory/400-10-0x0000000002520000-0x0000000002531000-memory.dmp

Filesize
68KB

Download
memory/520-15-0x0000000000000000-mapping.dmp

Download
memory/872-6-0x0000000000000000-mapping.dmp

Download
memory/1224-4-0x0000000000000000-mapping.dmp

Download
memory/1224-11-0x0000000000610000-0x000000000064A000-memory.dmp

Filesize
232KB

Download
memory/1892-12-0x0000000000000000-mapping.dmp

Download
memory/2004-0-0x0000000000000000-mapping.dmp

Download
memory/2004-1-0x0000000002670000-0x0000000002681000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads