qakbot | d163c4b7578caf1d1a8a63073319aa99d5e92812e8142f430d719d080b2558e4

General

Target

oqlsuz.exe
Size

1.0MB
MD5

d153d28439048d0f855e1a7ab2e9abed
SHA1

a6cdf4fae84f44e04751a9956e1198c64137c99a
SHA256

d163c4b7578caf1d1a8a63073319aa99d5e92812e8142f430d719d080b2558e4
SHA512

a8ca36926158042eabeab638a1e079bb026074211138e001dfcc260df841e4f0551228ca24e62464bbaaa98046236d465b7cc7bb7517397ae049af8f2c893fc0

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

zrhgbef.exezrhgbef.exe

pid process

304 zrhgbef.exe
1676 zrhgbef.exe
Loads dropped DLL 2 IoCs

Processes:

oqlsuz.exe

pid process

1960 oqlsuz.exe
1960 oqlsuz.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

800 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

oqlsuz.exeoqlsuz.exezrhgbef.exezrhgbef.exeexplorer.exeoqlsuz.exe

pid process

1960 oqlsuz.exe
1728 oqlsuz.exe
1728 oqlsuz.exe
304 zrhgbef.exe
1676 zrhgbef.exe
1676 zrhgbef.exe
640 explorer.exe
640 explorer.exe
300 oqlsuz.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

zrhgbef.exe

pid process

304 zrhgbef.exe

pid	process
304	zrhgbef.exe
1676	zrhgbef.exe

pid	process
1960	oqlsuz.exe
1960	oqlsuz.exe

pid	process
800	schtasks.exe

pid	process
1960	oqlsuz.exe
1728	oqlsuz.exe
1728	oqlsuz.exe
304	zrhgbef.exe
1676	zrhgbef.exe
1676	zrhgbef.exe
640	explorer.exe
640	explorer.exe
300	oqlsuz.exe

pid	process
304	zrhgbef.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

oqlsuz.exezrhgbef.exetaskeng.exe

description	pid	process	target process
PID 1960 wrote to memory of 1728	1960	oqlsuz.exe	oqlsuz.exe
PID 1960 wrote to memory of 1728	1960	oqlsuz.exe	oqlsuz.exe
PID 1960 wrote to memory of 1728	1960	oqlsuz.exe	oqlsuz.exe
PID 1960 wrote to memory of 1728	1960	oqlsuz.exe	oqlsuz.exe
PID 1960 wrote to memory of 304	1960	oqlsuz.exe	zrhgbef.exe
PID 1960 wrote to memory of 304	1960	oqlsuz.exe	zrhgbef.exe
PID 1960 wrote to memory of 304	1960	oqlsuz.exe	zrhgbef.exe
PID 1960 wrote to memory of 304	1960	oqlsuz.exe	zrhgbef.exe
PID 1960 wrote to memory of 800	1960	oqlsuz.exe	schtasks.exe
PID 1960 wrote to memory of 800	1960	oqlsuz.exe	schtasks.exe
PID 1960 wrote to memory of 800	1960	oqlsuz.exe	schtasks.exe
PID 1960 wrote to memory of 800	1960	oqlsuz.exe	schtasks.exe
PID 304 wrote to memory of 1676	304	zrhgbef.exe	zrhgbef.exe
PID 304 wrote to memory of 1676	304	zrhgbef.exe	zrhgbef.exe
PID 304 wrote to memory of 1676	304	zrhgbef.exe	zrhgbef.exe
PID 304 wrote to memory of 1676	304	zrhgbef.exe	zrhgbef.exe
PID 304 wrote to memory of 640	304	zrhgbef.exe	explorer.exe
PID 304 wrote to memory of 640	304	zrhgbef.exe	explorer.exe
PID 304 wrote to memory of 640	304	zrhgbef.exe	explorer.exe
PID 304 wrote to memory of 640	304	zrhgbef.exe	explorer.exe
PID 304 wrote to memory of 640	304	zrhgbef.exe	explorer.exe
PID 1328 wrote to memory of 300	1328	taskeng.exe	oqlsuz.exe
PID 1328 wrote to memory of 300	1328	taskeng.exe	oqlsuz.exe
PID 1328 wrote to memory of 300	1328	taskeng.exe	oqlsuz.exe
PID 1328 wrote to memory of 300	1328	taskeng.exe	oqlsuz.exe

C:\Users\Admin\AppData\Local\Temp\oqlsuz.exe
"C:\Users\Admin\AppData\Local\Temp\oqlsuz.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1960

C:\Users\Admin\AppData\Local\Temp\oqlsuz.exe
C:\Users\Admin\AppData\Local\Temp\oqlsuz.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728

C:\Users\Admin\AppData\Roaming\Microsoft\Qvpooll\zrhgbef.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Qvpooll\zrhgbef.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:304

C:\Users\Admin\AppData\Roaming\Microsoft\Qvpooll\zrhgbef.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Qvpooll\zrhgbef.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1676

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:640

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn witxhhle /tr "\"C:\Users\Admin\AppData\Local\Temp\oqlsuz.exe\" /I witxhhle" /SC ONCE /Z /ST 14:46 /ET 14:58
2⤵
- Creates scheduled task(s)
PID:800

C:\Windows\system32\taskeng.exe
taskeng.exe {D055E7EE-B30F-4642-B769-53A6AF3514D5} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1328

C:\Users\Admin\AppData\Local\Temp\oqlsuz.exe
C:\Users\Admin\AppData\Local\Temp\oqlsuz.exe /I witxhhle
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:300

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Qvpooll\zrhgbef.dat
MD5
a841f64cbfd09c5da84b054e60385c08

SHA1
94705355f5e8ea5c32601ac56b87690f7fd961b4

SHA256
7532ab3a224180c32871f72043b51c60143c95c41eb7541dfeb72d3e586cbea0

SHA512
acc7fe10ad1d691ca5242abc0b1e2497ad3a0e47230ba87146d30473ac9db8a80b9664417e49f407d2305f75b801959ed6e8b3cf3ccb1270f9d6b11937f37ab1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Qvpooll\zrhgbef.exe
MD5
d153d28439048d0f855e1a7ab2e9abed

SHA1
a6cdf4fae84f44e04751a9956e1198c64137c99a

SHA256
d163c4b7578caf1d1a8a63073319aa99d5e92812e8142f430d719d080b2558e4

SHA512
a8ca36926158042eabeab638a1e079bb026074211138e001dfcc260df841e4f0551228ca24e62464bbaaa98046236d465b7cc7bb7517397ae049af8f2c893fc0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Qvpooll\zrhgbef.exe
MD5
d153d28439048d0f855e1a7ab2e9abed

SHA1
a6cdf4fae84f44e04751a9956e1198c64137c99a

SHA256
d163c4b7578caf1d1a8a63073319aa99d5e92812e8142f430d719d080b2558e4

SHA512
a8ca36926158042eabeab638a1e079bb026074211138e001dfcc260df841e4f0551228ca24e62464bbaaa98046236d465b7cc7bb7517397ae049af8f2c893fc0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Qvpooll\zrhgbef.exe
MD5
d153d28439048d0f855e1a7ab2e9abed

SHA1
a6cdf4fae84f44e04751a9956e1198c64137c99a

SHA256
d163c4b7578caf1d1a8a63073319aa99d5e92812e8142f430d719d080b2558e4

SHA512
a8ca36926158042eabeab638a1e079bb026074211138e001dfcc260df841e4f0551228ca24e62464bbaaa98046236d465b7cc7bb7517397ae049af8f2c893fc0

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Qvpooll\zrhgbef.exe
MD5
d153d28439048d0f855e1a7ab2e9abed

SHA1
a6cdf4fae84f44e04751a9956e1198c64137c99a

SHA256
d163c4b7578caf1d1a8a63073319aa99d5e92812e8142f430d719d080b2558e4

SHA512
a8ca36926158042eabeab638a1e079bb026074211138e001dfcc260df841e4f0551228ca24e62464bbaaa98046236d465b7cc7bb7517397ae049af8f2c893fc0

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Qvpooll\zrhgbef.exe
MD5
d153d28439048d0f855e1a7ab2e9abed

SHA1
a6cdf4fae84f44e04751a9956e1198c64137c99a

SHA256
d163c4b7578caf1d1a8a63073319aa99d5e92812e8142f430d719d080b2558e4

SHA512
a8ca36926158042eabeab638a1e079bb026074211138e001dfcc260df841e4f0551228ca24e62464bbaaa98046236d465b7cc7bb7517397ae049af8f2c893fc0

Download Submit
memory/300-14-0x0000000000000000-mapping.dmp

Download
memory/304-4-0x0000000000000000-mapping.dmp

Download
memory/304-11-0x00000000021B0000-0x00000000021EA000-memory.dmp

Filesize
232KB

Download
memory/640-12-0x0000000000000000-mapping.dmp

Download
memory/800-6-0x0000000000000000-mapping.dmp

Download
memory/1676-8-0x0000000000000000-mapping.dmp

Download
memory/1676-10-0x0000000002710000-0x0000000002721000-memory.dmp

Filesize
68KB

Download
memory/1728-0-0x0000000000000000-mapping.dmp

Download
memory/1728-1-0x0000000002650000-0x0000000002661000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads