qakbot | ffabd4ffe3407979fef03218ea18a1223ac187ee2b6e352a6148ab17d57e6c7d

General

Target

qtnkxm.exe
Size

1.0MB
MD5

78c6d7763633b050577b432554ec42fd
SHA1

358a07e0e915f510c397b8a01ef2fd9393fe67c0
SHA256

ffabd4ffe3407979fef03218ea18a1223ac187ee2b6e352a6148ab17d57e6c7d
SHA512

1de0314824f22c5ec739da2f670e4c3d3d6f36aa22990209e63e404189a6fa0babd1ad11e009eec67db158f09f56c3451a578484bbcbc4451a2b17c144f91875

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

yhuev.exeyhuev.exe

pid process

1672 yhuev.exe
860 yhuev.exe
Loads dropped DLL 2 IoCs

Processes:

qtnkxm.exe

pid process

1772 qtnkxm.exe
1772 qtnkxm.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1612 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

qtnkxm.exeqtnkxm.exeyhuev.exeyhuev.exeexplorer.exeqtnkxm.exe

pid process

1772 qtnkxm.exe
1520 qtnkxm.exe
1520 qtnkxm.exe
1672 yhuev.exe
860 yhuev.exe
860 yhuev.exe
780 explorer.exe
780 explorer.exe
1560 qtnkxm.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

yhuev.exe

pid process

1672 yhuev.exe

pid	process
1672	yhuev.exe
860	yhuev.exe

pid	process
1772	qtnkxm.exe
1772	qtnkxm.exe

pid	process
1612	schtasks.exe

pid	process
1772	qtnkxm.exe
1520	qtnkxm.exe
1520	qtnkxm.exe
1672	yhuev.exe
860	yhuev.exe
860	yhuev.exe
780	explorer.exe
780	explorer.exe
1560	qtnkxm.exe

pid	process
1672	yhuev.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

qtnkxm.exeyhuev.exetaskeng.exe

description	pid	process	target process
PID 1772 wrote to memory of 1520	1772	qtnkxm.exe	qtnkxm.exe
PID 1772 wrote to memory of 1520	1772	qtnkxm.exe	qtnkxm.exe
PID 1772 wrote to memory of 1520	1772	qtnkxm.exe	qtnkxm.exe
PID 1772 wrote to memory of 1520	1772	qtnkxm.exe	qtnkxm.exe
PID 1772 wrote to memory of 1672	1772	qtnkxm.exe	yhuev.exe
PID 1772 wrote to memory of 1672	1772	qtnkxm.exe	yhuev.exe
PID 1772 wrote to memory of 1672	1772	qtnkxm.exe	yhuev.exe
PID 1772 wrote to memory of 1672	1772	qtnkxm.exe	yhuev.exe
PID 1772 wrote to memory of 1612	1772	qtnkxm.exe	schtasks.exe
PID 1772 wrote to memory of 1612	1772	qtnkxm.exe	schtasks.exe
PID 1772 wrote to memory of 1612	1772	qtnkxm.exe	schtasks.exe
PID 1772 wrote to memory of 1612	1772	qtnkxm.exe	schtasks.exe
PID 1672 wrote to memory of 860	1672	yhuev.exe	yhuev.exe
PID 1672 wrote to memory of 860	1672	yhuev.exe	yhuev.exe
PID 1672 wrote to memory of 860	1672	yhuev.exe	yhuev.exe
PID 1672 wrote to memory of 860	1672	yhuev.exe	yhuev.exe
PID 1672 wrote to memory of 780	1672	yhuev.exe	explorer.exe
PID 1672 wrote to memory of 780	1672	yhuev.exe	explorer.exe
PID 1672 wrote to memory of 780	1672	yhuev.exe	explorer.exe
PID 1672 wrote to memory of 780	1672	yhuev.exe	explorer.exe
PID 1672 wrote to memory of 780	1672	yhuev.exe	explorer.exe
PID 616 wrote to memory of 1560	616	taskeng.exe	qtnkxm.exe
PID 616 wrote to memory of 1560	616	taskeng.exe	qtnkxm.exe
PID 616 wrote to memory of 1560	616	taskeng.exe	qtnkxm.exe
PID 616 wrote to memory of 1560	616	taskeng.exe	qtnkxm.exe

C:\Users\Admin\AppData\Local\Temp\qtnkxm.exe
"C:\Users\Admin\AppData\Local\Temp\qtnkxm.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1772

C:\Users\Admin\AppData\Local\Temp\qtnkxm.exe
C:\Users\Admin\AppData\Local\Temp\qtnkxm.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1520

C:\Users\Admin\AppData\Roaming\Microsoft\Eyutlvsjis\yhuev.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Eyutlvsjis\yhuev.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1672

C:\Users\Admin\AppData\Roaming\Microsoft\Eyutlvsjis\yhuev.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Eyutlvsjis\yhuev.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:860

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:780

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn onzmihl /tr "\"C:\Users\Admin\AppData\Local\Temp\qtnkxm.exe\" /I onzmihl" /SC ONCE /Z /ST 15:44 /ET 15:56
2⤵
- Creates scheduled task(s)
PID:1612

C:\Windows\system32\taskeng.exe
taskeng.exe {9DEACB6A-C0FD-4D71-85C5-7889B7481649} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:616

C:\Users\Admin\AppData\Local\Temp\qtnkxm.exe
C:\Users\Admin\AppData\Local\Temp\qtnkxm.exe /I onzmihl
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1560

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Eyutlvsjis\yhuev.dat
MD5
479ee16b4932686caf2ede3260459042

SHA1
56881eef2a48e7df5b9ae913b420018b254691a3

SHA256
f1496c18b5631ffd35cb2b25eea19ec7eb2956d877d14330b789999542c672b5

SHA512
1285111bcb121694b9d49c113463c2498740466941d7b679a8bc98ebd58a49b9569e825635ac3293065bedfeca6669cb5b78a1f595a47122443d06024a6a448b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Eyutlvsjis\yhuev.exe
MD5
78c6d7763633b050577b432554ec42fd

SHA1
358a07e0e915f510c397b8a01ef2fd9393fe67c0

SHA256
ffabd4ffe3407979fef03218ea18a1223ac187ee2b6e352a6148ab17d57e6c7d

SHA512
1de0314824f22c5ec739da2f670e4c3d3d6f36aa22990209e63e404189a6fa0babd1ad11e009eec67db158f09f56c3451a578484bbcbc4451a2b17c144f91875

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Eyutlvsjis\yhuev.exe
MD5
78c6d7763633b050577b432554ec42fd

SHA1
358a07e0e915f510c397b8a01ef2fd9393fe67c0

SHA256
ffabd4ffe3407979fef03218ea18a1223ac187ee2b6e352a6148ab17d57e6c7d

SHA512
1de0314824f22c5ec739da2f670e4c3d3d6f36aa22990209e63e404189a6fa0babd1ad11e009eec67db158f09f56c3451a578484bbcbc4451a2b17c144f91875

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Eyutlvsjis\yhuev.exe
MD5
78c6d7763633b050577b432554ec42fd

SHA1
358a07e0e915f510c397b8a01ef2fd9393fe67c0

SHA256
ffabd4ffe3407979fef03218ea18a1223ac187ee2b6e352a6148ab17d57e6c7d

SHA512
1de0314824f22c5ec739da2f670e4c3d3d6f36aa22990209e63e404189a6fa0babd1ad11e009eec67db158f09f56c3451a578484bbcbc4451a2b17c144f91875

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Eyutlvsjis\yhuev.exe
MD5
78c6d7763633b050577b432554ec42fd

SHA1
358a07e0e915f510c397b8a01ef2fd9393fe67c0

SHA256
ffabd4ffe3407979fef03218ea18a1223ac187ee2b6e352a6148ab17d57e6c7d

SHA512
1de0314824f22c5ec739da2f670e4c3d3d6f36aa22990209e63e404189a6fa0babd1ad11e009eec67db158f09f56c3451a578484bbcbc4451a2b17c144f91875

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Eyutlvsjis\yhuev.exe
MD5
78c6d7763633b050577b432554ec42fd

SHA1
358a07e0e915f510c397b8a01ef2fd9393fe67c0

SHA256
ffabd4ffe3407979fef03218ea18a1223ac187ee2b6e352a6148ab17d57e6c7d

SHA512
1de0314824f22c5ec739da2f670e4c3d3d6f36aa22990209e63e404189a6fa0babd1ad11e009eec67db158f09f56c3451a578484bbcbc4451a2b17c144f91875

Download Submit
memory/780-12-0x0000000000000000-mapping.dmp

Download
memory/860-8-0x0000000000000000-mapping.dmp

Download
memory/860-10-0x0000000002570000-0x0000000002581000-memory.dmp

Filesize
68KB

Download
memory/1520-0-0x0000000000000000-mapping.dmp

Download
memory/1520-1-0x0000000002560000-0x0000000002571000-memory.dmp

Filesize
68KB

Download
memory/1560-14-0x0000000000000000-mapping.dmp

Download
memory/1612-6-0x0000000000000000-mapping.dmp

Download
memory/1672-4-0x0000000000000000-mapping.dmp

Download
memory/1672-11-0x0000000000850000-0x000000000088A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads