qakbot | 1d5c91bc326eb5ef49b5ff713bb48aeb5d52cd83835f077e6cfc7573af90b402

General

Target

fbunjk.exe
Size

1.0MB
MD5

b37acd0e43dfd0414b4633f035322706
SHA1

ff7fa8d2a855a843b139fe963d5d2acbd0277a31
SHA256

1d5c91bc326eb5ef49b5ff713bb48aeb5d52cd83835f077e6cfc7573af90b402
SHA512

ead87e6217c7032be5b183b39a0832359a827d8ce7d1ad40ea6d2dcbf8ea90af5fe03945cc2b17119234f4782f238e2e4f2db0071aaf7ac301ebe34adf7ac2e6

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

yaikkmck.exeyaikkmck.exe

pid process

1396 yaikkmck.exe
344 yaikkmck.exe
Loads dropped DLL 2 IoCs

Processes:

fbunjk.exe

pid process

308 fbunjk.exe
308 fbunjk.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

524 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

fbunjk.exefbunjk.exeyaikkmck.exeyaikkmck.exeexplorer.exefbunjk.exe

pid process

308 fbunjk.exe
1192 fbunjk.exe
1192 fbunjk.exe
1396 yaikkmck.exe
344 yaikkmck.exe
344 yaikkmck.exe
1628 explorer.exe
1628 explorer.exe
1476 fbunjk.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

yaikkmck.exe

pid process

1396 yaikkmck.exe

pid	process
1396	yaikkmck.exe
344	yaikkmck.exe

pid	process
308	fbunjk.exe
308	fbunjk.exe

pid	process
524	schtasks.exe

pid	process
308	fbunjk.exe
1192	fbunjk.exe
1192	fbunjk.exe
1396	yaikkmck.exe
344	yaikkmck.exe
344	yaikkmck.exe
1628	explorer.exe
1628	explorer.exe
1476	fbunjk.exe

pid	process
1396	yaikkmck.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

fbunjk.exeyaikkmck.exetaskeng.exe

description	pid	process	target process
PID 308 wrote to memory of 1192	308	fbunjk.exe	fbunjk.exe
PID 308 wrote to memory of 1192	308	fbunjk.exe	fbunjk.exe
PID 308 wrote to memory of 1192	308	fbunjk.exe	fbunjk.exe
PID 308 wrote to memory of 1192	308	fbunjk.exe	fbunjk.exe
PID 308 wrote to memory of 1396	308	fbunjk.exe	yaikkmck.exe
PID 308 wrote to memory of 1396	308	fbunjk.exe	yaikkmck.exe
PID 308 wrote to memory of 1396	308	fbunjk.exe	yaikkmck.exe
PID 308 wrote to memory of 1396	308	fbunjk.exe	yaikkmck.exe
PID 308 wrote to memory of 524	308	fbunjk.exe	schtasks.exe
PID 308 wrote to memory of 524	308	fbunjk.exe	schtasks.exe
PID 308 wrote to memory of 524	308	fbunjk.exe	schtasks.exe
PID 308 wrote to memory of 524	308	fbunjk.exe	schtasks.exe
PID 1396 wrote to memory of 344	1396	yaikkmck.exe	yaikkmck.exe
PID 1396 wrote to memory of 344	1396	yaikkmck.exe	yaikkmck.exe
PID 1396 wrote to memory of 344	1396	yaikkmck.exe	yaikkmck.exe
PID 1396 wrote to memory of 344	1396	yaikkmck.exe	yaikkmck.exe
PID 1396 wrote to memory of 1628	1396	yaikkmck.exe	explorer.exe
PID 1396 wrote to memory of 1628	1396	yaikkmck.exe	explorer.exe
PID 1396 wrote to memory of 1628	1396	yaikkmck.exe	explorer.exe
PID 1396 wrote to memory of 1628	1396	yaikkmck.exe	explorer.exe
PID 1396 wrote to memory of 1628	1396	yaikkmck.exe	explorer.exe
PID 592 wrote to memory of 1476	592	taskeng.exe	fbunjk.exe
PID 592 wrote to memory of 1476	592	taskeng.exe	fbunjk.exe
PID 592 wrote to memory of 1476	592	taskeng.exe	fbunjk.exe
PID 592 wrote to memory of 1476	592	taskeng.exe	fbunjk.exe

C:\Users\Admin\AppData\Local\Temp\fbunjk.exe
"C:\Users\Admin\AppData\Local\Temp\fbunjk.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:308

C:\Users\Admin\AppData\Local\Temp\fbunjk.exe
C:\Users\Admin\AppData\Local\Temp\fbunjk.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1192

C:\Users\Admin\AppData\Roaming\Microsoft\Tubqezqel\yaikkmck.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Tubqezqel\yaikkmck.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1396

C:\Users\Admin\AppData\Roaming\Microsoft\Tubqezqel\yaikkmck.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Tubqezqel\yaikkmck.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:344

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1628

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn toskawirfa /tr "\"C:\Users\Admin\AppData\Local\Temp\fbunjk.exe\" /I toskawirfa" /SC ONCE /Z /ST 15:39 /ET 15:51
2⤵
- Creates scheduled task(s)
PID:524

C:\Windows\system32\taskeng.exe
taskeng.exe {CC8F0ACA-575D-4CA7-9BE1-92A02F250499} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:592

C:\Users\Admin\AppData\Local\Temp\fbunjk.exe
C:\Users\Admin\AppData\Local\Temp\fbunjk.exe /I toskawirfa
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1476

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Tubqezqel\yaikkmck.dat
MD5
b1ccb3a9bb68e45e9cae9888c6d24f3a

SHA1
89c73f742c6370f043013e001a1d6074ff59ee87

SHA256
cf6efd84ee4eee8b03bc4c555ca13d54d3ca72bf30936a20749753c4d3eaabf6

SHA512
95cee6d995dcdf902a90b928f2e0344c07c11dc3af8f771fc49c0a898149649cd4b70826f9e43731a45419b2f564f284e3a9337b7280434b326af229a56a2e27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Tubqezqel\yaikkmck.exe
MD5
b37acd0e43dfd0414b4633f035322706

SHA1
ff7fa8d2a855a843b139fe963d5d2acbd0277a31

SHA256
1d5c91bc326eb5ef49b5ff713bb48aeb5d52cd83835f077e6cfc7573af90b402

SHA512
ead87e6217c7032be5b183b39a0832359a827d8ce7d1ad40ea6d2dcbf8ea90af5fe03945cc2b17119234f4782f238e2e4f2db0071aaf7ac301ebe34adf7ac2e6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Tubqezqel\yaikkmck.exe
MD5
b37acd0e43dfd0414b4633f035322706

SHA1
ff7fa8d2a855a843b139fe963d5d2acbd0277a31

SHA256
1d5c91bc326eb5ef49b5ff713bb48aeb5d52cd83835f077e6cfc7573af90b402

SHA512
ead87e6217c7032be5b183b39a0832359a827d8ce7d1ad40ea6d2dcbf8ea90af5fe03945cc2b17119234f4782f238e2e4f2db0071aaf7ac301ebe34adf7ac2e6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Tubqezqel\yaikkmck.exe
MD5
b37acd0e43dfd0414b4633f035322706

SHA1
ff7fa8d2a855a843b139fe963d5d2acbd0277a31

SHA256
1d5c91bc326eb5ef49b5ff713bb48aeb5d52cd83835f077e6cfc7573af90b402

SHA512
ead87e6217c7032be5b183b39a0832359a827d8ce7d1ad40ea6d2dcbf8ea90af5fe03945cc2b17119234f4782f238e2e4f2db0071aaf7ac301ebe34adf7ac2e6

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Tubqezqel\yaikkmck.exe
MD5
b37acd0e43dfd0414b4633f035322706

SHA1
ff7fa8d2a855a843b139fe963d5d2acbd0277a31

SHA256
1d5c91bc326eb5ef49b5ff713bb48aeb5d52cd83835f077e6cfc7573af90b402

SHA512
ead87e6217c7032be5b183b39a0832359a827d8ce7d1ad40ea6d2dcbf8ea90af5fe03945cc2b17119234f4782f238e2e4f2db0071aaf7ac301ebe34adf7ac2e6

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Tubqezqel\yaikkmck.exe
MD5
b37acd0e43dfd0414b4633f035322706

SHA1
ff7fa8d2a855a843b139fe963d5d2acbd0277a31

SHA256
1d5c91bc326eb5ef49b5ff713bb48aeb5d52cd83835f077e6cfc7573af90b402

SHA512
ead87e6217c7032be5b183b39a0832359a827d8ce7d1ad40ea6d2dcbf8ea90af5fe03945cc2b17119234f4782f238e2e4f2db0071aaf7ac301ebe34adf7ac2e6

Download Submit
memory/344-8-0x0000000000000000-mapping.dmp

Download
memory/344-10-0x00000000025D0000-0x00000000025E1000-memory.dmp

Filesize
68KB

Download
memory/524-6-0x0000000000000000-mapping.dmp

Download
memory/1192-0-0x0000000000000000-mapping.dmp

Download
memory/1192-1-0x00000000024D0000-0x00000000024E1000-memory.dmp

Filesize
68KB

Download
memory/1396-4-0x0000000000000000-mapping.dmp

Download
memory/1396-11-0x0000000000510000-0x000000000054A000-memory.dmp

Filesize
232KB

Download
memory/1476-14-0x0000000000000000-mapping.dmp

Download
memory/1628-12-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads