qakbot | 34bb7647747a0d6cb35f4ede857390e52db83ed2639f40a4c0ffb00c4bc58c8d

General

Target

xxlwss.exe
Size

1.0MB
MD5

e63b167120cd8e6801a3e8aed6698b41
SHA1

48d6e4fe9ed1e4b38a785f70cabf4df6c09ac393
SHA256

34bb7647747a0d6cb35f4ede857390e52db83ed2639f40a4c0ffb00c4bc58c8d
SHA512

8a2a8adf8232329348bf4202210a2e21ee8c1d89830e55f44d6dfa1e55abbeaca5bbda0517d833dc3fc3ed6da199862cb49906410da0c9182af419c8e85b5a9c

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

hobaov.exehobaov.exe

pid process

1600 hobaov.exe
800 hobaov.exe
Loads dropped DLL 2 IoCs

Processes:

xxlwss.exe

pid process

764 xxlwss.exe
764 xxlwss.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

900 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

xxlwss.exexxlwss.exehobaov.exehobaov.exeexplorer.exexxlwss.exe

pid process

764 xxlwss.exe
1328 xxlwss.exe
1328 xxlwss.exe
1600 hobaov.exe
800 hobaov.exe
800 hobaov.exe
584 explorer.exe
584 explorer.exe
1136 xxlwss.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

hobaov.exe

pid process

1600 hobaov.exe

pid	process
1600	hobaov.exe
800	hobaov.exe

pid	process
764	xxlwss.exe
764	xxlwss.exe

pid	process
900	schtasks.exe

pid	process
764	xxlwss.exe
1328	xxlwss.exe
1328	xxlwss.exe
1600	hobaov.exe
800	hobaov.exe
800	hobaov.exe
584	explorer.exe
584	explorer.exe
1136	xxlwss.exe

pid	process
1600	hobaov.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

xxlwss.exehobaov.exetaskeng.exe

description	pid	process	target process
PID 764 wrote to memory of 1328	764	xxlwss.exe	xxlwss.exe
PID 764 wrote to memory of 1328	764	xxlwss.exe	xxlwss.exe
PID 764 wrote to memory of 1328	764	xxlwss.exe	xxlwss.exe
PID 764 wrote to memory of 1328	764	xxlwss.exe	xxlwss.exe
PID 764 wrote to memory of 1600	764	xxlwss.exe	hobaov.exe
PID 764 wrote to memory of 1600	764	xxlwss.exe	hobaov.exe
PID 764 wrote to memory of 1600	764	xxlwss.exe	hobaov.exe
PID 764 wrote to memory of 1600	764	xxlwss.exe	hobaov.exe
PID 764 wrote to memory of 900	764	xxlwss.exe	schtasks.exe
PID 764 wrote to memory of 900	764	xxlwss.exe	schtasks.exe
PID 764 wrote to memory of 900	764	xxlwss.exe	schtasks.exe
PID 764 wrote to memory of 900	764	xxlwss.exe	schtasks.exe
PID 1600 wrote to memory of 800	1600	hobaov.exe	hobaov.exe
PID 1600 wrote to memory of 800	1600	hobaov.exe	hobaov.exe
PID 1600 wrote to memory of 800	1600	hobaov.exe	hobaov.exe
PID 1600 wrote to memory of 800	1600	hobaov.exe	hobaov.exe
PID 1600 wrote to memory of 584	1600	hobaov.exe	explorer.exe
PID 1600 wrote to memory of 584	1600	hobaov.exe	explorer.exe
PID 1600 wrote to memory of 584	1600	hobaov.exe	explorer.exe
PID 1600 wrote to memory of 584	1600	hobaov.exe	explorer.exe
PID 1600 wrote to memory of 584	1600	hobaov.exe	explorer.exe
PID 1928 wrote to memory of 1136	1928	taskeng.exe	xxlwss.exe
PID 1928 wrote to memory of 1136	1928	taskeng.exe	xxlwss.exe
PID 1928 wrote to memory of 1136	1928	taskeng.exe	xxlwss.exe
PID 1928 wrote to memory of 1136	1928	taskeng.exe	xxlwss.exe

C:\Users\Admin\AppData\Local\Temp\xxlwss.exe
"C:\Users\Admin\AppData\Local\Temp\xxlwss.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:764

C:\Users\Admin\AppData\Local\Temp\xxlwss.exe
C:\Users\Admin\AppData\Local\Temp\xxlwss.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1328

C:\Users\Admin\AppData\Roaming\Microsoft\Vfewuoyxb\hobaov.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Vfewuoyxb\hobaov.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1600

C:\Users\Admin\AppData\Roaming\Microsoft\Vfewuoyxb\hobaov.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Vfewuoyxb\hobaov.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:800

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:584

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn odmsykecm /tr "\"C:\Users\Admin\AppData\Local\Temp\xxlwss.exe\" /I odmsykecm" /SC ONCE /Z /ST 14:46 /ET 14:58
2⤵
- Creates scheduled task(s)
PID:900

C:\Windows\system32\taskeng.exe
taskeng.exe {32510ACF-93B4-46D5-9262-35DE36C4098F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Users\Admin\AppData\Local\Temp\xxlwss.exe
C:\Users\Admin\AppData\Local\Temp\xxlwss.exe /I odmsykecm
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1136

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Vfewuoyxb\hobaov.dat
MD5
f5a99297db1a54a2386a712da7b0119c

SHA1
5bf657121803f8621172c7d1557fa887e4e8d895

SHA256
bb5cfec19437009b3b186aa5185abcdb2be45750fb34e9d28b9ac6f816b1665d

SHA512
be608344bbacb31e1bb52f49145fbe717463a9041b18e49ffb9f655e2476995262bd54d1ba2b9fe95109cbcd9ffbb7e5dac09e0950c4e646b654255a72ce3635

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Vfewuoyxb\hobaov.exe
MD5
e63b167120cd8e6801a3e8aed6698b41

SHA1
48d6e4fe9ed1e4b38a785f70cabf4df6c09ac393

SHA256
34bb7647747a0d6cb35f4ede857390e52db83ed2639f40a4c0ffb00c4bc58c8d

SHA512
8a2a8adf8232329348bf4202210a2e21ee8c1d89830e55f44d6dfa1e55abbeaca5bbda0517d833dc3fc3ed6da199862cb49906410da0c9182af419c8e85b5a9c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Vfewuoyxb\hobaov.exe
MD5
e63b167120cd8e6801a3e8aed6698b41

SHA1
48d6e4fe9ed1e4b38a785f70cabf4df6c09ac393

SHA256
34bb7647747a0d6cb35f4ede857390e52db83ed2639f40a4c0ffb00c4bc58c8d

SHA512
8a2a8adf8232329348bf4202210a2e21ee8c1d89830e55f44d6dfa1e55abbeaca5bbda0517d833dc3fc3ed6da199862cb49906410da0c9182af419c8e85b5a9c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Vfewuoyxb\hobaov.exe
MD5
e63b167120cd8e6801a3e8aed6698b41

SHA1
48d6e4fe9ed1e4b38a785f70cabf4df6c09ac393

SHA256
34bb7647747a0d6cb35f4ede857390e52db83ed2639f40a4c0ffb00c4bc58c8d

SHA512
8a2a8adf8232329348bf4202210a2e21ee8c1d89830e55f44d6dfa1e55abbeaca5bbda0517d833dc3fc3ed6da199862cb49906410da0c9182af419c8e85b5a9c

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Vfewuoyxb\hobaov.exe
MD5
e63b167120cd8e6801a3e8aed6698b41

SHA1
48d6e4fe9ed1e4b38a785f70cabf4df6c09ac393

SHA256
34bb7647747a0d6cb35f4ede857390e52db83ed2639f40a4c0ffb00c4bc58c8d

SHA512
8a2a8adf8232329348bf4202210a2e21ee8c1d89830e55f44d6dfa1e55abbeaca5bbda0517d833dc3fc3ed6da199862cb49906410da0c9182af419c8e85b5a9c

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Vfewuoyxb\hobaov.exe
MD5
e63b167120cd8e6801a3e8aed6698b41

SHA1
48d6e4fe9ed1e4b38a785f70cabf4df6c09ac393

SHA256
34bb7647747a0d6cb35f4ede857390e52db83ed2639f40a4c0ffb00c4bc58c8d

SHA512
8a2a8adf8232329348bf4202210a2e21ee8c1d89830e55f44d6dfa1e55abbeaca5bbda0517d833dc3fc3ed6da199862cb49906410da0c9182af419c8e85b5a9c

Download Submit
memory/584-13-0x0000000000000000-mapping.dmp

Download
memory/800-8-0x0000000000000000-mapping.dmp

Download
memory/800-11-0x00000000025B0000-0x00000000025C1000-memory.dmp

Filesize
68KB

Download
memory/900-6-0x0000000000000000-mapping.dmp

Download
memory/1136-15-0x0000000000000000-mapping.dmp

Download
memory/1328-0-0x0000000000000000-mapping.dmp

Download
memory/1328-1-0x0000000002520000-0x0000000002531000-memory.dmp

Filesize
68KB

Download
memory/1600-4-0x0000000000000000-mapping.dmp

Download
memory/1600-12-0x0000000000510000-0x000000000054A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads