qakbot | d3368c621d8b194ddcfc224b20b047008da55bb33593a36bbccd85049a019279

General

Target

zyjsvq.exe
Size

1.0MB
MD5

a41e738834f7f57c140a9ef213b52072
SHA1

64f9a25e8097e9995010dbe85f5ba0b72a6d0417
SHA256

d3368c621d8b194ddcfc224b20b047008da55bb33593a36bbccd85049a019279
SHA512

20599e32d25fe3a2aa90f3d6ff5c01e4aa00db2f9fb93032b13dd35f5d198c4ea0381c7715b832b5e0716aa7d1b2d57dde266d0928cad6935024d6627faf940f

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

tnocwie.exetnocwie.exe

pid process

1676 tnocwie.exe
776 tnocwie.exe
Loads dropped DLL 2 IoCs

Processes:

zyjsvq.exe

pid process

1084 zyjsvq.exe
1084 zyjsvq.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1620 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

zyjsvq.exezyjsvq.exetnocwie.exetnocwie.exeexplorer.exe

pid process

1084 zyjsvq.exe
1536 zyjsvq.exe
1536 zyjsvq.exe
1676 tnocwie.exe
776 tnocwie.exe
776 tnocwie.exe
808 explorer.exe
808 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

tnocwie.exe

pid process

1676 tnocwie.exe

pid	process
1676	tnocwie.exe
776	tnocwie.exe

pid	process
1084	zyjsvq.exe
1084	zyjsvq.exe

pid	process
1620	schtasks.exe

pid	process
1084	zyjsvq.exe
1536	zyjsvq.exe
1536	zyjsvq.exe
1676	tnocwie.exe
776	tnocwie.exe
776	tnocwie.exe
808	explorer.exe
808	explorer.exe

pid	process
1676	tnocwie.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

zyjsvq.exetnocwie.exetaskeng.exe

description	pid	process	target process
PID 1084 wrote to memory of 1536	1084	zyjsvq.exe	zyjsvq.exe
PID 1084 wrote to memory of 1536	1084	zyjsvq.exe	zyjsvq.exe
PID 1084 wrote to memory of 1536	1084	zyjsvq.exe	zyjsvq.exe
PID 1084 wrote to memory of 1536	1084	zyjsvq.exe	zyjsvq.exe
PID 1084 wrote to memory of 1676	1084	zyjsvq.exe	tnocwie.exe
PID 1084 wrote to memory of 1676	1084	zyjsvq.exe	tnocwie.exe
PID 1084 wrote to memory of 1676	1084	zyjsvq.exe	tnocwie.exe
PID 1084 wrote to memory of 1676	1084	zyjsvq.exe	tnocwie.exe
PID 1084 wrote to memory of 1620	1084	zyjsvq.exe	schtasks.exe
PID 1084 wrote to memory of 1620	1084	zyjsvq.exe	schtasks.exe
PID 1084 wrote to memory of 1620	1084	zyjsvq.exe	schtasks.exe
PID 1084 wrote to memory of 1620	1084	zyjsvq.exe	schtasks.exe
PID 1676 wrote to memory of 776	1676	tnocwie.exe	tnocwie.exe
PID 1676 wrote to memory of 776	1676	tnocwie.exe	tnocwie.exe
PID 1676 wrote to memory of 776	1676	tnocwie.exe	tnocwie.exe
PID 1676 wrote to memory of 776	1676	tnocwie.exe	tnocwie.exe
PID 1676 wrote to memory of 808	1676	tnocwie.exe	explorer.exe
PID 1676 wrote to memory of 808	1676	tnocwie.exe	explorer.exe
PID 1676 wrote to memory of 808	1676	tnocwie.exe	explorer.exe
PID 1676 wrote to memory of 808	1676	tnocwie.exe	explorer.exe
PID 1676 wrote to memory of 808	1676	tnocwie.exe	explorer.exe
PID 564 wrote to memory of 812	564	taskeng.exe	zyjsvq.exe
PID 564 wrote to memory of 812	564	taskeng.exe	zyjsvq.exe
PID 564 wrote to memory of 812	564	taskeng.exe	zyjsvq.exe
PID 564 wrote to memory of 812	564	taskeng.exe	zyjsvq.exe

C:\Users\Admin\AppData\Local\Temp\zyjsvq.exe
"C:\Users\Admin\AppData\Local\Temp\zyjsvq.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1084

C:\Users\Admin\AppData\Local\Temp\zyjsvq.exe
C:\Users\Admin\AppData\Local\Temp\zyjsvq.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536

C:\Users\Admin\AppData\Roaming\Microsoft\Oenpfx\tnocwie.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Oenpfx\tnocwie.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1676

C:\Users\Admin\AppData\Roaming\Microsoft\Oenpfx\tnocwie.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Oenpfx\tnocwie.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:776

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:808

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn whfdnmc /tr "\"C:\Users\Admin\AppData\Local\Temp\zyjsvq.exe\" /I whfdnmc" /SC ONCE /Z /ST 14:46 /ET 14:58
2⤵
- Creates scheduled task(s)
PID:1620

C:\Windows\system32\taskeng.exe
taskeng.exe {CA7D5498-9EA0-449C-BA8E-B5A3B1475C53} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:564

C:\Users\Admin\AppData\Local\Temp\zyjsvq.exe
C:\Users\Admin\AppData\Local\Temp\zyjsvq.exe /I whfdnmc
2⤵
PID:812

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Oenpfx\tnocwie.dat
MD5
6130dd0eb73f9208eb1ae91a2374616e

SHA1
279d8f8095f3ff8edf5b58e8c3faf38a4635a3bc

SHA256
dca3949a7df6a66c72d52017ddf5ade172145f6ff25177cb2004bdaf896871e2

SHA512
db91f99f21a9ae7a291e988a328f946127809d09f83131a1c54d10da2890c182c7b516b74015048538cfc12148a518a28714ec69124a286bb77a6eadd8271fca

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Oenpfx\tnocwie.exe
MD5
a41e738834f7f57c140a9ef213b52072

SHA1
64f9a25e8097e9995010dbe85f5ba0b72a6d0417

SHA256
d3368c621d8b194ddcfc224b20b047008da55bb33593a36bbccd85049a019279

SHA512
20599e32d25fe3a2aa90f3d6ff5c01e4aa00db2f9fb93032b13dd35f5d198c4ea0381c7715b832b5e0716aa7d1b2d57dde266d0928cad6935024d6627faf940f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Oenpfx\tnocwie.exe
MD5
a41e738834f7f57c140a9ef213b52072

SHA1
64f9a25e8097e9995010dbe85f5ba0b72a6d0417

SHA256
d3368c621d8b194ddcfc224b20b047008da55bb33593a36bbccd85049a019279

SHA512
20599e32d25fe3a2aa90f3d6ff5c01e4aa00db2f9fb93032b13dd35f5d198c4ea0381c7715b832b5e0716aa7d1b2d57dde266d0928cad6935024d6627faf940f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Oenpfx\tnocwie.exe
MD5
a41e738834f7f57c140a9ef213b52072

SHA1
64f9a25e8097e9995010dbe85f5ba0b72a6d0417

SHA256
d3368c621d8b194ddcfc224b20b047008da55bb33593a36bbccd85049a019279

SHA512
20599e32d25fe3a2aa90f3d6ff5c01e4aa00db2f9fb93032b13dd35f5d198c4ea0381c7715b832b5e0716aa7d1b2d57dde266d0928cad6935024d6627faf940f

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Oenpfx\tnocwie.exe
MD5
a41e738834f7f57c140a9ef213b52072

SHA1
64f9a25e8097e9995010dbe85f5ba0b72a6d0417

SHA256
d3368c621d8b194ddcfc224b20b047008da55bb33593a36bbccd85049a019279

SHA512
20599e32d25fe3a2aa90f3d6ff5c01e4aa00db2f9fb93032b13dd35f5d198c4ea0381c7715b832b5e0716aa7d1b2d57dde266d0928cad6935024d6627faf940f

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Oenpfx\tnocwie.exe
MD5
a41e738834f7f57c140a9ef213b52072

SHA1
64f9a25e8097e9995010dbe85f5ba0b72a6d0417

SHA256
d3368c621d8b194ddcfc224b20b047008da55bb33593a36bbccd85049a019279

SHA512
20599e32d25fe3a2aa90f3d6ff5c01e4aa00db2f9fb93032b13dd35f5d198c4ea0381c7715b832b5e0716aa7d1b2d57dde266d0928cad6935024d6627faf940f

Download Submit
memory/776-8-0x0000000000000000-mapping.dmp

Download
memory/776-10-0x0000000002580000-0x0000000002591000-memory.dmp

Filesize
68KB

Download
memory/808-12-0x0000000000000000-mapping.dmp

Download
memory/812-14-0x0000000000000000-mapping.dmp

Download
memory/1536-0-0x0000000000000000-mapping.dmp

Download
memory/1536-1-0x0000000002550000-0x0000000002561000-memory.dmp

Filesize
68KB

Download
memory/1620-6-0x0000000000000000-mapping.dmp

Download
memory/1676-4-0x0000000000000000-mapping.dmp

Download
memory/1676-11-0x0000000000510000-0x000000000054A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads