qakbot | 7fbee47f67d7ddc252e9ca8cbdb981f0497f6a6781524f882f67348f4e9b1f6b

General

Target

tqnsfi.exe
Size

1.0MB
MD5

0d6117076050e50d36dbd23efbef42df
SHA1

eb5af0599e92eba03b1b7fe91ed8938d3ff0a6b0
SHA256

7fbee47f67d7ddc252e9ca8cbdb981f0497f6a6781524f882f67348f4e9b1f6b
SHA512

66dea08a2c077c56cc0322c95c12098bb79be0d5751d1c06087a21fe124f1f7d62b5bbdb8a131fbf6f7bc17ae8c1513e3d6d074e81095bb82126e44361aff84c

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

juyopjf.exejuyopjf.exe

pid process

1704 juyopjf.exe
1324 juyopjf.exe
Loads dropped DLL 2 IoCs

Processes:

tqnsfi.exe

pid process

1320 tqnsfi.exe
1320 tqnsfi.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1676 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

tqnsfi.exetqnsfi.exejuyopjf.exejuyopjf.exeexplorer.exetqnsfi.exe

pid process

1320 tqnsfi.exe
1288 tqnsfi.exe
1288 tqnsfi.exe
1704 juyopjf.exe
1324 juyopjf.exe
1324 juyopjf.exe
1328 explorer.exe
1328 explorer.exe
1264 tqnsfi.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

juyopjf.exe

pid process

1704 juyopjf.exe

pid	process
1704	juyopjf.exe
1324	juyopjf.exe

pid	process
1320	tqnsfi.exe
1320	tqnsfi.exe

pid	process
1676	schtasks.exe

pid	process
1320	tqnsfi.exe
1288	tqnsfi.exe
1288	tqnsfi.exe
1704	juyopjf.exe
1324	juyopjf.exe
1324	juyopjf.exe
1328	explorer.exe
1328	explorer.exe
1264	tqnsfi.exe

pid	process
1704	juyopjf.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

tqnsfi.exejuyopjf.exetaskeng.exe

description	pid	process	target process
PID 1320 wrote to memory of 1288	1320	tqnsfi.exe	tqnsfi.exe
PID 1320 wrote to memory of 1288	1320	tqnsfi.exe	tqnsfi.exe
PID 1320 wrote to memory of 1288	1320	tqnsfi.exe	tqnsfi.exe
PID 1320 wrote to memory of 1288	1320	tqnsfi.exe	tqnsfi.exe
PID 1320 wrote to memory of 1704	1320	tqnsfi.exe	juyopjf.exe
PID 1320 wrote to memory of 1704	1320	tqnsfi.exe	juyopjf.exe
PID 1320 wrote to memory of 1704	1320	tqnsfi.exe	juyopjf.exe
PID 1320 wrote to memory of 1704	1320	tqnsfi.exe	juyopjf.exe
PID 1320 wrote to memory of 1676	1320	tqnsfi.exe	schtasks.exe
PID 1320 wrote to memory of 1676	1320	tqnsfi.exe	schtasks.exe
PID 1320 wrote to memory of 1676	1320	tqnsfi.exe	schtasks.exe
PID 1320 wrote to memory of 1676	1320	tqnsfi.exe	schtasks.exe
PID 1704 wrote to memory of 1324	1704	juyopjf.exe	juyopjf.exe
PID 1704 wrote to memory of 1324	1704	juyopjf.exe	juyopjf.exe
PID 1704 wrote to memory of 1324	1704	juyopjf.exe	juyopjf.exe
PID 1704 wrote to memory of 1324	1704	juyopjf.exe	juyopjf.exe
PID 1704 wrote to memory of 1328	1704	juyopjf.exe	explorer.exe
PID 1704 wrote to memory of 1328	1704	juyopjf.exe	explorer.exe
PID 1704 wrote to memory of 1328	1704	juyopjf.exe	explorer.exe
PID 1704 wrote to memory of 1328	1704	juyopjf.exe	explorer.exe
PID 1704 wrote to memory of 1328	1704	juyopjf.exe	explorer.exe
PID 416 wrote to memory of 1264	416	taskeng.exe	tqnsfi.exe
PID 416 wrote to memory of 1264	416	taskeng.exe	tqnsfi.exe
PID 416 wrote to memory of 1264	416	taskeng.exe	tqnsfi.exe
PID 416 wrote to memory of 1264	416	taskeng.exe	tqnsfi.exe

C:\Users\Admin\AppData\Local\Temp\tqnsfi.exe
"C:\Users\Admin\AppData\Local\Temp\tqnsfi.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1320

C:\Users\Admin\AppData\Local\Temp\tqnsfi.exe
C:\Users\Admin\AppData\Local\Temp\tqnsfi.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1288

C:\Users\Admin\AppData\Roaming\Microsoft\Uogokaa\juyopjf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Uogokaa\juyopjf.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Roaming\Microsoft\Uogokaa\juyopjf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Uogokaa\juyopjf.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1324

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1328

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yzurrqlhez /tr "\"C:\Users\Admin\AppData\Local\Temp\tqnsfi.exe\" /I yzurrqlhez" /SC ONCE /Z /ST 15:45 /ET 15:57
2⤵
- Creates scheduled task(s)
PID:1676

C:\Windows\system32\taskeng.exe
taskeng.exe {719C4B59-D72A-4328-A346-44DA80DB9F19} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:416

C:\Users\Admin\AppData\Local\Temp\tqnsfi.exe
C:\Users\Admin\AppData\Local\Temp\tqnsfi.exe /I yzurrqlhez
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1264

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Uogokaa\juyopjf.dat
MD5
e501d5c4ef621b4e5b104fb58d21c0cd

SHA1
c9948349eaa6fea3e04ea45e855240d1d27896a3

SHA256
4167e8aa25dd3c150853c8db7bab318e84037fd52767a76104c0208791347adc

SHA512
cdda6f67916a9efa027c01a6bbf5199d7f64080a52f814e9e1a833a38b7dc383c44e12a6447e4e63542349335dd41f98ef76850baef965d37ba69e722f68a26f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Uogokaa\juyopjf.exe
MD5
0d6117076050e50d36dbd23efbef42df

SHA1
eb5af0599e92eba03b1b7fe91ed8938d3ff0a6b0

SHA256
7fbee47f67d7ddc252e9ca8cbdb981f0497f6a6781524f882f67348f4e9b1f6b

SHA512
66dea08a2c077c56cc0322c95c12098bb79be0d5751d1c06087a21fe124f1f7d62b5bbdb8a131fbf6f7bc17ae8c1513e3d6d074e81095bb82126e44361aff84c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Uogokaa\juyopjf.exe
MD5
0d6117076050e50d36dbd23efbef42df

SHA1
eb5af0599e92eba03b1b7fe91ed8938d3ff0a6b0

SHA256
7fbee47f67d7ddc252e9ca8cbdb981f0497f6a6781524f882f67348f4e9b1f6b

SHA512
66dea08a2c077c56cc0322c95c12098bb79be0d5751d1c06087a21fe124f1f7d62b5bbdb8a131fbf6f7bc17ae8c1513e3d6d074e81095bb82126e44361aff84c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Uogokaa\juyopjf.exe
MD5
0d6117076050e50d36dbd23efbef42df

SHA1
eb5af0599e92eba03b1b7fe91ed8938d3ff0a6b0

SHA256
7fbee47f67d7ddc252e9ca8cbdb981f0497f6a6781524f882f67348f4e9b1f6b

SHA512
66dea08a2c077c56cc0322c95c12098bb79be0d5751d1c06087a21fe124f1f7d62b5bbdb8a131fbf6f7bc17ae8c1513e3d6d074e81095bb82126e44361aff84c

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Uogokaa\juyopjf.exe
MD5
0d6117076050e50d36dbd23efbef42df

SHA1
eb5af0599e92eba03b1b7fe91ed8938d3ff0a6b0

SHA256
7fbee47f67d7ddc252e9ca8cbdb981f0497f6a6781524f882f67348f4e9b1f6b

SHA512
66dea08a2c077c56cc0322c95c12098bb79be0d5751d1c06087a21fe124f1f7d62b5bbdb8a131fbf6f7bc17ae8c1513e3d6d074e81095bb82126e44361aff84c

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Uogokaa\juyopjf.exe
MD5
0d6117076050e50d36dbd23efbef42df

SHA1
eb5af0599e92eba03b1b7fe91ed8938d3ff0a6b0

SHA256
7fbee47f67d7ddc252e9ca8cbdb981f0497f6a6781524f882f67348f4e9b1f6b

SHA512
66dea08a2c077c56cc0322c95c12098bb79be0d5751d1c06087a21fe124f1f7d62b5bbdb8a131fbf6f7bc17ae8c1513e3d6d074e81095bb82126e44361aff84c

Download Submit
memory/1264-14-0x0000000000000000-mapping.dmp

Download
memory/1288-0-0x0000000000000000-mapping.dmp

Download
memory/1288-1-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/1324-8-0x0000000000000000-mapping.dmp

Download
memory/1324-10-0x00000000025E0000-0x00000000025F1000-memory.dmp

Filesize
68KB

Download
memory/1328-12-0x0000000000000000-mapping.dmp

Download
memory/1676-6-0x0000000000000000-mapping.dmp

Download
memory/1704-4-0x0000000000000000-mapping.dmp

Download
memory/1704-11-0x00000000003C0000-0x00000000003FA000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads