qakbot | d8b79cfdc38c2870303af4a21ad22e02325bccbf0ed129e91e5d76369f65a610

General

Target

tkaipv.exe
Size

1.0MB
MD5

9f1f6f7b71fe91c26ab259df5f97e4d7
SHA1

f0bc285f4f84c9c169b3392fec64d5f994fb3dd9
SHA256

d8b79cfdc38c2870303af4a21ad22e02325bccbf0ed129e91e5d76369f65a610
SHA512

c7c2fa11fc63a8e6da609b6571b86526f0d81f1c6dbb3eb2cf866bc1a13126e7f2cfe366ec5d13118277eb1f41c76775b1500ba7cf53e0f720cf5fd78361a5cf

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

wexidie.exewexidie.exe

pid process

1340 wexidie.exe
756 wexidie.exe
Loads dropped DLL 2 IoCs

Processes:

tkaipv.exe

pid process

364 tkaipv.exe
364 tkaipv.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

836 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

tkaipv.exetkaipv.exewexidie.exewexidie.exeexplorer.exetkaipv.exe

pid process

364 tkaipv.exe
1044 tkaipv.exe
1044 tkaipv.exe
1340 wexidie.exe
756 wexidie.exe
756 wexidie.exe
1064 explorer.exe
1064 explorer.exe
1108 tkaipv.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

wexidie.exe

pid process

1340 wexidie.exe

pid	process
1340	wexidie.exe
756	wexidie.exe

pid	process
364	tkaipv.exe
364	tkaipv.exe

pid	process
836	schtasks.exe

pid	process
364	tkaipv.exe
1044	tkaipv.exe
1044	tkaipv.exe
1340	wexidie.exe
756	wexidie.exe
756	wexidie.exe
1064	explorer.exe
1064	explorer.exe
1108	tkaipv.exe

pid	process
1340	wexidie.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

tkaipv.exewexidie.exetaskeng.exe

description	pid	process	target process
PID 364 wrote to memory of 1044	364	tkaipv.exe	tkaipv.exe
PID 364 wrote to memory of 1044	364	tkaipv.exe	tkaipv.exe
PID 364 wrote to memory of 1044	364	tkaipv.exe	tkaipv.exe
PID 364 wrote to memory of 1044	364	tkaipv.exe	tkaipv.exe
PID 364 wrote to memory of 1340	364	tkaipv.exe	wexidie.exe
PID 364 wrote to memory of 1340	364	tkaipv.exe	wexidie.exe
PID 364 wrote to memory of 1340	364	tkaipv.exe	wexidie.exe
PID 364 wrote to memory of 1340	364	tkaipv.exe	wexidie.exe
PID 364 wrote to memory of 836	364	tkaipv.exe	schtasks.exe
PID 364 wrote to memory of 836	364	tkaipv.exe	schtasks.exe
PID 364 wrote to memory of 836	364	tkaipv.exe	schtasks.exe
PID 364 wrote to memory of 836	364	tkaipv.exe	schtasks.exe
PID 1340 wrote to memory of 756	1340	wexidie.exe	wexidie.exe
PID 1340 wrote to memory of 756	1340	wexidie.exe	wexidie.exe
PID 1340 wrote to memory of 756	1340	wexidie.exe	wexidie.exe
PID 1340 wrote to memory of 756	1340	wexidie.exe	wexidie.exe
PID 1340 wrote to memory of 1064	1340	wexidie.exe	explorer.exe
PID 1340 wrote to memory of 1064	1340	wexidie.exe	explorer.exe
PID 1340 wrote to memory of 1064	1340	wexidie.exe	explorer.exe
PID 1340 wrote to memory of 1064	1340	wexidie.exe	explorer.exe
PID 1340 wrote to memory of 1064	1340	wexidie.exe	explorer.exe
PID 400 wrote to memory of 1108	400	taskeng.exe	tkaipv.exe
PID 400 wrote to memory of 1108	400	taskeng.exe	tkaipv.exe
PID 400 wrote to memory of 1108	400	taskeng.exe	tkaipv.exe
PID 400 wrote to memory of 1108	400	taskeng.exe	tkaipv.exe

C:\Users\Admin\AppData\Local\Temp\tkaipv.exe
"C:\Users\Admin\AppData\Local\Temp\tkaipv.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:364

C:\Users\Admin\AppData\Local\Temp\tkaipv.exe
C:\Users\Admin\AppData\Local\Temp\tkaipv.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1044

C:\Users\Admin\AppData\Roaming\Microsoft\Oahepn\wexidie.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Oahepn\wexidie.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1340

C:\Users\Admin\AppData\Roaming\Microsoft\Oahepn\wexidie.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Oahepn\wexidie.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:756

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1064

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn sgnpzfqp /tr "\"C:\Users\Admin\AppData\Local\Temp\tkaipv.exe\" /I sgnpzfqp" /SC ONCE /Z /ST 15:40 /ET 15:52
2⤵
- Creates scheduled task(s)
PID:836

C:\Windows\system32\taskeng.exe
taskeng.exe {1DEDAB8B-E40F-421A-A4A0-4E5E8F7A6298} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:400

C:\Users\Admin\AppData\Local\Temp\tkaipv.exe
C:\Users\Admin\AppData\Local\Temp\tkaipv.exe /I sgnpzfqp
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1108

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Oahepn\wexidie.dat
MD5
0c944ce60aa3d0782734c47d5e93edd1

SHA1
6b9a028e03276221dd32fcfccbba983c565f7065

SHA256
16971b242276baf7a2169929181ef66003a393a238aa40f174437660d3b07218

SHA512
4c673db032b0beb3c6ffc95e8391a0cede189a84918074b7b5b68c3953903133c29a8112b7fdb353f3160c10f0b93fc1fb1a97b37a6a1aa5f881e9ec26f7bd0f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Oahepn\wexidie.exe
MD5
9f1f6f7b71fe91c26ab259df5f97e4d7

SHA1
f0bc285f4f84c9c169b3392fec64d5f994fb3dd9

SHA256
d8b79cfdc38c2870303af4a21ad22e02325bccbf0ed129e91e5d76369f65a610

SHA512
c7c2fa11fc63a8e6da609b6571b86526f0d81f1c6dbb3eb2cf866bc1a13126e7f2cfe366ec5d13118277eb1f41c76775b1500ba7cf53e0f720cf5fd78361a5cf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Oahepn\wexidie.exe
MD5
9f1f6f7b71fe91c26ab259df5f97e4d7

SHA1
f0bc285f4f84c9c169b3392fec64d5f994fb3dd9

SHA256
d8b79cfdc38c2870303af4a21ad22e02325bccbf0ed129e91e5d76369f65a610

SHA512
c7c2fa11fc63a8e6da609b6571b86526f0d81f1c6dbb3eb2cf866bc1a13126e7f2cfe366ec5d13118277eb1f41c76775b1500ba7cf53e0f720cf5fd78361a5cf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Oahepn\wexidie.exe
MD5
9f1f6f7b71fe91c26ab259df5f97e4d7

SHA1
f0bc285f4f84c9c169b3392fec64d5f994fb3dd9

SHA256
d8b79cfdc38c2870303af4a21ad22e02325bccbf0ed129e91e5d76369f65a610

SHA512
c7c2fa11fc63a8e6da609b6571b86526f0d81f1c6dbb3eb2cf866bc1a13126e7f2cfe366ec5d13118277eb1f41c76775b1500ba7cf53e0f720cf5fd78361a5cf

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Oahepn\wexidie.exe
MD5
9f1f6f7b71fe91c26ab259df5f97e4d7

SHA1
f0bc285f4f84c9c169b3392fec64d5f994fb3dd9

SHA256
d8b79cfdc38c2870303af4a21ad22e02325bccbf0ed129e91e5d76369f65a610

SHA512
c7c2fa11fc63a8e6da609b6571b86526f0d81f1c6dbb3eb2cf866bc1a13126e7f2cfe366ec5d13118277eb1f41c76775b1500ba7cf53e0f720cf5fd78361a5cf

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Oahepn\wexidie.exe
MD5
9f1f6f7b71fe91c26ab259df5f97e4d7

SHA1
f0bc285f4f84c9c169b3392fec64d5f994fb3dd9

SHA256
d8b79cfdc38c2870303af4a21ad22e02325bccbf0ed129e91e5d76369f65a610

SHA512
c7c2fa11fc63a8e6da609b6571b86526f0d81f1c6dbb3eb2cf866bc1a13126e7f2cfe366ec5d13118277eb1f41c76775b1500ba7cf53e0f720cf5fd78361a5cf

Download Submit
memory/756-8-0x0000000000000000-mapping.dmp

Download
memory/756-11-0x0000000002680000-0x0000000002691000-memory.dmp

Filesize
68KB

Download
memory/836-6-0x0000000000000000-mapping.dmp

Download
memory/1044-0-0x0000000000000000-mapping.dmp

Download
memory/1044-1-0x0000000002670000-0x0000000002681000-memory.dmp

Filesize
68KB

Download
memory/1064-13-0x0000000000000000-mapping.dmp

Download
memory/1108-15-0x0000000000000000-mapping.dmp

Download
memory/1340-4-0x0000000000000000-mapping.dmp

Download
memory/1340-12-0x0000000001D60000-0x0000000001D9A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads