qakbot | 456e614e58cc3a64f60a127209134e380c97f608484fcb2861c23006177a3448

General

Target

ajhbii.exe
Size

1.0MB
MD5

6d75b095fd054c242a3b67a8ff8db744
SHA1

3353cffbcb85a9f6341e97fc89168febfbab7be8
SHA256

456e614e58cc3a64f60a127209134e380c97f608484fcb2861c23006177a3448
SHA512

85d8894d7bc25b399d42817879ec939088b6255038b5676828e831413532092d7aa96e2a6c6c39dafb8c3ea34bedf6ac2df7154b7f493fab8a0e490c9b27a353

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

msierb.exemsierb.exe

pid process

1700 msierb.exe
592 msierb.exe
Loads dropped DLL 2 IoCs

Processes:

ajhbii.exe

pid process

744 ajhbii.exe
744 ajhbii.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1352 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

ajhbii.exeajhbii.exemsierb.exemsierb.exeexplorer.exeajhbii.exe

pid process

744 ajhbii.exe
1756 ajhbii.exe
1756 ajhbii.exe
1700 msierb.exe
592 msierb.exe
592 msierb.exe
1212 explorer.exe
1212 explorer.exe
812 ajhbii.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

msierb.exe

pid process

1700 msierb.exe

pid	process
1700	msierb.exe
592	msierb.exe

pid	process
744	ajhbii.exe
744	ajhbii.exe

pid	process
1352	schtasks.exe

pid	process
744	ajhbii.exe
1756	ajhbii.exe
1756	ajhbii.exe
1700	msierb.exe
592	msierb.exe
592	msierb.exe
1212	explorer.exe
1212	explorer.exe
812	ajhbii.exe

pid	process
1700	msierb.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

ajhbii.exemsierb.exetaskeng.exe

description	pid	process	target process
PID 744 wrote to memory of 1756	744	ajhbii.exe	ajhbii.exe
PID 744 wrote to memory of 1756	744	ajhbii.exe	ajhbii.exe
PID 744 wrote to memory of 1756	744	ajhbii.exe	ajhbii.exe
PID 744 wrote to memory of 1756	744	ajhbii.exe	ajhbii.exe
PID 744 wrote to memory of 1700	744	ajhbii.exe	msierb.exe
PID 744 wrote to memory of 1700	744	ajhbii.exe	msierb.exe
PID 744 wrote to memory of 1700	744	ajhbii.exe	msierb.exe
PID 744 wrote to memory of 1700	744	ajhbii.exe	msierb.exe
PID 744 wrote to memory of 1352	744	ajhbii.exe	schtasks.exe
PID 744 wrote to memory of 1352	744	ajhbii.exe	schtasks.exe
PID 744 wrote to memory of 1352	744	ajhbii.exe	schtasks.exe
PID 744 wrote to memory of 1352	744	ajhbii.exe	schtasks.exe
PID 1700 wrote to memory of 592	1700	msierb.exe	msierb.exe
PID 1700 wrote to memory of 592	1700	msierb.exe	msierb.exe
PID 1700 wrote to memory of 592	1700	msierb.exe	msierb.exe
PID 1700 wrote to memory of 592	1700	msierb.exe	msierb.exe
PID 1700 wrote to memory of 1212	1700	msierb.exe	explorer.exe
PID 1700 wrote to memory of 1212	1700	msierb.exe	explorer.exe
PID 1700 wrote to memory of 1212	1700	msierb.exe	explorer.exe
PID 1700 wrote to memory of 1212	1700	msierb.exe	explorer.exe
PID 1700 wrote to memory of 1212	1700	msierb.exe	explorer.exe
PID 840 wrote to memory of 812	840	taskeng.exe	ajhbii.exe
PID 840 wrote to memory of 812	840	taskeng.exe	ajhbii.exe
PID 840 wrote to memory of 812	840	taskeng.exe	ajhbii.exe
PID 840 wrote to memory of 812	840	taskeng.exe	ajhbii.exe

C:\Users\Admin\AppData\Local\Temp\ajhbii.exe
"C:\Users\Admin\AppData\Local\Temp\ajhbii.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:744

C:\Users\Admin\AppData\Local\Temp\ajhbii.exe
C:\Users\Admin\AppData\Local\Temp\ajhbii.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1756

C:\Users\Admin\AppData\Roaming\Microsoft\Lnooen\msierb.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Lnooen\msierb.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1700

C:\Users\Admin\AppData\Roaming\Microsoft\Lnooen\msierb.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Lnooen\msierb.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:592

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1212

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ktxdchepl /tr "\"C:\Users\Admin\AppData\Local\Temp\ajhbii.exe\" /I ktxdchepl" /SC ONCE /Z /ST 15:39 /ET 15:51
2⤵
- Creates scheduled task(s)
PID:1352

C:\Windows\system32\taskeng.exe
taskeng.exe {B2A4C25F-7622-4523-B809-5386A0BC1BD3} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:840

C:\Users\Admin\AppData\Local\Temp\ajhbii.exe
C:\Users\Admin\AppData\Local\Temp\ajhbii.exe /I ktxdchepl
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:812

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Lnooen\msierb.dat
MD5
6d9e8edbc15545ac0581f9e0fdc31574

SHA1
5d9a8f7fe246ca8acd9ae02d587d8f86fc0f24bc

SHA256
782aa325a8e81d10ea90b523efdd2ebb787dc836125879e00dc0e92a4978bc3e

SHA512
03d7e15b91453b06c90db55413d55e20b3bec89f99ccf68205179e99b627a977e1874fea593f1a1ee32deddb2a4cb50eb81cca172470a156f50b02fe781a606c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lnooen\msierb.exe
MD5
6d75b095fd054c242a3b67a8ff8db744

SHA1
3353cffbcb85a9f6341e97fc89168febfbab7be8

SHA256
456e614e58cc3a64f60a127209134e380c97f608484fcb2861c23006177a3448

SHA512
85d8894d7bc25b399d42817879ec939088b6255038b5676828e831413532092d7aa96e2a6c6c39dafb8c3ea34bedf6ac2df7154b7f493fab8a0e490c9b27a353

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lnooen\msierb.exe
MD5
6d75b095fd054c242a3b67a8ff8db744

SHA1
3353cffbcb85a9f6341e97fc89168febfbab7be8

SHA256
456e614e58cc3a64f60a127209134e380c97f608484fcb2861c23006177a3448

SHA512
85d8894d7bc25b399d42817879ec939088b6255038b5676828e831413532092d7aa96e2a6c6c39dafb8c3ea34bedf6ac2df7154b7f493fab8a0e490c9b27a353

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lnooen\msierb.exe
MD5
6d75b095fd054c242a3b67a8ff8db744

SHA1
3353cffbcb85a9f6341e97fc89168febfbab7be8

SHA256
456e614e58cc3a64f60a127209134e380c97f608484fcb2861c23006177a3448

SHA512
85d8894d7bc25b399d42817879ec939088b6255038b5676828e831413532092d7aa96e2a6c6c39dafb8c3ea34bedf6ac2df7154b7f493fab8a0e490c9b27a353

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Lnooen\msierb.exe
MD5
6d75b095fd054c242a3b67a8ff8db744

SHA1
3353cffbcb85a9f6341e97fc89168febfbab7be8

SHA256
456e614e58cc3a64f60a127209134e380c97f608484fcb2861c23006177a3448

SHA512
85d8894d7bc25b399d42817879ec939088b6255038b5676828e831413532092d7aa96e2a6c6c39dafb8c3ea34bedf6ac2df7154b7f493fab8a0e490c9b27a353

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Lnooen\msierb.exe
MD5
6d75b095fd054c242a3b67a8ff8db744

SHA1
3353cffbcb85a9f6341e97fc89168febfbab7be8

SHA256
456e614e58cc3a64f60a127209134e380c97f608484fcb2861c23006177a3448

SHA512
85d8894d7bc25b399d42817879ec939088b6255038b5676828e831413532092d7aa96e2a6c6c39dafb8c3ea34bedf6ac2df7154b7f493fab8a0e490c9b27a353

Download Submit
memory/592-8-0x0000000000000000-mapping.dmp

Download
memory/592-10-0x0000000002650000-0x0000000002661000-memory.dmp

Filesize
68KB

Download
memory/812-14-0x0000000000000000-mapping.dmp

Download
memory/1212-12-0x0000000000000000-mapping.dmp

Download
memory/1352-6-0x0000000000000000-mapping.dmp

Download
memory/1700-4-0x0000000000000000-mapping.dmp

Download
memory/1700-11-0x00000000003C0000-0x00000000003FA000-memory.dmp

Filesize
232KB

Download
memory/1756-0-0x0000000000000000-mapping.dmp

Download
memory/1756-1-0x00000000025E0000-0x00000000025F1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads