qakbot | 4c83dc0ef2da8bc57733e58d9ae4dcc0ee1e171c32887b698f6322f076694274

General

Target

mkyirz.exe
Size

1.0MB
MD5

c34b3a7c912d75c9c9962856016338bc
SHA1

fee48a7d24cd3045372239ccefe04030453e3a81
SHA256

4c83dc0ef2da8bc57733e58d9ae4dcc0ee1e171c32887b698f6322f076694274
SHA512

152fc76d848ed0449e7578393ddbdaeac32b1834f9c311ab3ea9b24c0cdaff50e6a5e6b33b23e974792dabefed0fa10c39f9afeba2afc741788016b6d9d18815

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

jyoau.exejyoau.exe

pid process

344 jyoau.exe
332 jyoau.exe
Loads dropped DLL 2 IoCs

Processes:

mkyirz.exe

pid process

1892 mkyirz.exe
1892 mkyirz.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1156 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

mkyirz.exemkyirz.exejyoau.exejyoau.exeexplorer.exemkyirz.exe

pid process

1892 mkyirz.exe
1600 mkyirz.exe
1600 mkyirz.exe
344 jyoau.exe
332 jyoau.exe
332 jyoau.exe
1120 explorer.exe
1120 explorer.exe
1064 mkyirz.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

jyoau.exe

pid process

344 jyoau.exe

pid	process
344	jyoau.exe
332	jyoau.exe

pid	process
1892	mkyirz.exe
1892	mkyirz.exe

pid	process
1156	schtasks.exe

pid	process
1892	mkyirz.exe
1600	mkyirz.exe
1600	mkyirz.exe
344	jyoau.exe
332	jyoau.exe
332	jyoau.exe
1120	explorer.exe
1120	explorer.exe
1064	mkyirz.exe

pid	process
344	jyoau.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

mkyirz.exejyoau.exetaskeng.exe

description	pid	process	target process
PID 1892 wrote to memory of 1600	1892	mkyirz.exe	mkyirz.exe
PID 1892 wrote to memory of 1600	1892	mkyirz.exe	mkyirz.exe
PID 1892 wrote to memory of 1600	1892	mkyirz.exe	mkyirz.exe
PID 1892 wrote to memory of 1600	1892	mkyirz.exe	mkyirz.exe
PID 1892 wrote to memory of 344	1892	mkyirz.exe	jyoau.exe
PID 1892 wrote to memory of 344	1892	mkyirz.exe	jyoau.exe
PID 1892 wrote to memory of 344	1892	mkyirz.exe	jyoau.exe
PID 1892 wrote to memory of 344	1892	mkyirz.exe	jyoau.exe
PID 1892 wrote to memory of 1156	1892	mkyirz.exe	schtasks.exe
PID 1892 wrote to memory of 1156	1892	mkyirz.exe	schtasks.exe
PID 1892 wrote to memory of 1156	1892	mkyirz.exe	schtasks.exe
PID 1892 wrote to memory of 1156	1892	mkyirz.exe	schtasks.exe
PID 344 wrote to memory of 332	344	jyoau.exe	jyoau.exe
PID 344 wrote to memory of 332	344	jyoau.exe	jyoau.exe
PID 344 wrote to memory of 332	344	jyoau.exe	jyoau.exe
PID 344 wrote to memory of 332	344	jyoau.exe	jyoau.exe
PID 344 wrote to memory of 1120	344	jyoau.exe	explorer.exe
PID 344 wrote to memory of 1120	344	jyoau.exe	explorer.exe
PID 344 wrote to memory of 1120	344	jyoau.exe	explorer.exe
PID 344 wrote to memory of 1120	344	jyoau.exe	explorer.exe
PID 344 wrote to memory of 1120	344	jyoau.exe	explorer.exe
PID 1020 wrote to memory of 1064	1020	taskeng.exe	mkyirz.exe
PID 1020 wrote to memory of 1064	1020	taskeng.exe	mkyirz.exe
PID 1020 wrote to memory of 1064	1020	taskeng.exe	mkyirz.exe
PID 1020 wrote to memory of 1064	1020	taskeng.exe	mkyirz.exe

C:\Users\Admin\AppData\Local\Temp\mkyirz.exe
"C:\Users\Admin\AppData\Local\Temp\mkyirz.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1892

C:\Users\Admin\AppData\Local\Temp\mkyirz.exe
C:\Users\Admin\AppData\Local\Temp\mkyirz.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1600

C:\Users\Admin\AppData\Roaming\Microsoft\Xhnxtha\jyoau.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Xhnxtha\jyoau.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:344

C:\Users\Admin\AppData\Roaming\Microsoft\Xhnxtha\jyoau.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Xhnxtha\jyoau.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:332

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1120

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn odwtqta /tr "\"C:\Users\Admin\AppData\Local\Temp\mkyirz.exe\" /I odwtqta" /SC ONCE /Z /ST 14:45 /ET 14:57
2⤵
- Creates scheduled task(s)
PID:1156

C:\Windows\system32\taskeng.exe
taskeng.exe {5D311F18-D70E-42E9-8E2A-16BA81045A21} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1020

C:\Users\Admin\AppData\Local\Temp\mkyirz.exe
C:\Users\Admin\AppData\Local\Temp\mkyirz.exe /I odwtqta
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1064

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Xhnxtha\jyoau.dat
MD5
e4bd1b1552c0f49a10129718c8608a1b

SHA1
31527b4ba7d6ce6ab42c8692697768a05e11ceba

SHA256
72197e307aa120c9168a136c82f48f8876b4ca318c92bab2ba66c73fbe74ae74

SHA512
f0306aed40bac782b18fbcdf8f9c21b6ee6879f0d0ebb3144f02dac41a05711601b618577684834d1584f19b53f6c92ab343aca626d342cc1349748f2a1da51b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Xhnxtha\jyoau.exe
MD5
c34b3a7c912d75c9c9962856016338bc

SHA1
fee48a7d24cd3045372239ccefe04030453e3a81

SHA256
4c83dc0ef2da8bc57733e58d9ae4dcc0ee1e171c32887b698f6322f076694274

SHA512
152fc76d848ed0449e7578393ddbdaeac32b1834f9c311ab3ea9b24c0cdaff50e6a5e6b33b23e974792dabefed0fa10c39f9afeba2afc741788016b6d9d18815

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Xhnxtha\jyoau.exe
MD5
c34b3a7c912d75c9c9962856016338bc

SHA1
fee48a7d24cd3045372239ccefe04030453e3a81

SHA256
4c83dc0ef2da8bc57733e58d9ae4dcc0ee1e171c32887b698f6322f076694274

SHA512
152fc76d848ed0449e7578393ddbdaeac32b1834f9c311ab3ea9b24c0cdaff50e6a5e6b33b23e974792dabefed0fa10c39f9afeba2afc741788016b6d9d18815

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Xhnxtha\jyoau.exe
MD5
c34b3a7c912d75c9c9962856016338bc

SHA1
fee48a7d24cd3045372239ccefe04030453e3a81

SHA256
4c83dc0ef2da8bc57733e58d9ae4dcc0ee1e171c32887b698f6322f076694274

SHA512
152fc76d848ed0449e7578393ddbdaeac32b1834f9c311ab3ea9b24c0cdaff50e6a5e6b33b23e974792dabefed0fa10c39f9afeba2afc741788016b6d9d18815

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Xhnxtha\jyoau.exe
MD5
c34b3a7c912d75c9c9962856016338bc

SHA1
fee48a7d24cd3045372239ccefe04030453e3a81

SHA256
4c83dc0ef2da8bc57733e58d9ae4dcc0ee1e171c32887b698f6322f076694274

SHA512
152fc76d848ed0449e7578393ddbdaeac32b1834f9c311ab3ea9b24c0cdaff50e6a5e6b33b23e974792dabefed0fa10c39f9afeba2afc741788016b6d9d18815

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Xhnxtha\jyoau.exe
MD5
c34b3a7c912d75c9c9962856016338bc

SHA1
fee48a7d24cd3045372239ccefe04030453e3a81

SHA256
4c83dc0ef2da8bc57733e58d9ae4dcc0ee1e171c32887b698f6322f076694274

SHA512
152fc76d848ed0449e7578393ddbdaeac32b1834f9c311ab3ea9b24c0cdaff50e6a5e6b33b23e974792dabefed0fa10c39f9afeba2afc741788016b6d9d18815

Download Submit
memory/332-8-0x0000000000000000-mapping.dmp

Download
memory/332-10-0x0000000002500000-0x0000000002511000-memory.dmp

Filesize
68KB

Download
memory/344-11-0x0000000000510000-0x000000000054A000-memory.dmp

Filesize
232KB

Download
memory/344-4-0x0000000000000000-mapping.dmp

Download
memory/1064-14-0x0000000000000000-mapping.dmp

Download
memory/1120-12-0x0000000000000000-mapping.dmp

Download
memory/1156-6-0x0000000000000000-mapping.dmp

Download
memory/1600-0-0x0000000000000000-mapping.dmp

Download
memory/1600-1-0x0000000002690000-0x00000000026A1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads