qakbot | e213d4a2a34b137b44cdc0d395168e303376f84f7111194adc0403cd0059b5c4

General

Target

jlbdme.exe
Size

1.0MB
MD5

e06aaa8d5c296a8731d0867e135422d7
SHA1

c8b0656b6ffbf935bae96316b609a92435a4639e
SHA256

e213d4a2a34b137b44cdc0d395168e303376f84f7111194adc0403cd0059b5c4
SHA512

cfcc035205d83d4b70948b40af4b9fa29cc0b2339c479692220613e9d32b3402e4633773a97624431874c0a6808e1c0038f8fac3993e19207b1e14294c68be0c

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

ibaossr.exeibaossr.exe

pid process

1408 ibaossr.exe
280 ibaossr.exe
Loads dropped DLL 2 IoCs

Processes:

jlbdme.exe

pid process

1704 jlbdme.exe
1704 jlbdme.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1592 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

jlbdme.exejlbdme.exeibaossr.exeibaossr.exeexplorer.exejlbdme.exe

pid process

1704 jlbdme.exe
1268 jlbdme.exe
1268 jlbdme.exe
1408 ibaossr.exe
280 ibaossr.exe
280 ibaossr.exe
1076 explorer.exe
1076 explorer.exe
1348 jlbdme.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ibaossr.exe

pid process

1408 ibaossr.exe

pid	process
1408	ibaossr.exe
280	ibaossr.exe

pid	process
1704	jlbdme.exe
1704	jlbdme.exe

pid	process
1592	schtasks.exe

pid	process
1704	jlbdme.exe
1268	jlbdme.exe
1268	jlbdme.exe
1408	ibaossr.exe
280	ibaossr.exe
280	ibaossr.exe
1076	explorer.exe
1076	explorer.exe
1348	jlbdme.exe

pid	process
1408	ibaossr.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

jlbdme.exeibaossr.exetaskeng.exe

description	pid	process	target process
PID 1704 wrote to memory of 1268	1704	jlbdme.exe	jlbdme.exe
PID 1704 wrote to memory of 1268	1704	jlbdme.exe	jlbdme.exe
PID 1704 wrote to memory of 1268	1704	jlbdme.exe	jlbdme.exe
PID 1704 wrote to memory of 1268	1704	jlbdme.exe	jlbdme.exe
PID 1704 wrote to memory of 1408	1704	jlbdme.exe	ibaossr.exe
PID 1704 wrote to memory of 1408	1704	jlbdme.exe	ibaossr.exe
PID 1704 wrote to memory of 1408	1704	jlbdme.exe	ibaossr.exe
PID 1704 wrote to memory of 1408	1704	jlbdme.exe	ibaossr.exe
PID 1704 wrote to memory of 1592	1704	jlbdme.exe	schtasks.exe
PID 1704 wrote to memory of 1592	1704	jlbdme.exe	schtasks.exe
PID 1704 wrote to memory of 1592	1704	jlbdme.exe	schtasks.exe
PID 1704 wrote to memory of 1592	1704	jlbdme.exe	schtasks.exe
PID 1408 wrote to memory of 280	1408	ibaossr.exe	ibaossr.exe
PID 1408 wrote to memory of 280	1408	ibaossr.exe	ibaossr.exe
PID 1408 wrote to memory of 280	1408	ibaossr.exe	ibaossr.exe
PID 1408 wrote to memory of 280	1408	ibaossr.exe	ibaossr.exe
PID 1408 wrote to memory of 1076	1408	ibaossr.exe	explorer.exe
PID 1408 wrote to memory of 1076	1408	ibaossr.exe	explorer.exe
PID 1408 wrote to memory of 1076	1408	ibaossr.exe	explorer.exe
PID 1408 wrote to memory of 1076	1408	ibaossr.exe	explorer.exe
PID 1408 wrote to memory of 1076	1408	ibaossr.exe	explorer.exe
PID 548 wrote to memory of 1348	548	taskeng.exe	jlbdme.exe
PID 548 wrote to memory of 1348	548	taskeng.exe	jlbdme.exe
PID 548 wrote to memory of 1348	548	taskeng.exe	jlbdme.exe
PID 548 wrote to memory of 1348	548	taskeng.exe	jlbdme.exe

C:\Users\Admin\AppData\Local\Temp\jlbdme.exe
"C:\Users\Admin\AppData\Local\Temp\jlbdme.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Local\Temp\jlbdme.exe
C:\Users\Admin\AppData\Local\Temp\jlbdme.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1268

C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1408

C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:280

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ekuolxpjic /tr "\"C:\Users\Admin\AppData\Local\Temp\jlbdme.exe\" /I ekuolxpjic" /SC ONCE /Z /ST 14:46 /ET 14:58
2⤵
- Creates scheduled task(s)
PID:1592

C:\Windows\system32\taskeng.exe
taskeng.exe {C9E5968C-DAED-4004-8744-F0B38C8BC136} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:548

C:\Users\Admin\AppData\Local\Temp\jlbdme.exe
C:\Users\Admin\AppData\Local\Temp\jlbdme.exe /I ekuolxpjic
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1348

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.dat
MD5
5bbea06303115e4fe7d212d38f16bff4

SHA1
e21e6e6f21921487d4f98176fd0f69d5e0b1fd28

SHA256
04ed1927e3d861400f9ce10149cda059732c9351ee0beaa87d7efbc4f419e2d6

SHA512
5c7fbe8da4fafeee97993b3f785e3f8b6b3cd024a09588b20a70a68085d0ee0c22e1e0a4062791599814e7fc0717f17d8568a80df227a32bd74478f81b882f7f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe
MD5
e06aaa8d5c296a8731d0867e135422d7

SHA1
c8b0656b6ffbf935bae96316b609a92435a4639e

SHA256
e213d4a2a34b137b44cdc0d395168e303376f84f7111194adc0403cd0059b5c4

SHA512
cfcc035205d83d4b70948b40af4b9fa29cc0b2339c479692220613e9d32b3402e4633773a97624431874c0a6808e1c0038f8fac3993e19207b1e14294c68be0c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe
MD5
e06aaa8d5c296a8731d0867e135422d7

SHA1
c8b0656b6ffbf935bae96316b609a92435a4639e

SHA256
e213d4a2a34b137b44cdc0d395168e303376f84f7111194adc0403cd0059b5c4

SHA512
cfcc035205d83d4b70948b40af4b9fa29cc0b2339c479692220613e9d32b3402e4633773a97624431874c0a6808e1c0038f8fac3993e19207b1e14294c68be0c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe
MD5
e06aaa8d5c296a8731d0867e135422d7

SHA1
c8b0656b6ffbf935bae96316b609a92435a4639e

SHA256
e213d4a2a34b137b44cdc0d395168e303376f84f7111194adc0403cd0059b5c4

SHA512
cfcc035205d83d4b70948b40af4b9fa29cc0b2339c479692220613e9d32b3402e4633773a97624431874c0a6808e1c0038f8fac3993e19207b1e14294c68be0c

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe
MD5
e06aaa8d5c296a8731d0867e135422d7

SHA1
c8b0656b6ffbf935bae96316b609a92435a4639e

SHA256
e213d4a2a34b137b44cdc0d395168e303376f84f7111194adc0403cd0059b5c4

SHA512
cfcc035205d83d4b70948b40af4b9fa29cc0b2339c479692220613e9d32b3402e4633773a97624431874c0a6808e1c0038f8fac3993e19207b1e14294c68be0c

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe
MD5
e06aaa8d5c296a8731d0867e135422d7

SHA1
c8b0656b6ffbf935bae96316b609a92435a4639e

SHA256
e213d4a2a34b137b44cdc0d395168e303376f84f7111194adc0403cd0059b5c4

SHA512
cfcc035205d83d4b70948b40af4b9fa29cc0b2339c479692220613e9d32b3402e4633773a97624431874c0a6808e1c0038f8fac3993e19207b1e14294c68be0c

Download Submit
memory/280-8-0x0000000000000000-mapping.dmp

Download
memory/280-10-0x0000000002600000-0x0000000002611000-memory.dmp

Filesize
68KB

Download
memory/1076-12-0x0000000000000000-mapping.dmp

Download
memory/1268-1-0x00000000024D0000-0x00000000024E1000-memory.dmp

Filesize
68KB

Download
memory/1268-0-0x0000000000000000-mapping.dmp

Download
memory/1348-14-0x0000000000000000-mapping.dmp

Download
memory/1408-4-0x0000000000000000-mapping.dmp

Download
memory/1408-11-0x00000000003C0000-0x00000000003FA000-memory.dmp

Filesize
232KB

Download
memory/1592-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads