qakbot | 2d516a98f0ac197d808becec8c53623310992d7ce95c911a57bf9cfda3b20f94

General

Target

tmepsh.exe
Size

1.0MB
MD5

3adefcf414e69c9b852f8ae2cba0c091
SHA1

9ab76a01f2e9b578bdb6d0e6e9505b85fb025017
SHA256

2d516a98f0ac197d808becec8c53623310992d7ce95c911a57bf9cfda3b20f94
SHA512

e07fa9d0ff9dd5502e5305930c9292a144b2742bb2a4406d6d3fc1745ab2fe88f01fee4f8657578fe5c611c809bc2aa1392cbac4f7fbe1c354022ac48c008745

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

wzoyy.exewzoyy.exe

pid process

1576 wzoyy.exe
1780 wzoyy.exe
Loads dropped DLL 2 IoCs

Processes:

tmepsh.exe

pid process

1644 tmepsh.exe
1644 tmepsh.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1532 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

tmepsh.exetmepsh.exewzoyy.exewzoyy.exeexplorer.exetmepsh.exe

pid process

1644 tmepsh.exe
1268 tmepsh.exe
1268 tmepsh.exe
1576 wzoyy.exe
1780 wzoyy.exe
1780 wzoyy.exe
1460 explorer.exe
1460 explorer.exe
1728 tmepsh.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

wzoyy.exe

pid process

1576 wzoyy.exe

pid	process
1576	wzoyy.exe
1780	wzoyy.exe

pid	process
1644	tmepsh.exe
1644	tmepsh.exe

pid	process
1532	schtasks.exe

pid	process
1644	tmepsh.exe
1268	tmepsh.exe
1268	tmepsh.exe
1576	wzoyy.exe
1780	wzoyy.exe
1780	wzoyy.exe
1460	explorer.exe
1460	explorer.exe
1728	tmepsh.exe

pid	process
1576	wzoyy.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

tmepsh.exewzoyy.exetaskeng.exe

description	pid	process	target process
PID 1644 wrote to memory of 1268	1644	tmepsh.exe	tmepsh.exe
PID 1644 wrote to memory of 1268	1644	tmepsh.exe	tmepsh.exe
PID 1644 wrote to memory of 1268	1644	tmepsh.exe	tmepsh.exe
PID 1644 wrote to memory of 1268	1644	tmepsh.exe	tmepsh.exe
PID 1644 wrote to memory of 1576	1644	tmepsh.exe	wzoyy.exe
PID 1644 wrote to memory of 1576	1644	tmepsh.exe	wzoyy.exe
PID 1644 wrote to memory of 1576	1644	tmepsh.exe	wzoyy.exe
PID 1644 wrote to memory of 1576	1644	tmepsh.exe	wzoyy.exe
PID 1644 wrote to memory of 1532	1644	tmepsh.exe	schtasks.exe
PID 1644 wrote to memory of 1532	1644	tmepsh.exe	schtasks.exe
PID 1644 wrote to memory of 1532	1644	tmepsh.exe	schtasks.exe
PID 1644 wrote to memory of 1532	1644	tmepsh.exe	schtasks.exe
PID 1576 wrote to memory of 1780	1576	wzoyy.exe	wzoyy.exe
PID 1576 wrote to memory of 1780	1576	wzoyy.exe	wzoyy.exe
PID 1576 wrote to memory of 1780	1576	wzoyy.exe	wzoyy.exe
PID 1576 wrote to memory of 1780	1576	wzoyy.exe	wzoyy.exe
PID 1576 wrote to memory of 1460	1576	wzoyy.exe	explorer.exe
PID 1576 wrote to memory of 1460	1576	wzoyy.exe	explorer.exe
PID 1576 wrote to memory of 1460	1576	wzoyy.exe	explorer.exe
PID 1576 wrote to memory of 1460	1576	wzoyy.exe	explorer.exe
PID 1576 wrote to memory of 1460	1576	wzoyy.exe	explorer.exe
PID 1508 wrote to memory of 1728	1508	taskeng.exe	tmepsh.exe
PID 1508 wrote to memory of 1728	1508	taskeng.exe	tmepsh.exe
PID 1508 wrote to memory of 1728	1508	taskeng.exe	tmepsh.exe
PID 1508 wrote to memory of 1728	1508	taskeng.exe	tmepsh.exe

C:\Users\Admin\AppData\Local\Temp\tmepsh.exe
"C:\Users\Admin\AppData\Local\Temp\tmepsh.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1644

C:\Users\Admin\AppData\Local\Temp\tmepsh.exe
C:\Users\Admin\AppData\Local\Temp\tmepsh.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1268

C:\Users\Admin\AppData\Roaming\Microsoft\Fhokfpyzqu\wzoyy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Fhokfpyzqu\wzoyy.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1576

C:\Users\Admin\AppData\Roaming\Microsoft\Fhokfpyzqu\wzoyy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Fhokfpyzqu\wzoyy.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1780

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1460

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ucoityp /tr "\"C:\Users\Admin\AppData\Local\Temp\tmepsh.exe\" /I ucoityp" /SC ONCE /Z /ST 14:45 /ET 14:57
2⤵
- Creates scheduled task(s)
PID:1532

C:\Windows\system32\taskeng.exe
taskeng.exe {07702D4A-B26B-429A-9207-452E16B9A8ED} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Users\Admin\AppData\Local\Temp\tmepsh.exe
C:\Users\Admin\AppData\Local\Temp\tmepsh.exe /I ucoityp
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Fhokfpyzqu\wzoyy.dat
MD5
bd26670c013e6fedc413935419c9ad74

SHA1
a4e51413b2dd9b4f1dfd290051fd008e48a3cdec

SHA256
cd14c9f4876427a66c24737dbfad12f66ec2d47581b2ed6d1816630cb458c670

SHA512
35fad5f2fd710d8e40cb95e4862527a0ed35980a527817f4a944329735bda90504ef8eb7d0bfe115a3071d9585b40da97ba60a126eb1a22ad46d8d3aa4156ee9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Fhokfpyzqu\wzoyy.exe
MD5
3adefcf414e69c9b852f8ae2cba0c091

SHA1
9ab76a01f2e9b578bdb6d0e6e9505b85fb025017

SHA256
2d516a98f0ac197d808becec8c53623310992d7ce95c911a57bf9cfda3b20f94

SHA512
e07fa9d0ff9dd5502e5305930c9292a144b2742bb2a4406d6d3fc1745ab2fe88f01fee4f8657578fe5c611c809bc2aa1392cbac4f7fbe1c354022ac48c008745

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Fhokfpyzqu\wzoyy.exe
MD5
3adefcf414e69c9b852f8ae2cba0c091

SHA1
9ab76a01f2e9b578bdb6d0e6e9505b85fb025017

SHA256
2d516a98f0ac197d808becec8c53623310992d7ce95c911a57bf9cfda3b20f94

SHA512
e07fa9d0ff9dd5502e5305930c9292a144b2742bb2a4406d6d3fc1745ab2fe88f01fee4f8657578fe5c611c809bc2aa1392cbac4f7fbe1c354022ac48c008745

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Fhokfpyzqu\wzoyy.exe
MD5
3adefcf414e69c9b852f8ae2cba0c091

SHA1
9ab76a01f2e9b578bdb6d0e6e9505b85fb025017

SHA256
2d516a98f0ac197d808becec8c53623310992d7ce95c911a57bf9cfda3b20f94

SHA512
e07fa9d0ff9dd5502e5305930c9292a144b2742bb2a4406d6d3fc1745ab2fe88f01fee4f8657578fe5c611c809bc2aa1392cbac4f7fbe1c354022ac48c008745

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Fhokfpyzqu\wzoyy.exe
MD5
3adefcf414e69c9b852f8ae2cba0c091

SHA1
9ab76a01f2e9b578bdb6d0e6e9505b85fb025017

SHA256
2d516a98f0ac197d808becec8c53623310992d7ce95c911a57bf9cfda3b20f94

SHA512
e07fa9d0ff9dd5502e5305930c9292a144b2742bb2a4406d6d3fc1745ab2fe88f01fee4f8657578fe5c611c809bc2aa1392cbac4f7fbe1c354022ac48c008745

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Fhokfpyzqu\wzoyy.exe
MD5
3adefcf414e69c9b852f8ae2cba0c091

SHA1
9ab76a01f2e9b578bdb6d0e6e9505b85fb025017

SHA256
2d516a98f0ac197d808becec8c53623310992d7ce95c911a57bf9cfda3b20f94

SHA512
e07fa9d0ff9dd5502e5305930c9292a144b2742bb2a4406d6d3fc1745ab2fe88f01fee4f8657578fe5c611c809bc2aa1392cbac4f7fbe1c354022ac48c008745

Download Submit
memory/1268-1-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/1268-0-0x0000000000000000-mapping.dmp

Download
memory/1460-12-0x0000000000000000-mapping.dmp

Download
memory/1532-6-0x0000000000000000-mapping.dmp

Download
memory/1576-11-0x00000000020E0000-0x000000000211A000-memory.dmp

Filesize
232KB

Download
memory/1576-4-0x0000000000000000-mapping.dmp

Download
memory/1728-14-0x0000000000000000-mapping.dmp

Download
memory/1780-10-0x0000000002500000-0x0000000002511000-memory.dmp

Filesize
68KB

Download
memory/1780-8-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads