qakbot | 193a9528efc16ceef98a01595d02d58c9b1d66be6ee6ec5350fb1ddb980eba19

General

Target

iaixxu.exe
Size

1.0MB
MD5

1abe47e0df637a1b7f656da888cbfdbe
SHA1

94e51f81bb017ef0d70e52574dd819840abc9895
SHA256

193a9528efc16ceef98a01595d02d58c9b1d66be6ee6ec5350fb1ddb980eba19
SHA512

c680f04b9e3a0e92d31195fe826819d9c8244cb094097d96252f83a4b79b97daaace781dd3429bbb1e9e66ddd4dfd6793fdbff0da5dccf93c352b5c186b862c7

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

booyvqo.exebooyvqo.exe

pid process

656 booyvqo.exe
564 booyvqo.exe
Loads dropped DLL 2 IoCs

Processes:

iaixxu.exe

pid process

844 iaixxu.exe
844 iaixxu.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

884 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

iaixxu.exeiaixxu.exebooyvqo.exebooyvqo.exeexplorer.exeiaixxu.exe

pid process

844 iaixxu.exe
1288 iaixxu.exe
1288 iaixxu.exe
656 booyvqo.exe
564 booyvqo.exe
564 booyvqo.exe
1568 explorer.exe
1568 explorer.exe
852 iaixxu.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

booyvqo.exe

pid process

656 booyvqo.exe

pid	process
656	booyvqo.exe
564	booyvqo.exe

pid	process
844	iaixxu.exe
844	iaixxu.exe

pid	process
884	schtasks.exe

pid	process
844	iaixxu.exe
1288	iaixxu.exe
1288	iaixxu.exe
656	booyvqo.exe
564	booyvqo.exe
564	booyvqo.exe
1568	explorer.exe
1568	explorer.exe
852	iaixxu.exe

pid	process
656	booyvqo.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

iaixxu.exebooyvqo.exetaskeng.exe

description	pid	process	target process
PID 844 wrote to memory of 1288	844	iaixxu.exe	iaixxu.exe
PID 844 wrote to memory of 1288	844	iaixxu.exe	iaixxu.exe
PID 844 wrote to memory of 1288	844	iaixxu.exe	iaixxu.exe
PID 844 wrote to memory of 1288	844	iaixxu.exe	iaixxu.exe
PID 844 wrote to memory of 656	844	iaixxu.exe	booyvqo.exe
PID 844 wrote to memory of 656	844	iaixxu.exe	booyvqo.exe
PID 844 wrote to memory of 656	844	iaixxu.exe	booyvqo.exe
PID 844 wrote to memory of 656	844	iaixxu.exe	booyvqo.exe
PID 844 wrote to memory of 884	844	iaixxu.exe	schtasks.exe
PID 844 wrote to memory of 884	844	iaixxu.exe	schtasks.exe
PID 844 wrote to memory of 884	844	iaixxu.exe	schtasks.exe
PID 844 wrote to memory of 884	844	iaixxu.exe	schtasks.exe
PID 656 wrote to memory of 564	656	booyvqo.exe	booyvqo.exe
PID 656 wrote to memory of 564	656	booyvqo.exe	booyvqo.exe
PID 656 wrote to memory of 564	656	booyvqo.exe	booyvqo.exe
PID 656 wrote to memory of 564	656	booyvqo.exe	booyvqo.exe
PID 656 wrote to memory of 1568	656	booyvqo.exe	explorer.exe
PID 656 wrote to memory of 1568	656	booyvqo.exe	explorer.exe
PID 656 wrote to memory of 1568	656	booyvqo.exe	explorer.exe
PID 656 wrote to memory of 1568	656	booyvqo.exe	explorer.exe
PID 656 wrote to memory of 1568	656	booyvqo.exe	explorer.exe
PID 904 wrote to memory of 852	904	taskeng.exe	iaixxu.exe
PID 904 wrote to memory of 852	904	taskeng.exe	iaixxu.exe
PID 904 wrote to memory of 852	904	taskeng.exe	iaixxu.exe
PID 904 wrote to memory of 852	904	taskeng.exe	iaixxu.exe

C:\Users\Admin\AppData\Local\Temp\iaixxu.exe
"C:\Users\Admin\AppData\Local\Temp\iaixxu.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:844

C:\Users\Admin\AppData\Local\Temp\iaixxu.exe
C:\Users\Admin\AppData\Local\Temp\iaixxu.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1288

C:\Users\Admin\AppData\Roaming\Microsoft\Mssad\booyvqo.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Mssad\booyvqo.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:656

C:\Users\Admin\AppData\Roaming\Microsoft\Mssad\booyvqo.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Mssad\booyvqo.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:564

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1568

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hcqamkcuzq /tr "\"C:\Users\Admin\AppData\Local\Temp\iaixxu.exe\" /I hcqamkcuzq" /SC ONCE /Z /ST 15:44 /ET 15:56
2⤵
- Creates scheduled task(s)
PID:884

C:\Windows\system32\taskeng.exe
taskeng.exe {7E4BF47A-AF31-4FBA-BCBA-D8B28A653FCD} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:904

C:\Users\Admin\AppData\Local\Temp\iaixxu.exe
C:\Users\Admin\AppData\Local\Temp\iaixxu.exe /I hcqamkcuzq
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:852

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Mssad\booyvqo.dat
MD5
f28bda92868a8c844298e473e85e1145

SHA1
fcc89a99241d57bc49754ed7f6a3ac139ce6d046

SHA256
119cff432f288cf1cf27cb77985e4955702c0f645e2bdf9c601a72e89264bed2

SHA512
1541da0996bbfc1c1bc47365b55796b8955d9bd0218a826b70089b9f98734bb9e1f04af03919afe888c259133ddd687fe8aa7f130d901981c5fb9337ebb4ebd1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Mssad\booyvqo.exe
MD5
1abe47e0df637a1b7f656da888cbfdbe

SHA1
94e51f81bb017ef0d70e52574dd819840abc9895

SHA256
193a9528efc16ceef98a01595d02d58c9b1d66be6ee6ec5350fb1ddb980eba19

SHA512
c680f04b9e3a0e92d31195fe826819d9c8244cb094097d96252f83a4b79b97daaace781dd3429bbb1e9e66ddd4dfd6793fdbff0da5dccf93c352b5c186b862c7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Mssad\booyvqo.exe
MD5
1abe47e0df637a1b7f656da888cbfdbe

SHA1
94e51f81bb017ef0d70e52574dd819840abc9895

SHA256
193a9528efc16ceef98a01595d02d58c9b1d66be6ee6ec5350fb1ddb980eba19

SHA512
c680f04b9e3a0e92d31195fe826819d9c8244cb094097d96252f83a4b79b97daaace781dd3429bbb1e9e66ddd4dfd6793fdbff0da5dccf93c352b5c186b862c7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Mssad\booyvqo.exe
MD5
1abe47e0df637a1b7f656da888cbfdbe

SHA1
94e51f81bb017ef0d70e52574dd819840abc9895

SHA256
193a9528efc16ceef98a01595d02d58c9b1d66be6ee6ec5350fb1ddb980eba19

SHA512
c680f04b9e3a0e92d31195fe826819d9c8244cb094097d96252f83a4b79b97daaace781dd3429bbb1e9e66ddd4dfd6793fdbff0da5dccf93c352b5c186b862c7

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Mssad\booyvqo.exe
MD5
1abe47e0df637a1b7f656da888cbfdbe

SHA1
94e51f81bb017ef0d70e52574dd819840abc9895

SHA256
193a9528efc16ceef98a01595d02d58c9b1d66be6ee6ec5350fb1ddb980eba19

SHA512
c680f04b9e3a0e92d31195fe826819d9c8244cb094097d96252f83a4b79b97daaace781dd3429bbb1e9e66ddd4dfd6793fdbff0da5dccf93c352b5c186b862c7

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Mssad\booyvqo.exe
MD5
1abe47e0df637a1b7f656da888cbfdbe

SHA1
94e51f81bb017ef0d70e52574dd819840abc9895

SHA256
193a9528efc16ceef98a01595d02d58c9b1d66be6ee6ec5350fb1ddb980eba19

SHA512
c680f04b9e3a0e92d31195fe826819d9c8244cb094097d96252f83a4b79b97daaace781dd3429bbb1e9e66ddd4dfd6793fdbff0da5dccf93c352b5c186b862c7

Download Submit
memory/564-8-0x0000000000000000-mapping.dmp

Download
memory/564-10-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/656-11-0x00000000003C0000-0x00000000003FA000-memory.dmp

Filesize
232KB

Download
memory/656-4-0x0000000000000000-mapping.dmp

Download
memory/852-14-0x0000000000000000-mapping.dmp

Download
memory/884-6-0x0000000000000000-mapping.dmp

Download
memory/1288-0-0x0000000000000000-mapping.dmp

Download
memory/1288-1-0x00000000024C0000-0x00000000024D1000-memory.dmp

Filesize
68KB

Download
memory/1568-12-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads