qakbot | 1d4c9d63ec2e365af7cb6c159f88ca4e790c70aebb8758b3f8a38c8a1c9a1678

General

Target

sjtxdy.exe
Size

1.0MB
MD5

00c96b879014dee7b62d3d3260459248
SHA1

c697874e1d76207c242aa0405cd326a169e8e7f4
SHA256

1d4c9d63ec2e365af7cb6c159f88ca4e790c70aebb8758b3f8a38c8a1c9a1678
SHA512

1f5c6b02b0a8e6c33cfa9ad607ed665f19a95485572667a7183cb277269ebe32e9fcff352b113b166350366d88b2c898304eee447b35cf77d1e7326d7433f7f5

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

xhwoobmd.exexhwoobmd.exe

pid process

1672 xhwoobmd.exe
1072 xhwoobmd.exe
Loads dropped DLL 2 IoCs

Processes:

sjtxdy.exe

pid process

1032 sjtxdy.exe
1032 sjtxdy.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1584 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

sjtxdy.exesjtxdy.exexhwoobmd.exexhwoobmd.exeexplorer.exesjtxdy.exe

pid process

1032 sjtxdy.exe
1528 sjtxdy.exe
1528 sjtxdy.exe
1672 xhwoobmd.exe
1072 xhwoobmd.exe
1072 xhwoobmd.exe
428 explorer.exe
428 explorer.exe
920 sjtxdy.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

xhwoobmd.exe

pid process

1672 xhwoobmd.exe

pid	process
1672	xhwoobmd.exe
1072	xhwoobmd.exe

pid	process
1032	sjtxdy.exe
1032	sjtxdy.exe

pid	process
1584	schtasks.exe

pid	process
1032	sjtxdy.exe
1528	sjtxdy.exe
1528	sjtxdy.exe
1672	xhwoobmd.exe
1072	xhwoobmd.exe
1072	xhwoobmd.exe
428	explorer.exe
428	explorer.exe
920	sjtxdy.exe

pid	process
1672	xhwoobmd.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

sjtxdy.exexhwoobmd.exetaskeng.exe

description	pid	process	target process
PID 1032 wrote to memory of 1528	1032	sjtxdy.exe	sjtxdy.exe
PID 1032 wrote to memory of 1528	1032	sjtxdy.exe	sjtxdy.exe
PID 1032 wrote to memory of 1528	1032	sjtxdy.exe	sjtxdy.exe
PID 1032 wrote to memory of 1528	1032	sjtxdy.exe	sjtxdy.exe
PID 1032 wrote to memory of 1672	1032	sjtxdy.exe	xhwoobmd.exe
PID 1032 wrote to memory of 1672	1032	sjtxdy.exe	xhwoobmd.exe
PID 1032 wrote to memory of 1672	1032	sjtxdy.exe	xhwoobmd.exe
PID 1032 wrote to memory of 1672	1032	sjtxdy.exe	xhwoobmd.exe
PID 1032 wrote to memory of 1584	1032	sjtxdy.exe	schtasks.exe
PID 1032 wrote to memory of 1584	1032	sjtxdy.exe	schtasks.exe
PID 1032 wrote to memory of 1584	1032	sjtxdy.exe	schtasks.exe
PID 1032 wrote to memory of 1584	1032	sjtxdy.exe	schtasks.exe
PID 1672 wrote to memory of 1072	1672	xhwoobmd.exe	xhwoobmd.exe
PID 1672 wrote to memory of 1072	1672	xhwoobmd.exe	xhwoobmd.exe
PID 1672 wrote to memory of 1072	1672	xhwoobmd.exe	xhwoobmd.exe
PID 1672 wrote to memory of 1072	1672	xhwoobmd.exe	xhwoobmd.exe
PID 1672 wrote to memory of 428	1672	xhwoobmd.exe	explorer.exe
PID 1672 wrote to memory of 428	1672	xhwoobmd.exe	explorer.exe
PID 1672 wrote to memory of 428	1672	xhwoobmd.exe	explorer.exe
PID 1672 wrote to memory of 428	1672	xhwoobmd.exe	explorer.exe
PID 1672 wrote to memory of 428	1672	xhwoobmd.exe	explorer.exe
PID 1348 wrote to memory of 920	1348	taskeng.exe	sjtxdy.exe
PID 1348 wrote to memory of 920	1348	taskeng.exe	sjtxdy.exe
PID 1348 wrote to memory of 920	1348	taskeng.exe	sjtxdy.exe
PID 1348 wrote to memory of 920	1348	taskeng.exe	sjtxdy.exe

C:\Users\Admin\AppData\Local\Temp\sjtxdy.exe
"C:\Users\Admin\AppData\Local\Temp\sjtxdy.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1032

C:\Users\Admin\AppData\Local\Temp\sjtxdy.exe
C:\Users\Admin\AppData\Local\Temp\sjtxdy.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1528

C:\Users\Admin\AppData\Roaming\Microsoft\Dejeusygv\xhwoobmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Dejeusygv\xhwoobmd.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1672

C:\Users\Admin\AppData\Roaming\Microsoft\Dejeusygv\xhwoobmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Dejeusygv\xhwoobmd.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1072

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:428

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn auairaz /tr "\"C:\Users\Admin\AppData\Local\Temp\sjtxdy.exe\" /I auairaz" /SC ONCE /Z /ST 15:45 /ET 15:57
2⤵
- Creates scheduled task(s)
PID:1584

C:\Windows\system32\taskeng.exe
taskeng.exe {20C47BA3-367B-4C10-8464-4F2E61E9C4C5} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1348

C:\Users\Admin\AppData\Local\Temp\sjtxdy.exe
C:\Users\Admin\AppData\Local\Temp\sjtxdy.exe /I auairaz
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:920

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Dejeusygv\xhwoobmd.dat
MD5
87c23d3b8e81d2757c2a7cfb0022c704

SHA1
d27169387d9034583ef8d53dddc212d24980cecc

SHA256
72050aaf9cc95307b2f66385b9e64656be6ddfb7fd88efd87c94f411b2985b67

SHA512
25a2dca595d53cef61d290c55c6a267925b6eee984188f3cb24acdb3d2fab1fec2c959542db0b165512aad6943c884bcadc9517baf0319b71907e0195ac54c6d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Dejeusygv\xhwoobmd.exe
MD5
00c96b879014dee7b62d3d3260459248

SHA1
c697874e1d76207c242aa0405cd326a169e8e7f4

SHA256
1d4c9d63ec2e365af7cb6c159f88ca4e790c70aebb8758b3f8a38c8a1c9a1678

SHA512
1f5c6b02b0a8e6c33cfa9ad607ed665f19a95485572667a7183cb277269ebe32e9fcff352b113b166350366d88b2c898304eee447b35cf77d1e7326d7433f7f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Dejeusygv\xhwoobmd.exe
MD5
00c96b879014dee7b62d3d3260459248

SHA1
c697874e1d76207c242aa0405cd326a169e8e7f4

SHA256
1d4c9d63ec2e365af7cb6c159f88ca4e790c70aebb8758b3f8a38c8a1c9a1678

SHA512
1f5c6b02b0a8e6c33cfa9ad607ed665f19a95485572667a7183cb277269ebe32e9fcff352b113b166350366d88b2c898304eee447b35cf77d1e7326d7433f7f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Dejeusygv\xhwoobmd.exe
MD5
00c96b879014dee7b62d3d3260459248

SHA1
c697874e1d76207c242aa0405cd326a169e8e7f4

SHA256
1d4c9d63ec2e365af7cb6c159f88ca4e790c70aebb8758b3f8a38c8a1c9a1678

SHA512
1f5c6b02b0a8e6c33cfa9ad607ed665f19a95485572667a7183cb277269ebe32e9fcff352b113b166350366d88b2c898304eee447b35cf77d1e7326d7433f7f5

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Dejeusygv\xhwoobmd.exe
MD5
00c96b879014dee7b62d3d3260459248

SHA1
c697874e1d76207c242aa0405cd326a169e8e7f4

SHA256
1d4c9d63ec2e365af7cb6c159f88ca4e790c70aebb8758b3f8a38c8a1c9a1678

SHA512
1f5c6b02b0a8e6c33cfa9ad607ed665f19a95485572667a7183cb277269ebe32e9fcff352b113b166350366d88b2c898304eee447b35cf77d1e7326d7433f7f5

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Dejeusygv\xhwoobmd.exe
MD5
00c96b879014dee7b62d3d3260459248

SHA1
c697874e1d76207c242aa0405cd326a169e8e7f4

SHA256
1d4c9d63ec2e365af7cb6c159f88ca4e790c70aebb8758b3f8a38c8a1c9a1678

SHA512
1f5c6b02b0a8e6c33cfa9ad607ed665f19a95485572667a7183cb277269ebe32e9fcff352b113b166350366d88b2c898304eee447b35cf77d1e7326d7433f7f5

Download Submit
memory/428-12-0x0000000000000000-mapping.dmp

Download
memory/920-14-0x0000000000000000-mapping.dmp

Download
memory/1072-8-0x0000000000000000-mapping.dmp

Download
memory/1072-10-0x0000000002550000-0x0000000002561000-memory.dmp

Filesize
68KB

Download
memory/1528-1-0x0000000002570000-0x0000000002581000-memory.dmp

Filesize
68KB

Download
memory/1528-0-0x0000000000000000-mapping.dmp

Download
memory/1584-6-0x0000000000000000-mapping.dmp

Download
memory/1672-11-0x0000000001F70000-0x0000000001FAA000-memory.dmp

Filesize
232KB

Download
memory/1672-4-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads