qakbot | 430e77ceec59ad4b4b0121d1b70220cf52a162ea5769742435b758f932b07cc2

General

Target

nzhjtf.exe
Size

1.0MB
MD5

d89efabdeae31f2060b926c59edc3123
SHA1

1739e1320e2e86282d9336f29b14a4f4bebb588f
SHA256

430e77ceec59ad4b4b0121d1b70220cf52a162ea5769742435b758f932b07cc2
SHA512

471fcf84988070d1a937d74646d161ae30fd62f00a6545276247d52c8163be9ef765a9f321dbc4858ea1b836b760712095a0e51a42e4d1494f09fd776364a585

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

mowjyxve.exemowjyxve.exe

pid process

628 mowjyxve.exe
1676 mowjyxve.exe
Loads dropped DLL 2 IoCs

Processes:

nzhjtf.exe

pid process

240 nzhjtf.exe
240 nzhjtf.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1344 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

nzhjtf.exenzhjtf.exemowjyxve.exemowjyxve.exeexplorer.exenzhjtf.exe

pid process

240 nzhjtf.exe
1228 nzhjtf.exe
1228 nzhjtf.exe
628 mowjyxve.exe
1676 mowjyxve.exe
1676 mowjyxve.exe
556 explorer.exe
556 explorer.exe
436 nzhjtf.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

mowjyxve.exe

pid process

628 mowjyxve.exe

pid	process
628	mowjyxve.exe
1676	mowjyxve.exe

pid	process
240	nzhjtf.exe
240	nzhjtf.exe

pid	process
1344	schtasks.exe

pid	process
240	nzhjtf.exe
1228	nzhjtf.exe
1228	nzhjtf.exe
628	mowjyxve.exe
1676	mowjyxve.exe
1676	mowjyxve.exe
556	explorer.exe
556	explorer.exe
436	nzhjtf.exe

pid	process
628	mowjyxve.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

nzhjtf.exemowjyxve.exetaskeng.exe

description	pid	process	target process
PID 240 wrote to memory of 1228	240	nzhjtf.exe	nzhjtf.exe
PID 240 wrote to memory of 1228	240	nzhjtf.exe	nzhjtf.exe
PID 240 wrote to memory of 1228	240	nzhjtf.exe	nzhjtf.exe
PID 240 wrote to memory of 1228	240	nzhjtf.exe	nzhjtf.exe
PID 240 wrote to memory of 628	240	nzhjtf.exe	mowjyxve.exe
PID 240 wrote to memory of 628	240	nzhjtf.exe	mowjyxve.exe
PID 240 wrote to memory of 628	240	nzhjtf.exe	mowjyxve.exe
PID 240 wrote to memory of 628	240	nzhjtf.exe	mowjyxve.exe
PID 240 wrote to memory of 1344	240	nzhjtf.exe	schtasks.exe
PID 240 wrote to memory of 1344	240	nzhjtf.exe	schtasks.exe
PID 240 wrote to memory of 1344	240	nzhjtf.exe	schtasks.exe
PID 240 wrote to memory of 1344	240	nzhjtf.exe	schtasks.exe
PID 628 wrote to memory of 1676	628	mowjyxve.exe	mowjyxve.exe
PID 628 wrote to memory of 1676	628	mowjyxve.exe	mowjyxve.exe
PID 628 wrote to memory of 1676	628	mowjyxve.exe	mowjyxve.exe
PID 628 wrote to memory of 1676	628	mowjyxve.exe	mowjyxve.exe
PID 628 wrote to memory of 556	628	mowjyxve.exe	explorer.exe
PID 628 wrote to memory of 556	628	mowjyxve.exe	explorer.exe
PID 628 wrote to memory of 556	628	mowjyxve.exe	explorer.exe
PID 628 wrote to memory of 556	628	mowjyxve.exe	explorer.exe
PID 628 wrote to memory of 556	628	mowjyxve.exe	explorer.exe
PID 1616 wrote to memory of 436	1616	taskeng.exe	nzhjtf.exe
PID 1616 wrote to memory of 436	1616	taskeng.exe	nzhjtf.exe
PID 1616 wrote to memory of 436	1616	taskeng.exe	nzhjtf.exe
PID 1616 wrote to memory of 436	1616	taskeng.exe	nzhjtf.exe

C:\Users\Admin\AppData\Local\Temp\nzhjtf.exe
"C:\Users\Admin\AppData\Local\Temp\nzhjtf.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:240

C:\Users\Admin\AppData\Local\Temp\nzhjtf.exe
C:\Users\Admin\AppData\Local\Temp\nzhjtf.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1228

C:\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:628

C:\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1676

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:556

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dklzaxfo /tr "\"C:\Users\Admin\AppData\Local\Temp\nzhjtf.exe\" /I dklzaxfo" /SC ONCE /Z /ST 14:46 /ET 14:58
2⤵
- Creates scheduled task(s)
PID:1344

C:\Windows\system32\taskeng.exe
taskeng.exe {834F0129-BB2F-4A2A-95FE-C64AF5295095} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1616

C:\Users\Admin\AppData\Local\Temp\nzhjtf.exe
C:\Users\Admin\AppData\Local\Temp\nzhjtf.exe /I dklzaxfo
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:436

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.dat
MD5
f73b936e257011b3d8ebf3ab626d6834

SHA1
9ddf1665a08f421f27e3adbfadbef16798aa22ee

SHA256
50f0ffbae75cb3e99fb41751ca1893fb814ea5d70e1006fd73cf2cac45890910

SHA512
7660f23418dc75bed00a5d055ea3422d016d11b65969e7fd98a1a04d5604dde262976ca31b93804bd7c57a17b797bb6d36e3f5b65368ebbad899e52cc5c522a2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe
MD5
d89efabdeae31f2060b926c59edc3123

SHA1
1739e1320e2e86282d9336f29b14a4f4bebb588f

SHA256
430e77ceec59ad4b4b0121d1b70220cf52a162ea5769742435b758f932b07cc2

SHA512
471fcf84988070d1a937d74646d161ae30fd62f00a6545276247d52c8163be9ef765a9f321dbc4858ea1b836b760712095a0e51a42e4d1494f09fd776364a585

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe
MD5
d89efabdeae31f2060b926c59edc3123

SHA1
1739e1320e2e86282d9336f29b14a4f4bebb588f

SHA256
430e77ceec59ad4b4b0121d1b70220cf52a162ea5769742435b758f932b07cc2

SHA512
471fcf84988070d1a937d74646d161ae30fd62f00a6545276247d52c8163be9ef765a9f321dbc4858ea1b836b760712095a0e51a42e4d1494f09fd776364a585

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe
MD5
d89efabdeae31f2060b926c59edc3123

SHA1
1739e1320e2e86282d9336f29b14a4f4bebb588f

SHA256
430e77ceec59ad4b4b0121d1b70220cf52a162ea5769742435b758f932b07cc2

SHA512
471fcf84988070d1a937d74646d161ae30fd62f00a6545276247d52c8163be9ef765a9f321dbc4858ea1b836b760712095a0e51a42e4d1494f09fd776364a585

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe
MD5
d89efabdeae31f2060b926c59edc3123

SHA1
1739e1320e2e86282d9336f29b14a4f4bebb588f

SHA256
430e77ceec59ad4b4b0121d1b70220cf52a162ea5769742435b758f932b07cc2

SHA512
471fcf84988070d1a937d74646d161ae30fd62f00a6545276247d52c8163be9ef765a9f321dbc4858ea1b836b760712095a0e51a42e4d1494f09fd776364a585

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe
MD5
d89efabdeae31f2060b926c59edc3123

SHA1
1739e1320e2e86282d9336f29b14a4f4bebb588f

SHA256
430e77ceec59ad4b4b0121d1b70220cf52a162ea5769742435b758f932b07cc2

SHA512
471fcf84988070d1a937d74646d161ae30fd62f00a6545276247d52c8163be9ef765a9f321dbc4858ea1b836b760712095a0e51a42e4d1494f09fd776364a585

Download Submit
memory/436-14-0x0000000000000000-mapping.dmp

Download
memory/556-12-0x0000000000000000-mapping.dmp

Download
memory/628-4-0x0000000000000000-mapping.dmp

Download
memory/628-11-0x0000000001E50000-0x0000000001E8A000-memory.dmp

Filesize
232KB

Download
memory/1228-0-0x0000000000000000-mapping.dmp

Download
memory/1228-1-0x0000000002620000-0x0000000002631000-memory.dmp

Filesize
68KB

Download
memory/1344-6-0x0000000000000000-mapping.dmp

Download
memory/1676-8-0x0000000000000000-mapping.dmp

Download
memory/1676-10-0x00000000025F0000-0x0000000002601000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads