qakbot | e8d4a00a53e230f8e70f6abdebbcf3896a3b3ddd2ce664f479246279cc3f3e9d

General

Target

xkkrqm.exe
Size

1.0MB
MD5

ab1f8599e1789c2f3088f8067ec86cbf
SHA1

a3a67a633938e751e042e5d5bf6b038215fcd133
SHA256

e8d4a00a53e230f8e70f6abdebbcf3896a3b3ddd2ce664f479246279cc3f3e9d
SHA512

90749961824a75a9b0a1d51338d1190a3a4484f86e33609e582f351924d274bd86985da3d1da822c9f18b3fcd5c4a3b06e3f805d970531578f1e67035e4db14b

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

aovyu.exeaovyu.exe

pid process

1504 aovyu.exe
428 aovyu.exe
Loads dropped DLL 2 IoCs

Processes:

xkkrqm.exe

pid process

752 xkkrqm.exe
752 xkkrqm.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1416 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

xkkrqm.exexkkrqm.exeaovyu.exeaovyu.exeexplorer.exe

pid process

752 xkkrqm.exe
1324 xkkrqm.exe
1324 xkkrqm.exe
1504 aovyu.exe
428 aovyu.exe
428 aovyu.exe
800 explorer.exe
800 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

aovyu.exe

pid process

1504 aovyu.exe

pid	process
1504	aovyu.exe
428	aovyu.exe

pid	process
752	xkkrqm.exe
752	xkkrqm.exe

pid	process
1416	schtasks.exe

pid	process
752	xkkrqm.exe
1324	xkkrqm.exe
1324	xkkrqm.exe
1504	aovyu.exe
428	aovyu.exe
428	aovyu.exe
800	explorer.exe
800	explorer.exe

pid	process
1504	aovyu.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

xkkrqm.exeaovyu.exetaskeng.exe

description	pid	process	target process
PID 752 wrote to memory of 1324	752	xkkrqm.exe	xkkrqm.exe
PID 752 wrote to memory of 1324	752	xkkrqm.exe	xkkrqm.exe
PID 752 wrote to memory of 1324	752	xkkrqm.exe	xkkrqm.exe
PID 752 wrote to memory of 1324	752	xkkrqm.exe	xkkrqm.exe
PID 752 wrote to memory of 1504	752	xkkrqm.exe	aovyu.exe
PID 752 wrote to memory of 1504	752	xkkrqm.exe	aovyu.exe
PID 752 wrote to memory of 1504	752	xkkrqm.exe	aovyu.exe
PID 752 wrote to memory of 1504	752	xkkrqm.exe	aovyu.exe
PID 752 wrote to memory of 1416	752	xkkrqm.exe	schtasks.exe
PID 752 wrote to memory of 1416	752	xkkrqm.exe	schtasks.exe
PID 752 wrote to memory of 1416	752	xkkrqm.exe	schtasks.exe
PID 752 wrote to memory of 1416	752	xkkrqm.exe	schtasks.exe
PID 1504 wrote to memory of 428	1504	aovyu.exe	aovyu.exe
PID 1504 wrote to memory of 428	1504	aovyu.exe	aovyu.exe
PID 1504 wrote to memory of 428	1504	aovyu.exe	aovyu.exe
PID 1504 wrote to memory of 428	1504	aovyu.exe	aovyu.exe
PID 1504 wrote to memory of 800	1504	aovyu.exe	explorer.exe
PID 1504 wrote to memory of 800	1504	aovyu.exe	explorer.exe
PID 1504 wrote to memory of 800	1504	aovyu.exe	explorer.exe
PID 1504 wrote to memory of 800	1504	aovyu.exe	explorer.exe
PID 1504 wrote to memory of 800	1504	aovyu.exe	explorer.exe
PID 1480 wrote to memory of 1836	1480	taskeng.exe	xkkrqm.exe
PID 1480 wrote to memory of 1836	1480	taskeng.exe	xkkrqm.exe
PID 1480 wrote to memory of 1836	1480	taskeng.exe	xkkrqm.exe
PID 1480 wrote to memory of 1836	1480	taskeng.exe	xkkrqm.exe

C:\Users\Admin\AppData\Local\Temp\xkkrqm.exe
"C:\Users\Admin\AppData\Local\Temp\xkkrqm.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:752

C:\Users\Admin\AppData\Local\Temp\xkkrqm.exe
C:\Users\Admin\AppData\Local\Temp\xkkrqm.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1324

C:\Users\Admin\AppData\Roaming\Microsoft\Ozvmhtvghpg\aovyu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ozvmhtvghpg\aovyu.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1504

C:\Users\Admin\AppData\Roaming\Microsoft\Ozvmhtvghpg\aovyu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ozvmhtvghpg\aovyu.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:428

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:800

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn whbqecepfy /tr "\"C:\Users\Admin\AppData\Local\Temp\xkkrqm.exe\" /I whbqecepfy" /SC ONCE /Z /ST 14:46 /ET 14:58
2⤵
- Creates scheduled task(s)
PID:1416

C:\Windows\system32\taskeng.exe
taskeng.exe {8801D6E3-315B-492F-9521-0CF3787581F9} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1480

C:\Users\Admin\AppData\Local\Temp\xkkrqm.exe
C:\Users\Admin\AppData\Local\Temp\xkkrqm.exe /I whbqecepfy
2⤵
PID:1836

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Ozvmhtvghpg\aovyu.dat
MD5
486c6684d06f60f134f93ff5c13d8aff

SHA1
a50ab47bf3d703b9882bf8613ce54c93ad000ca5

SHA256
7cd9f05512c3fd6eba209867ed570bac10d30869992c0e0a723874f87336b48c

SHA512
b3bfcbb6004af6e7357c0f5dd3ba6a618630f9343f73cfb472255a044f286db3d8aa360576eb449d998371b82802a8582ac7f384b08db8a7a0c1f2141bbe6740

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ozvmhtvghpg\aovyu.exe
MD5
ab1f8599e1789c2f3088f8067ec86cbf

SHA1
a3a67a633938e751e042e5d5bf6b038215fcd133

SHA256
e8d4a00a53e230f8e70f6abdebbcf3896a3b3ddd2ce664f479246279cc3f3e9d

SHA512
90749961824a75a9b0a1d51338d1190a3a4484f86e33609e582f351924d274bd86985da3d1da822c9f18b3fcd5c4a3b06e3f805d970531578f1e67035e4db14b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ozvmhtvghpg\aovyu.exe
MD5
ab1f8599e1789c2f3088f8067ec86cbf

SHA1
a3a67a633938e751e042e5d5bf6b038215fcd133

SHA256
e8d4a00a53e230f8e70f6abdebbcf3896a3b3ddd2ce664f479246279cc3f3e9d

SHA512
90749961824a75a9b0a1d51338d1190a3a4484f86e33609e582f351924d274bd86985da3d1da822c9f18b3fcd5c4a3b06e3f805d970531578f1e67035e4db14b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ozvmhtvghpg\aovyu.exe
MD5
ab1f8599e1789c2f3088f8067ec86cbf

SHA1
a3a67a633938e751e042e5d5bf6b038215fcd133

SHA256
e8d4a00a53e230f8e70f6abdebbcf3896a3b3ddd2ce664f479246279cc3f3e9d

SHA512
90749961824a75a9b0a1d51338d1190a3a4484f86e33609e582f351924d274bd86985da3d1da822c9f18b3fcd5c4a3b06e3f805d970531578f1e67035e4db14b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Ozvmhtvghpg\aovyu.exe
MD5
ab1f8599e1789c2f3088f8067ec86cbf

SHA1
a3a67a633938e751e042e5d5bf6b038215fcd133

SHA256
e8d4a00a53e230f8e70f6abdebbcf3896a3b3ddd2ce664f479246279cc3f3e9d

SHA512
90749961824a75a9b0a1d51338d1190a3a4484f86e33609e582f351924d274bd86985da3d1da822c9f18b3fcd5c4a3b06e3f805d970531578f1e67035e4db14b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Ozvmhtvghpg\aovyu.exe
MD5
ab1f8599e1789c2f3088f8067ec86cbf

SHA1
a3a67a633938e751e042e5d5bf6b038215fcd133

SHA256
e8d4a00a53e230f8e70f6abdebbcf3896a3b3ddd2ce664f479246279cc3f3e9d

SHA512
90749961824a75a9b0a1d51338d1190a3a4484f86e33609e582f351924d274bd86985da3d1da822c9f18b3fcd5c4a3b06e3f805d970531578f1e67035e4db14b

Download Submit
memory/428-8-0x0000000000000000-mapping.dmp

Download
memory/428-10-0x0000000002630000-0x0000000002641000-memory.dmp

Filesize
68KB

Download
memory/800-12-0x0000000000000000-mapping.dmp

Download
memory/1324-0-0x0000000000000000-mapping.dmp

Download
memory/1324-1-0x00000000026B0000-0x00000000026C1000-memory.dmp

Filesize
68KB

Download
memory/1416-6-0x0000000000000000-mapping.dmp

Download
memory/1504-4-0x0000000000000000-mapping.dmp

Download
memory/1504-11-0x00000000008C0000-0x00000000008FA000-memory.dmp

Filesize
232KB

Download
memory/1836-14-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads