qakbot | a2d4074bdefdc43adc343c50770c148138a7c653be3d073955e8f89934fd0543

General

Target

szxwuu.exe
Size

1.0MB
MD5

e12aaf8dffcab551c859a6d2c05e554d
SHA1

c1ce7120816433b7eeb37a909a01d4ad777d65c8
SHA256

a2d4074bdefdc43adc343c50770c148138a7c653be3d073955e8f89934fd0543
SHA512

44c6f89d1a113b343d1cd777c246666ee91751d5b9a02705528e5c404617ffb022eba2997e8dfce7d40336f46296b0e5fcebe1ff924dbc464c1b1ac0fb59370c

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

wqzygso.exewqzygso.exe

pid process

1352 wqzygso.exe
436 wqzygso.exe
Loads dropped DLL 2 IoCs

Processes:

szxwuu.exe

pid process

1588 szxwuu.exe
1588 szxwuu.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1224 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

szxwuu.exeszxwuu.exewqzygso.exewqzygso.exeexplorer.exeszxwuu.exe

pid process

1588 szxwuu.exe
2032 szxwuu.exe
2032 szxwuu.exe
1352 wqzygso.exe
436 wqzygso.exe
436 wqzygso.exe
636 explorer.exe
636 explorer.exe
552 szxwuu.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

wqzygso.exe

pid process

1352 wqzygso.exe

pid	process
1352	wqzygso.exe
436	wqzygso.exe

pid	process
1588	szxwuu.exe
1588	szxwuu.exe

pid	process
1224	schtasks.exe

pid	process
1588	szxwuu.exe
2032	szxwuu.exe
2032	szxwuu.exe
1352	wqzygso.exe
436	wqzygso.exe
436	wqzygso.exe
636	explorer.exe
636	explorer.exe
552	szxwuu.exe

pid	process
1352	wqzygso.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

szxwuu.exewqzygso.exetaskeng.exe

description	pid	process	target process
PID 1588 wrote to memory of 2032	1588	szxwuu.exe	szxwuu.exe
PID 1588 wrote to memory of 2032	1588	szxwuu.exe	szxwuu.exe
PID 1588 wrote to memory of 2032	1588	szxwuu.exe	szxwuu.exe
PID 1588 wrote to memory of 2032	1588	szxwuu.exe	szxwuu.exe
PID 1588 wrote to memory of 1352	1588	szxwuu.exe	wqzygso.exe
PID 1588 wrote to memory of 1352	1588	szxwuu.exe	wqzygso.exe
PID 1588 wrote to memory of 1352	1588	szxwuu.exe	wqzygso.exe
PID 1588 wrote to memory of 1352	1588	szxwuu.exe	wqzygso.exe
PID 1588 wrote to memory of 1224	1588	szxwuu.exe	schtasks.exe
PID 1588 wrote to memory of 1224	1588	szxwuu.exe	schtasks.exe
PID 1588 wrote to memory of 1224	1588	szxwuu.exe	schtasks.exe
PID 1588 wrote to memory of 1224	1588	szxwuu.exe	schtasks.exe
PID 1352 wrote to memory of 436	1352	wqzygso.exe	wqzygso.exe
PID 1352 wrote to memory of 436	1352	wqzygso.exe	wqzygso.exe
PID 1352 wrote to memory of 436	1352	wqzygso.exe	wqzygso.exe
PID 1352 wrote to memory of 436	1352	wqzygso.exe	wqzygso.exe
PID 1352 wrote to memory of 636	1352	wqzygso.exe	explorer.exe
PID 1352 wrote to memory of 636	1352	wqzygso.exe	explorer.exe
PID 1352 wrote to memory of 636	1352	wqzygso.exe	explorer.exe
PID 1352 wrote to memory of 636	1352	wqzygso.exe	explorer.exe
PID 1352 wrote to memory of 636	1352	wqzygso.exe	explorer.exe
PID 684 wrote to memory of 552	684	taskeng.exe	szxwuu.exe
PID 684 wrote to memory of 552	684	taskeng.exe	szxwuu.exe
PID 684 wrote to memory of 552	684	taskeng.exe	szxwuu.exe
PID 684 wrote to memory of 552	684	taskeng.exe	szxwuu.exe

C:\Users\Admin\AppData\Local\Temp\szxwuu.exe
"C:\Users\Admin\AppData\Local\Temp\szxwuu.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1588

C:\Users\Admin\AppData\Local\Temp\szxwuu.exe
C:\Users\Admin\AppData\Local\Temp\szxwuu.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2032

C:\Users\Admin\AppData\Roaming\Microsoft\Uwlowgoy\wqzygso.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Uwlowgoy\wqzygso.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1352

C:\Users\Admin\AppData\Roaming\Microsoft\Uwlowgoy\wqzygso.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Uwlowgoy\wqzygso.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:436

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:636

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn owkzsetin /tr "\"C:\Users\Admin\AppData\Local\Temp\szxwuu.exe\" /I owkzsetin" /SC ONCE /Z /ST 14:46 /ET 14:58
2⤵
- Creates scheduled task(s)
PID:1224

C:\Windows\system32\taskeng.exe
taskeng.exe {70384644-1E7D-45AE-AFF3-C1B4DA038AC1} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:684

C:\Users\Admin\AppData\Local\Temp\szxwuu.exe
C:\Users\Admin\AppData\Local\Temp\szxwuu.exe /I owkzsetin
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:552

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Uwlowgoy\wqzygso.dat
MD5
2216d6a06086d2b7917c38c6fb0fe959

SHA1
f04982f08c43960835b20a65b763b95353ac9b9b

SHA256
5178febc82dd6cd1805f92ab81667e2ba30241bcc143f44e62c93e15c300629b

SHA512
89a3bdd5fa1941ae900151d82628a5adcc8fae9446abdd8706958567fd230e5ad1d91445745f75dffee7216333ad0dc28a8dc2ed1541c6536c29d6721f4306b7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Uwlowgoy\wqzygso.exe
MD5
e12aaf8dffcab551c859a6d2c05e554d

SHA1
c1ce7120816433b7eeb37a909a01d4ad777d65c8

SHA256
a2d4074bdefdc43adc343c50770c148138a7c653be3d073955e8f89934fd0543

SHA512
44c6f89d1a113b343d1cd777c246666ee91751d5b9a02705528e5c404617ffb022eba2997e8dfce7d40336f46296b0e5fcebe1ff924dbc464c1b1ac0fb59370c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Uwlowgoy\wqzygso.exe
MD5
e12aaf8dffcab551c859a6d2c05e554d

SHA1
c1ce7120816433b7eeb37a909a01d4ad777d65c8

SHA256
a2d4074bdefdc43adc343c50770c148138a7c653be3d073955e8f89934fd0543

SHA512
44c6f89d1a113b343d1cd777c246666ee91751d5b9a02705528e5c404617ffb022eba2997e8dfce7d40336f46296b0e5fcebe1ff924dbc464c1b1ac0fb59370c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Uwlowgoy\wqzygso.exe
MD5
e12aaf8dffcab551c859a6d2c05e554d

SHA1
c1ce7120816433b7eeb37a909a01d4ad777d65c8

SHA256
a2d4074bdefdc43adc343c50770c148138a7c653be3d073955e8f89934fd0543

SHA512
44c6f89d1a113b343d1cd777c246666ee91751d5b9a02705528e5c404617ffb022eba2997e8dfce7d40336f46296b0e5fcebe1ff924dbc464c1b1ac0fb59370c

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Uwlowgoy\wqzygso.exe
MD5
e12aaf8dffcab551c859a6d2c05e554d

SHA1
c1ce7120816433b7eeb37a909a01d4ad777d65c8

SHA256
a2d4074bdefdc43adc343c50770c148138a7c653be3d073955e8f89934fd0543

SHA512
44c6f89d1a113b343d1cd777c246666ee91751d5b9a02705528e5c404617ffb022eba2997e8dfce7d40336f46296b0e5fcebe1ff924dbc464c1b1ac0fb59370c

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Uwlowgoy\wqzygso.exe
MD5
e12aaf8dffcab551c859a6d2c05e554d

SHA1
c1ce7120816433b7eeb37a909a01d4ad777d65c8

SHA256
a2d4074bdefdc43adc343c50770c148138a7c653be3d073955e8f89934fd0543

SHA512
44c6f89d1a113b343d1cd777c246666ee91751d5b9a02705528e5c404617ffb022eba2997e8dfce7d40336f46296b0e5fcebe1ff924dbc464c1b1ac0fb59370c

Download Submit
memory/436-10-0x00000000025E0000-0x00000000025F1000-memory.dmp

Filesize
68KB

Download
memory/436-8-0x0000000000000000-mapping.dmp

Download
memory/552-14-0x0000000000000000-mapping.dmp

Download
memory/636-12-0x0000000000000000-mapping.dmp

Download
memory/1224-6-0x0000000000000000-mapping.dmp

Download
memory/1352-11-0x00000000024F0000-0x000000000252A000-memory.dmp

Filesize
232KB

Download
memory/1352-4-0x0000000000000000-mapping.dmp

Download
memory/2032-0-0x0000000000000000-mapping.dmp

Download
memory/2032-1-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads