qakbot | 7eb1319623b96e9400694656e1084abafe86c0c244b35de5c24fe6439df38067

General

Target

nypown.exe
Size

1.0MB
MD5

3a840c4657f6343e31db72ddae5d5611
SHA1

8a791952c59306ad2f25b235861d57781e9c6e30
SHA256

7eb1319623b96e9400694656e1084abafe86c0c244b35de5c24fe6439df38067
SHA512

989eea2bf454e4d9e5d877b5bbfaf519e722c16e22d2e8378ab1925806242565238a928f00a3474db1599e8f4e0a144f6eb135eeacbdbc61572906cf527745d5

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

eaartykx.exeeaartykx.exe

pid process

1468 eaartykx.exe
848 eaartykx.exe
Loads dropped DLL 2 IoCs

Processes:

nypown.exe

pid process

1876 nypown.exe
1876 nypown.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

608 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

nypown.exenypown.exeeaartykx.exeeaartykx.exeexplorer.exenypown.exe

pid process

1876 nypown.exe
1780 nypown.exe
1780 nypown.exe
1468 eaartykx.exe
848 eaartykx.exe
848 eaartykx.exe
1648 explorer.exe
1648 explorer.exe
1984 nypown.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

eaartykx.exe

pid process

1468 eaartykx.exe

pid	process
1468	eaartykx.exe
848	eaartykx.exe

pid	process
1876	nypown.exe
1876	nypown.exe

pid	process
608	schtasks.exe

pid	process
1876	nypown.exe
1780	nypown.exe
1780	nypown.exe
1468	eaartykx.exe
848	eaartykx.exe
848	eaartykx.exe
1648	explorer.exe
1648	explorer.exe
1984	nypown.exe

pid	process
1468	eaartykx.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

nypown.exeeaartykx.exetaskeng.exe

description	pid	process	target process
PID 1876 wrote to memory of 1780	1876	nypown.exe	nypown.exe
PID 1876 wrote to memory of 1780	1876	nypown.exe	nypown.exe
PID 1876 wrote to memory of 1780	1876	nypown.exe	nypown.exe
PID 1876 wrote to memory of 1780	1876	nypown.exe	nypown.exe
PID 1876 wrote to memory of 1468	1876	nypown.exe	eaartykx.exe
PID 1876 wrote to memory of 1468	1876	nypown.exe	eaartykx.exe
PID 1876 wrote to memory of 1468	1876	nypown.exe	eaartykx.exe
PID 1876 wrote to memory of 1468	1876	nypown.exe	eaartykx.exe
PID 1876 wrote to memory of 608	1876	nypown.exe	schtasks.exe
PID 1876 wrote to memory of 608	1876	nypown.exe	schtasks.exe
PID 1876 wrote to memory of 608	1876	nypown.exe	schtasks.exe
PID 1876 wrote to memory of 608	1876	nypown.exe	schtasks.exe
PID 1468 wrote to memory of 848	1468	eaartykx.exe	eaartykx.exe
PID 1468 wrote to memory of 848	1468	eaartykx.exe	eaartykx.exe
PID 1468 wrote to memory of 848	1468	eaartykx.exe	eaartykx.exe
PID 1468 wrote to memory of 848	1468	eaartykx.exe	eaartykx.exe
PID 1468 wrote to memory of 1648	1468	eaartykx.exe	explorer.exe
PID 1468 wrote to memory of 1648	1468	eaartykx.exe	explorer.exe
PID 1468 wrote to memory of 1648	1468	eaartykx.exe	explorer.exe
PID 1468 wrote to memory of 1648	1468	eaartykx.exe	explorer.exe
PID 1468 wrote to memory of 1648	1468	eaartykx.exe	explorer.exe
PID 980 wrote to memory of 1984	980	taskeng.exe	nypown.exe
PID 980 wrote to memory of 1984	980	taskeng.exe	nypown.exe
PID 980 wrote to memory of 1984	980	taskeng.exe	nypown.exe
PID 980 wrote to memory of 1984	980	taskeng.exe	nypown.exe

C:\Users\Admin\AppData\Local\Temp\nypown.exe
"C:\Users\Admin\AppData\Local\Temp\nypown.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1876

C:\Users\Admin\AppData\Local\Temp\nypown.exe
C:\Users\Admin\AppData\Local\Temp\nypown.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1780

C:\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1468

C:\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:848

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1648

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn albswxdyj /tr "\"C:\Users\Admin\AppData\Local\Temp\nypown.exe\" /I albswxdyj" /SC ONCE /Z /ST 15:40 /ET 15:52
2⤵
- Creates scheduled task(s)
PID:608

C:\Windows\system32\taskeng.exe
taskeng.exe {5B7FE2E1-3974-4F1C-8EDE-80B93E68C514} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:980

C:\Users\Admin\AppData\Local\Temp\nypown.exe
C:\Users\Admin\AppData\Local\Temp\nypown.exe /I albswxdyj
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1984

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.dat
MD5
42aa1883517661f5f39019a380d02a0e

SHA1
131e9aee1035f37c91f54e7fac13a47c38cf92dd

SHA256
cf85dca087c2677bfb74c647dd66afaec696db3640ed285d7ca672893ccbd267

SHA512
974c6fa4aeaf7a80b801d33ea39438c9ee96db91725f530ac33289805e3d36e0576c969b9ad530b4b5272518360428f74d364dadb4acd8caa0389b5824f95ae6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe
MD5
3a840c4657f6343e31db72ddae5d5611

SHA1
8a791952c59306ad2f25b235861d57781e9c6e30

SHA256
7eb1319623b96e9400694656e1084abafe86c0c244b35de5c24fe6439df38067

SHA512
989eea2bf454e4d9e5d877b5bbfaf519e722c16e22d2e8378ab1925806242565238a928f00a3474db1599e8f4e0a144f6eb135eeacbdbc61572906cf527745d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe
MD5
3a840c4657f6343e31db72ddae5d5611

SHA1
8a791952c59306ad2f25b235861d57781e9c6e30

SHA256
7eb1319623b96e9400694656e1084abafe86c0c244b35de5c24fe6439df38067

SHA512
989eea2bf454e4d9e5d877b5bbfaf519e722c16e22d2e8378ab1925806242565238a928f00a3474db1599e8f4e0a144f6eb135eeacbdbc61572906cf527745d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe
MD5
3a840c4657f6343e31db72ddae5d5611

SHA1
8a791952c59306ad2f25b235861d57781e9c6e30

SHA256
7eb1319623b96e9400694656e1084abafe86c0c244b35de5c24fe6439df38067

SHA512
989eea2bf454e4d9e5d877b5bbfaf519e722c16e22d2e8378ab1925806242565238a928f00a3474db1599e8f4e0a144f6eb135eeacbdbc61572906cf527745d5

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe
MD5
3a840c4657f6343e31db72ddae5d5611

SHA1
8a791952c59306ad2f25b235861d57781e9c6e30

SHA256
7eb1319623b96e9400694656e1084abafe86c0c244b35de5c24fe6439df38067

SHA512
989eea2bf454e4d9e5d877b5bbfaf519e722c16e22d2e8378ab1925806242565238a928f00a3474db1599e8f4e0a144f6eb135eeacbdbc61572906cf527745d5

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Zzbgj\eaartykx.exe
MD5
3a840c4657f6343e31db72ddae5d5611

SHA1
8a791952c59306ad2f25b235861d57781e9c6e30

SHA256
7eb1319623b96e9400694656e1084abafe86c0c244b35de5c24fe6439df38067

SHA512
989eea2bf454e4d9e5d877b5bbfaf519e722c16e22d2e8378ab1925806242565238a928f00a3474db1599e8f4e0a144f6eb135eeacbdbc61572906cf527745d5

Download Submit
memory/608-6-0x0000000000000000-mapping.dmp

Download
memory/848-8-0x0000000000000000-mapping.dmp

Download
memory/848-10-0x00000000025E0000-0x00000000025F1000-memory.dmp

Filesize
68KB

Download
memory/1468-4-0x0000000000000000-mapping.dmp

Download
memory/1468-11-0x00000000003C0000-0x00000000003FA000-memory.dmp

Filesize
232KB

Download
memory/1648-12-0x0000000000000000-mapping.dmp

Download
memory/1780-0-0x0000000000000000-mapping.dmp

Download
memory/1780-1-0x0000000002600000-0x0000000002611000-memory.dmp

Filesize
68KB

Download
memory/1984-14-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads