qakbot | 9045de343b864e44756ffeafd7273daee7b1dca669973c12c4fcfb8268ee4c62

General

Target

gmotla.exe
Size

1.0MB
MD5

2a4c8d696efa90078b492fbf90aea0c4
SHA1

36d686b81f00dca0b1d170df1108208f8f643103
SHA256

9045de343b864e44756ffeafd7273daee7b1dca669973c12c4fcfb8268ee4c62
SHA512

af75828d0ab95606cf1f4253513d0047a3bed74cf06cf4347d3a3d23cbba8e3409dad32ea47cabce3b7e71151201c8df57d80cb468b854b0ad6423de7715b533

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

mowjyxve.exemowjyxve.exe

pid process

920 mowjyxve.exe
396 mowjyxve.exe
Loads dropped DLL 2 IoCs

Processes:

gmotla.exe

pid process

932 gmotla.exe
932 gmotla.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1348 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

gmotla.exegmotla.exemowjyxve.exemowjyxve.exeexplorer.exegmotla.exe

pid process

932 gmotla.exe
1168 gmotla.exe
1168 gmotla.exe
920 mowjyxve.exe
396 mowjyxve.exe
396 mowjyxve.exe
556 explorer.exe
556 explorer.exe
1828 gmotla.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

mowjyxve.exe

pid process

920 mowjyxve.exe

pid	process
920	mowjyxve.exe
396	mowjyxve.exe

pid	process
932	gmotla.exe
932	gmotla.exe

pid	process
1348	schtasks.exe

pid	process
932	gmotla.exe
1168	gmotla.exe
1168	gmotla.exe
920	mowjyxve.exe
396	mowjyxve.exe
396	mowjyxve.exe
556	explorer.exe
556	explorer.exe
1828	gmotla.exe

pid	process
920	mowjyxve.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

gmotla.exemowjyxve.exetaskeng.exe

description	pid	process	target process
PID 932 wrote to memory of 1168	932	gmotla.exe	gmotla.exe
PID 932 wrote to memory of 1168	932	gmotla.exe	gmotla.exe
PID 932 wrote to memory of 1168	932	gmotla.exe	gmotla.exe
PID 932 wrote to memory of 1168	932	gmotla.exe	gmotla.exe
PID 932 wrote to memory of 920	932	gmotla.exe	mowjyxve.exe
PID 932 wrote to memory of 920	932	gmotla.exe	mowjyxve.exe
PID 932 wrote to memory of 920	932	gmotla.exe	mowjyxve.exe
PID 932 wrote to memory of 920	932	gmotla.exe	mowjyxve.exe
PID 932 wrote to memory of 1348	932	gmotla.exe	schtasks.exe
PID 932 wrote to memory of 1348	932	gmotla.exe	schtasks.exe
PID 932 wrote to memory of 1348	932	gmotla.exe	schtasks.exe
PID 932 wrote to memory of 1348	932	gmotla.exe	schtasks.exe
PID 920 wrote to memory of 396	920	mowjyxve.exe	mowjyxve.exe
PID 920 wrote to memory of 396	920	mowjyxve.exe	mowjyxve.exe
PID 920 wrote to memory of 396	920	mowjyxve.exe	mowjyxve.exe
PID 920 wrote to memory of 396	920	mowjyxve.exe	mowjyxve.exe
PID 920 wrote to memory of 556	920	mowjyxve.exe	explorer.exe
PID 920 wrote to memory of 556	920	mowjyxve.exe	explorer.exe
PID 920 wrote to memory of 556	920	mowjyxve.exe	explorer.exe
PID 920 wrote to memory of 556	920	mowjyxve.exe	explorer.exe
PID 920 wrote to memory of 556	920	mowjyxve.exe	explorer.exe
PID 472 wrote to memory of 1828	472	taskeng.exe	gmotla.exe
PID 472 wrote to memory of 1828	472	taskeng.exe	gmotla.exe
PID 472 wrote to memory of 1828	472	taskeng.exe	gmotla.exe
PID 472 wrote to memory of 1828	472	taskeng.exe	gmotla.exe

C:\Users\Admin\AppData\Local\Temp\gmotla.exe
"C:\Users\Admin\AppData\Local\Temp\gmotla.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:932

C:\Users\Admin\AppData\Local\Temp\gmotla.exe
C:\Users\Admin\AppData\Local\Temp\gmotla.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1168

C:\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:920

C:\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:396

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:556

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mgnoaft /tr "\"C:\Users\Admin\AppData\Local\Temp\gmotla.exe\" /I mgnoaft" /SC ONCE /Z /ST 14:40 /ET 14:52
2⤵
- Creates scheduled task(s)
PID:1348

C:\Windows\system32\taskeng.exe
taskeng.exe {0CD29970-325F-4187-BE1D-82EA5FE5EB81} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:472

C:\Users\Admin\AppData\Local\Temp\gmotla.exe
C:\Users\Admin\AppData\Local\Temp\gmotla.exe /I mgnoaft
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1828

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.dat
MD5
d9a6e3fa380b3aaed41839f568851074

SHA1
0521d26f128e6c77ff4d73542bbfda6367d809eb

SHA256
af52916a3fcfc94f1a4d318b007dc976a286e12c51a8120b58914b7c2b54163a

SHA512
90516f0ab04b80355ea7a6ae938d22a0fdf8004d21ade819d31d839459c85fc516dd3bd53cbff1d14a1381d05d01de0e6c1f594ebed2fd1b7e1820e8d5072e29

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe
MD5
2a4c8d696efa90078b492fbf90aea0c4

SHA1
36d686b81f00dca0b1d170df1108208f8f643103

SHA256
9045de343b864e44756ffeafd7273daee7b1dca669973c12c4fcfb8268ee4c62

SHA512
af75828d0ab95606cf1f4253513d0047a3bed74cf06cf4347d3a3d23cbba8e3409dad32ea47cabce3b7e71151201c8df57d80cb468b854b0ad6423de7715b533

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe
MD5
2a4c8d696efa90078b492fbf90aea0c4

SHA1
36d686b81f00dca0b1d170df1108208f8f643103

SHA256
9045de343b864e44756ffeafd7273daee7b1dca669973c12c4fcfb8268ee4c62

SHA512
af75828d0ab95606cf1f4253513d0047a3bed74cf06cf4347d3a3d23cbba8e3409dad32ea47cabce3b7e71151201c8df57d80cb468b854b0ad6423de7715b533

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe
MD5
2a4c8d696efa90078b492fbf90aea0c4

SHA1
36d686b81f00dca0b1d170df1108208f8f643103

SHA256
9045de343b864e44756ffeafd7273daee7b1dca669973c12c4fcfb8268ee4c62

SHA512
af75828d0ab95606cf1f4253513d0047a3bed74cf06cf4347d3a3d23cbba8e3409dad32ea47cabce3b7e71151201c8df57d80cb468b854b0ad6423de7715b533

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe
MD5
2a4c8d696efa90078b492fbf90aea0c4

SHA1
36d686b81f00dca0b1d170df1108208f8f643103

SHA256
9045de343b864e44756ffeafd7273daee7b1dca669973c12c4fcfb8268ee4c62

SHA512
af75828d0ab95606cf1f4253513d0047a3bed74cf06cf4347d3a3d23cbba8e3409dad32ea47cabce3b7e71151201c8df57d80cb468b854b0ad6423de7715b533

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Yzjkmutwz\mowjyxve.exe
MD5
2a4c8d696efa90078b492fbf90aea0c4

SHA1
36d686b81f00dca0b1d170df1108208f8f643103

SHA256
9045de343b864e44756ffeafd7273daee7b1dca669973c12c4fcfb8268ee4c62

SHA512
af75828d0ab95606cf1f4253513d0047a3bed74cf06cf4347d3a3d23cbba8e3409dad32ea47cabce3b7e71151201c8df57d80cb468b854b0ad6423de7715b533

Download Submit
memory/396-10-0x00000000026A0000-0x00000000026B1000-memory.dmp

Filesize
68KB

Download
memory/396-8-0x0000000000000000-mapping.dmp

Download
memory/556-12-0x0000000000000000-mapping.dmp

Download
memory/920-4-0x0000000000000000-mapping.dmp

Download
memory/920-11-0x0000000000610000-0x000000000064A000-memory.dmp

Filesize
232KB

Download
memory/1168-0-0x0000000000000000-mapping.dmp

Download
memory/1168-1-0x0000000002650000-0x0000000002661000-memory.dmp

Filesize
68KB

Download
memory/1348-6-0x0000000000000000-mapping.dmp

Download
memory/1828-14-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads