qakbot | dba71d0c715a30543fa49588dc2113251fb66a5bfb9168d5e3318c09fba140f9

General

Target

ckgxlz.exe
Size

1.0MB
MD5

4b674244c1f85ce172e4610886f729b7
SHA1

9e2573bf20920a7e49eec23a59b04df2d4b47af8
SHA256

dba71d0c715a30543fa49588dc2113251fb66a5bfb9168d5e3318c09fba140f9
SHA512

cc85aabbff9ee2427f1db76ca26746d3f412ee28b8f772e909cb72c435844b52dabbfa0ee09006a1be4c952c70f6cbe6f2751758d400541cddc83c2f49b6dbba

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

tefunr.exetefunr.exe

pid process

1476 tefunr.exe
520 tefunr.exe
Loads dropped DLL 2 IoCs

Processes:

ckgxlz.exe

pid process

744 ckgxlz.exe
744 ckgxlz.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1472 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

ckgxlz.execkgxlz.exetefunr.exetefunr.exeexplorer.execkgxlz.exe

pid process

744 ckgxlz.exe
1768 ckgxlz.exe
1768 ckgxlz.exe
1476 tefunr.exe
520 tefunr.exe
520 tefunr.exe
788 explorer.exe
788 explorer.exe
940 ckgxlz.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

tefunr.exe

pid process

1476 tefunr.exe

pid	process
1476	tefunr.exe
520	tefunr.exe

pid	process
744	ckgxlz.exe
744	ckgxlz.exe

pid	process
1472	schtasks.exe

pid	process
744	ckgxlz.exe
1768	ckgxlz.exe
1768	ckgxlz.exe
1476	tefunr.exe
520	tefunr.exe
520	tefunr.exe
788	explorer.exe
788	explorer.exe
940	ckgxlz.exe

pid	process
1476	tefunr.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

ckgxlz.exetefunr.exetaskeng.exe

description	pid	process	target process
PID 744 wrote to memory of 1768	744	ckgxlz.exe	ckgxlz.exe
PID 744 wrote to memory of 1768	744	ckgxlz.exe	ckgxlz.exe
PID 744 wrote to memory of 1768	744	ckgxlz.exe	ckgxlz.exe
PID 744 wrote to memory of 1768	744	ckgxlz.exe	ckgxlz.exe
PID 744 wrote to memory of 1476	744	ckgxlz.exe	tefunr.exe
PID 744 wrote to memory of 1476	744	ckgxlz.exe	tefunr.exe
PID 744 wrote to memory of 1476	744	ckgxlz.exe	tefunr.exe
PID 744 wrote to memory of 1476	744	ckgxlz.exe	tefunr.exe
PID 744 wrote to memory of 1472	744	ckgxlz.exe	schtasks.exe
PID 744 wrote to memory of 1472	744	ckgxlz.exe	schtasks.exe
PID 744 wrote to memory of 1472	744	ckgxlz.exe	schtasks.exe
PID 744 wrote to memory of 1472	744	ckgxlz.exe	schtasks.exe
PID 1476 wrote to memory of 520	1476	tefunr.exe	tefunr.exe
PID 1476 wrote to memory of 520	1476	tefunr.exe	tefunr.exe
PID 1476 wrote to memory of 520	1476	tefunr.exe	tefunr.exe
PID 1476 wrote to memory of 520	1476	tefunr.exe	tefunr.exe
PID 1476 wrote to memory of 788	1476	tefunr.exe	explorer.exe
PID 1476 wrote to memory of 788	1476	tefunr.exe	explorer.exe
PID 1476 wrote to memory of 788	1476	tefunr.exe	explorer.exe
PID 1476 wrote to memory of 788	1476	tefunr.exe	explorer.exe
PID 1476 wrote to memory of 788	1476	tefunr.exe	explorer.exe
PID 1012 wrote to memory of 940	1012	taskeng.exe	ckgxlz.exe
PID 1012 wrote to memory of 940	1012	taskeng.exe	ckgxlz.exe
PID 1012 wrote to memory of 940	1012	taskeng.exe	ckgxlz.exe
PID 1012 wrote to memory of 940	1012	taskeng.exe	ckgxlz.exe

C:\Users\Admin\AppData\Local\Temp\ckgxlz.exe
"C:\Users\Admin\AppData\Local\Temp\ckgxlz.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:744

C:\Users\Admin\AppData\Local\Temp\ckgxlz.exe
C:\Users\Admin\AppData\Local\Temp\ckgxlz.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1768

C:\Users\Admin\AppData\Roaming\Microsoft\Iodpguwswswu\tefunr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Iodpguwswswu\tefunr.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1476

C:\Users\Admin\AppData\Roaming\Microsoft\Iodpguwswswu\tefunr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Iodpguwswswu\tefunr.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:520

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:788

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ajzmlnhu /tr "\"C:\Users\Admin\AppData\Local\Temp\ckgxlz.exe\" /I ajzmlnhu" /SC ONCE /Z /ST 15:38 /ET 15:50
2⤵
- Creates scheduled task(s)
PID:1472

C:\Windows\system32\taskeng.exe
taskeng.exe {C1EE01A2-F59D-472A-975B-D8FAF8818317} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1012

C:\Users\Admin\AppData\Local\Temp\ckgxlz.exe
C:\Users\Admin\AppData\Local\Temp\ckgxlz.exe /I ajzmlnhu
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:940

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Iodpguwswswu\tefunr.dat
MD5
c169dae998d2799f9d83db2b959d45e1

SHA1
0c556ee0a47b7fd1d4619f13d0b298d0dd79ce22

SHA256
942408dbf1088f34f25fbf9f5be5248b4d033be76625d25381aa8fa5cc661b3b

SHA512
9324dd562c88969cd1eb4dbb97120c3c3efe19f7e162b1d3118a85fb34a5ca4c76644ff4377c655b79549c942a9e70c4b0b7cd9d0c129c54064ccf73318eadbe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Iodpguwswswu\tefunr.exe
MD5
4b674244c1f85ce172e4610886f729b7

SHA1
9e2573bf20920a7e49eec23a59b04df2d4b47af8

SHA256
dba71d0c715a30543fa49588dc2113251fb66a5bfb9168d5e3318c09fba140f9

SHA512
cc85aabbff9ee2427f1db76ca26746d3f412ee28b8f772e909cb72c435844b52dabbfa0ee09006a1be4c952c70f6cbe6f2751758d400541cddc83c2f49b6dbba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Iodpguwswswu\tefunr.exe
MD5
4b674244c1f85ce172e4610886f729b7

SHA1
9e2573bf20920a7e49eec23a59b04df2d4b47af8

SHA256
dba71d0c715a30543fa49588dc2113251fb66a5bfb9168d5e3318c09fba140f9

SHA512
cc85aabbff9ee2427f1db76ca26746d3f412ee28b8f772e909cb72c435844b52dabbfa0ee09006a1be4c952c70f6cbe6f2751758d400541cddc83c2f49b6dbba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Iodpguwswswu\tefunr.exe
MD5
4b674244c1f85ce172e4610886f729b7

SHA1
9e2573bf20920a7e49eec23a59b04df2d4b47af8

SHA256
dba71d0c715a30543fa49588dc2113251fb66a5bfb9168d5e3318c09fba140f9

SHA512
cc85aabbff9ee2427f1db76ca26746d3f412ee28b8f772e909cb72c435844b52dabbfa0ee09006a1be4c952c70f6cbe6f2751758d400541cddc83c2f49b6dbba

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Iodpguwswswu\tefunr.exe
MD5
4b674244c1f85ce172e4610886f729b7

SHA1
9e2573bf20920a7e49eec23a59b04df2d4b47af8

SHA256
dba71d0c715a30543fa49588dc2113251fb66a5bfb9168d5e3318c09fba140f9

SHA512
cc85aabbff9ee2427f1db76ca26746d3f412ee28b8f772e909cb72c435844b52dabbfa0ee09006a1be4c952c70f6cbe6f2751758d400541cddc83c2f49b6dbba

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Iodpguwswswu\tefunr.exe
MD5
4b674244c1f85ce172e4610886f729b7

SHA1
9e2573bf20920a7e49eec23a59b04df2d4b47af8

SHA256
dba71d0c715a30543fa49588dc2113251fb66a5bfb9168d5e3318c09fba140f9

SHA512
cc85aabbff9ee2427f1db76ca26746d3f412ee28b8f772e909cb72c435844b52dabbfa0ee09006a1be4c952c70f6cbe6f2751758d400541cddc83c2f49b6dbba

Download Submit
memory/520-10-0x0000000002680000-0x0000000002691000-memory.dmp

Filesize
68KB

Download
memory/520-8-0x0000000000000000-mapping.dmp

Download
memory/788-12-0x0000000000000000-mapping.dmp

Download
memory/940-14-0x0000000000000000-mapping.dmp

Download
memory/1472-6-0x0000000000000000-mapping.dmp

Download
memory/1476-11-0x0000000000510000-0x000000000054A000-memory.dmp

Filesize
232KB

Download
memory/1476-4-0x0000000000000000-mapping.dmp

Download
memory/1768-0-0x0000000000000000-mapping.dmp

Download
memory/1768-1-0x0000000002520000-0x0000000002531000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads