qakbot | a62c63b29db80c1d1e9a10a991aae89a98c695fa75d6444ee098c17f52c3b35d

General

Target

fepqaa.exe
Size

1.0MB
MD5

c43437c6645f51bb87b45ecaa5b27c27
SHA1

0b243c2273b3e6151445329432691b52b1fc6079
SHA256

a62c63b29db80c1d1e9a10a991aae89a98c695fa75d6444ee098c17f52c3b35d
SHA512

e3e6b2a701556ca0a2b85c009aa57c3966b95a1c0449e9b7dbd732487df05186ff0c1549b33df50541c1b7da8c259fb217a44e2a5f1416a3c527dd1fef681f89

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

adwhtu.exeadwhtu.exe

pid process

1392 adwhtu.exe
1580 adwhtu.exe
Loads dropped DLL 2 IoCs

Processes:

fepqaa.exe

pid process

288 fepqaa.exe
288 fepqaa.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1452 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

fepqaa.exefepqaa.exeadwhtu.exeadwhtu.exeexplorer.exe

pid process

288 fepqaa.exe
1692 fepqaa.exe
1692 fepqaa.exe
1392 adwhtu.exe
1580 adwhtu.exe
1580 adwhtu.exe
400 explorer.exe
400 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

adwhtu.exe

pid process

1392 adwhtu.exe

pid	process
1392	adwhtu.exe
1580	adwhtu.exe

pid	process
288	fepqaa.exe
288	fepqaa.exe

pid	process
1452	schtasks.exe

pid	process
288	fepqaa.exe
1692	fepqaa.exe
1692	fepqaa.exe
1392	adwhtu.exe
1580	adwhtu.exe
1580	adwhtu.exe
400	explorer.exe
400	explorer.exe

pid	process
1392	adwhtu.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

fepqaa.exeadwhtu.exetaskeng.exe

description	pid	process	target process
PID 288 wrote to memory of 1692	288	fepqaa.exe	fepqaa.exe
PID 288 wrote to memory of 1692	288	fepqaa.exe	fepqaa.exe
PID 288 wrote to memory of 1692	288	fepqaa.exe	fepqaa.exe
PID 288 wrote to memory of 1692	288	fepqaa.exe	fepqaa.exe
PID 288 wrote to memory of 1392	288	fepqaa.exe	adwhtu.exe
PID 288 wrote to memory of 1392	288	fepqaa.exe	adwhtu.exe
PID 288 wrote to memory of 1392	288	fepqaa.exe	adwhtu.exe
PID 288 wrote to memory of 1392	288	fepqaa.exe	adwhtu.exe
PID 288 wrote to memory of 1452	288	fepqaa.exe	schtasks.exe
PID 288 wrote to memory of 1452	288	fepqaa.exe	schtasks.exe
PID 288 wrote to memory of 1452	288	fepqaa.exe	schtasks.exe
PID 288 wrote to memory of 1452	288	fepqaa.exe	schtasks.exe
PID 1392 wrote to memory of 1580	1392	adwhtu.exe	adwhtu.exe
PID 1392 wrote to memory of 1580	1392	adwhtu.exe	adwhtu.exe
PID 1392 wrote to memory of 1580	1392	adwhtu.exe	adwhtu.exe
PID 1392 wrote to memory of 1580	1392	adwhtu.exe	adwhtu.exe
PID 1392 wrote to memory of 400	1392	adwhtu.exe	explorer.exe
PID 1392 wrote to memory of 400	1392	adwhtu.exe	explorer.exe
PID 1392 wrote to memory of 400	1392	adwhtu.exe	explorer.exe
PID 1392 wrote to memory of 400	1392	adwhtu.exe	explorer.exe
PID 1392 wrote to memory of 400	1392	adwhtu.exe	explorer.exe
PID 304 wrote to memory of 476	304	taskeng.exe	fepqaa.exe
PID 304 wrote to memory of 476	304	taskeng.exe	fepqaa.exe
PID 304 wrote to memory of 476	304	taskeng.exe	fepqaa.exe
PID 304 wrote to memory of 476	304	taskeng.exe	fepqaa.exe

C:\Users\Admin\AppData\Local\Temp\fepqaa.exe
"C:\Users\Admin\AppData\Local\Temp\fepqaa.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:288

C:\Users\Admin\AppData\Local\Temp\fepqaa.exe
C:\Users\Admin\AppData\Local\Temp\fepqaa.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1692

C:\Users\Admin\AppData\Roaming\Microsoft\Ikpioxpxriwo\adwhtu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ikpioxpxriwo\adwhtu.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1392

C:\Users\Admin\AppData\Roaming\Microsoft\Ikpioxpxriwo\adwhtu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ikpioxpxriwo\adwhtu.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1580

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:400

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn buibqcnsp /tr "\"C:\Users\Admin\AppData\Local\Temp\fepqaa.exe\" /I buibqcnsp" /SC ONCE /Z /ST 14:46 /ET 14:58
2⤵
- Creates scheduled task(s)
PID:1452

C:\Windows\system32\taskeng.exe
taskeng.exe {EA225F7F-77A2-4F5A-982C-A6C810C3141D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:304

C:\Users\Admin\AppData\Local\Temp\fepqaa.exe
C:\Users\Admin\AppData\Local\Temp\fepqaa.exe /I buibqcnsp
2⤵
PID:476

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Ikpioxpxriwo\adwhtu.dat
MD5
339f8d42197638d74a24238f6420fbc4

SHA1
e62baa610ffef62465dfe4477faf206191d301cc

SHA256
117de98fb9d006344c4b5059a7a1c402e04406853dc4d4a54c91135a9dd89678

SHA512
c168cf6362b65bce926e126b35b267392ca6d8777a34dcf2a2d29663e0c01f0b3f0184ff95e6ffa1a7e62f8bf11997eabf319d4611cef0540cd05b2ac7cb8183

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ikpioxpxriwo\adwhtu.exe
MD5
c43437c6645f51bb87b45ecaa5b27c27

SHA1
0b243c2273b3e6151445329432691b52b1fc6079

SHA256
a62c63b29db80c1d1e9a10a991aae89a98c695fa75d6444ee098c17f52c3b35d

SHA512
e3e6b2a701556ca0a2b85c009aa57c3966b95a1c0449e9b7dbd732487df05186ff0c1549b33df50541c1b7da8c259fb217a44e2a5f1416a3c527dd1fef681f89

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ikpioxpxriwo\adwhtu.exe
MD5
c43437c6645f51bb87b45ecaa5b27c27

SHA1
0b243c2273b3e6151445329432691b52b1fc6079

SHA256
a62c63b29db80c1d1e9a10a991aae89a98c695fa75d6444ee098c17f52c3b35d

SHA512
e3e6b2a701556ca0a2b85c009aa57c3966b95a1c0449e9b7dbd732487df05186ff0c1549b33df50541c1b7da8c259fb217a44e2a5f1416a3c527dd1fef681f89

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ikpioxpxriwo\adwhtu.exe
MD5
c43437c6645f51bb87b45ecaa5b27c27

SHA1
0b243c2273b3e6151445329432691b52b1fc6079

SHA256
a62c63b29db80c1d1e9a10a991aae89a98c695fa75d6444ee098c17f52c3b35d

SHA512
e3e6b2a701556ca0a2b85c009aa57c3966b95a1c0449e9b7dbd732487df05186ff0c1549b33df50541c1b7da8c259fb217a44e2a5f1416a3c527dd1fef681f89

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Ikpioxpxriwo\adwhtu.exe
MD5
c43437c6645f51bb87b45ecaa5b27c27

SHA1
0b243c2273b3e6151445329432691b52b1fc6079

SHA256
a62c63b29db80c1d1e9a10a991aae89a98c695fa75d6444ee098c17f52c3b35d

SHA512
e3e6b2a701556ca0a2b85c009aa57c3966b95a1c0449e9b7dbd732487df05186ff0c1549b33df50541c1b7da8c259fb217a44e2a5f1416a3c527dd1fef681f89

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Ikpioxpxriwo\adwhtu.exe
MD5
c43437c6645f51bb87b45ecaa5b27c27

SHA1
0b243c2273b3e6151445329432691b52b1fc6079

SHA256
a62c63b29db80c1d1e9a10a991aae89a98c695fa75d6444ee098c17f52c3b35d

SHA512
e3e6b2a701556ca0a2b85c009aa57c3966b95a1c0449e9b7dbd732487df05186ff0c1549b33df50541c1b7da8c259fb217a44e2a5f1416a3c527dd1fef681f89

Download Submit
memory/400-12-0x0000000000000000-mapping.dmp

Download
memory/476-15-0x0000000000000000-mapping.dmp

Download
memory/1392-4-0x0000000000000000-mapping.dmp

Download
memory/1392-11-0x0000000000620000-0x000000000065A000-memory.dmp

Filesize
232KB

Download
memory/1452-6-0x0000000000000000-mapping.dmp

Download
memory/1580-10-0x00000000024D0000-0x00000000024E1000-memory.dmp

Filesize
68KB

Download
memory/1580-8-0x0000000000000000-mapping.dmp

Download
memory/1692-0-0x0000000000000000-mapping.dmp

Download
memory/1692-1-0x00000000026E0000-0x00000000026F1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads