qakbot | 8c0395e40372a374a75d4c7ed847a27a5dcfb386961131f582111fea50e56947

General

Target

ldlnnl.exe
Size

1.0MB
MD5

823b1f875085754a397eb107e7fdb57d
SHA1

1bb646900773c64cf33be139989c385f11fd601e
SHA256

8c0395e40372a374a75d4c7ed847a27a5dcfb386961131f582111fea50e56947
SHA512

335cd7211fd19621b54def63fe1c4f8c9b67ce479d9c46148fb4a2901511aede85211fa0511983138d5412a4357af95ac44cbbdcd662dd22346929f25ec09e7b

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

cygvoyy.execygvoyy.exe

pid process

1724 cygvoyy.exe
1536 cygvoyy.exe
Loads dropped DLL 2 IoCs

Processes:

ldlnnl.exe

pid process

1828 ldlnnl.exe
1828 ldlnnl.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1668 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

ldlnnl.exeldlnnl.execygvoyy.execygvoyy.exeexplorer.exeldlnnl.exe

pid process

1828 ldlnnl.exe
1748 ldlnnl.exe
1748 ldlnnl.exe
1724 cygvoyy.exe
1536 cygvoyy.exe
1536 cygvoyy.exe
1728 explorer.exe
1728 explorer.exe
1140 ldlnnl.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

cygvoyy.exe

pid process

1724 cygvoyy.exe

pid	process
1724	cygvoyy.exe
1536	cygvoyy.exe

pid	process
1828	ldlnnl.exe
1828	ldlnnl.exe

pid	process
1668	schtasks.exe

pid	process
1828	ldlnnl.exe
1748	ldlnnl.exe
1748	ldlnnl.exe
1724	cygvoyy.exe
1536	cygvoyy.exe
1536	cygvoyy.exe
1728	explorer.exe
1728	explorer.exe
1140	ldlnnl.exe

pid	process
1724	cygvoyy.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

ldlnnl.execygvoyy.exetaskeng.exe

description	pid	process	target process
PID 1828 wrote to memory of 1748	1828	ldlnnl.exe	ldlnnl.exe
PID 1828 wrote to memory of 1748	1828	ldlnnl.exe	ldlnnl.exe
PID 1828 wrote to memory of 1748	1828	ldlnnl.exe	ldlnnl.exe
PID 1828 wrote to memory of 1748	1828	ldlnnl.exe	ldlnnl.exe
PID 1828 wrote to memory of 1724	1828	ldlnnl.exe	cygvoyy.exe
PID 1828 wrote to memory of 1724	1828	ldlnnl.exe	cygvoyy.exe
PID 1828 wrote to memory of 1724	1828	ldlnnl.exe	cygvoyy.exe
PID 1828 wrote to memory of 1724	1828	ldlnnl.exe	cygvoyy.exe
PID 1828 wrote to memory of 1668	1828	ldlnnl.exe	schtasks.exe
PID 1828 wrote to memory of 1668	1828	ldlnnl.exe	schtasks.exe
PID 1828 wrote to memory of 1668	1828	ldlnnl.exe	schtasks.exe
PID 1828 wrote to memory of 1668	1828	ldlnnl.exe	schtasks.exe
PID 1724 wrote to memory of 1536	1724	cygvoyy.exe	cygvoyy.exe
PID 1724 wrote to memory of 1536	1724	cygvoyy.exe	cygvoyy.exe
PID 1724 wrote to memory of 1536	1724	cygvoyy.exe	cygvoyy.exe
PID 1724 wrote to memory of 1536	1724	cygvoyy.exe	cygvoyy.exe
PID 1724 wrote to memory of 1728	1724	cygvoyy.exe	explorer.exe
PID 1724 wrote to memory of 1728	1724	cygvoyy.exe	explorer.exe
PID 1724 wrote to memory of 1728	1724	cygvoyy.exe	explorer.exe
PID 1724 wrote to memory of 1728	1724	cygvoyy.exe	explorer.exe
PID 1724 wrote to memory of 1728	1724	cygvoyy.exe	explorer.exe
PID 432 wrote to memory of 1140	432	taskeng.exe	ldlnnl.exe
PID 432 wrote to memory of 1140	432	taskeng.exe	ldlnnl.exe
PID 432 wrote to memory of 1140	432	taskeng.exe	ldlnnl.exe
PID 432 wrote to memory of 1140	432	taskeng.exe	ldlnnl.exe

C:\Users\Admin\AppData\Local\Temp\ldlnnl.exe
"C:\Users\Admin\AppData\Local\Temp\ldlnnl.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1828

C:\Users\Admin\AppData\Local\Temp\ldlnnl.exe
C:\Users\Admin\AppData\Local\Temp\ldlnnl.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1748

C:\Users\Admin\AppData\Roaming\Microsoft\Aexakneehks\cygvoyy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Aexakneehks\cygvoyy.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Admin\AppData\Roaming\Microsoft\Aexakneehks\cygvoyy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Aexakneehks\cygvoyy.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1536

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zbyymlkb /tr "\"C:\Users\Admin\AppData\Local\Temp\ldlnnl.exe\" /I zbyymlkb" /SC ONCE /Z /ST 15:40 /ET 15:52
2⤵
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\taskeng.exe
taskeng.exe {0BF7C9AB-78E6-4A79-9F0A-D1959A5AA70C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:432

C:\Users\Admin\AppData\Local\Temp\ldlnnl.exe
C:\Users\Admin\AppData\Local\Temp\ldlnnl.exe /I zbyymlkb
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1140

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Aexakneehks\cygvoyy.dat
MD5
2a66c2c80fc063b1306b3c474bcddc48

SHA1
648462623b96b8603d13548dcdfa77a2699235ac

SHA256
e2df4c3417d771d42095e25267f582ae9a1908f642f90d497b535311d0c1ceed

SHA512
70c1fb8a1fbce4aba845c86619b724c0b3d96a7d052edf7ea1a3ba995a52fe508b589bf02d7427e13d2020347fd695b9df90fc13760c1207258eb4837d65c9d0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Aexakneehks\cygvoyy.exe
MD5
823b1f875085754a397eb107e7fdb57d

SHA1
1bb646900773c64cf33be139989c385f11fd601e

SHA256
8c0395e40372a374a75d4c7ed847a27a5dcfb386961131f582111fea50e56947

SHA512
335cd7211fd19621b54def63fe1c4f8c9b67ce479d9c46148fb4a2901511aede85211fa0511983138d5412a4357af95ac44cbbdcd662dd22346929f25ec09e7b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Aexakneehks\cygvoyy.exe
MD5
823b1f875085754a397eb107e7fdb57d

SHA1
1bb646900773c64cf33be139989c385f11fd601e

SHA256
8c0395e40372a374a75d4c7ed847a27a5dcfb386961131f582111fea50e56947

SHA512
335cd7211fd19621b54def63fe1c4f8c9b67ce479d9c46148fb4a2901511aede85211fa0511983138d5412a4357af95ac44cbbdcd662dd22346929f25ec09e7b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Aexakneehks\cygvoyy.exe
MD5
823b1f875085754a397eb107e7fdb57d

SHA1
1bb646900773c64cf33be139989c385f11fd601e

SHA256
8c0395e40372a374a75d4c7ed847a27a5dcfb386961131f582111fea50e56947

SHA512
335cd7211fd19621b54def63fe1c4f8c9b67ce479d9c46148fb4a2901511aede85211fa0511983138d5412a4357af95ac44cbbdcd662dd22346929f25ec09e7b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Aexakneehks\cygvoyy.exe
MD5
823b1f875085754a397eb107e7fdb57d

SHA1
1bb646900773c64cf33be139989c385f11fd601e

SHA256
8c0395e40372a374a75d4c7ed847a27a5dcfb386961131f582111fea50e56947

SHA512
335cd7211fd19621b54def63fe1c4f8c9b67ce479d9c46148fb4a2901511aede85211fa0511983138d5412a4357af95ac44cbbdcd662dd22346929f25ec09e7b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Aexakneehks\cygvoyy.exe
MD5
823b1f875085754a397eb107e7fdb57d

SHA1
1bb646900773c64cf33be139989c385f11fd601e

SHA256
8c0395e40372a374a75d4c7ed847a27a5dcfb386961131f582111fea50e56947

SHA512
335cd7211fd19621b54def63fe1c4f8c9b67ce479d9c46148fb4a2901511aede85211fa0511983138d5412a4357af95ac44cbbdcd662dd22346929f25ec09e7b

Download Submit
memory/1140-14-0x0000000000000000-mapping.dmp

Download
memory/1536-10-0x0000000002630000-0x0000000002641000-memory.dmp

Filesize
68KB

Download
memory/1536-8-0x0000000000000000-mapping.dmp

Download
memory/1668-6-0x0000000000000000-mapping.dmp

Download
memory/1724-11-0x00000000003B0000-0x00000000003EA000-memory.dmp

Filesize
232KB

Download
memory/1724-4-0x0000000000000000-mapping.dmp

Download
memory/1728-12-0x0000000000000000-mapping.dmp

Download
memory/1748-0-0x0000000000000000-mapping.dmp

Download
memory/1748-1-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads