qakbot | 53656ceb9f5aed65e7a632f485e6807e2587a354d745978cf036ae14d942ae7a

General

Target

gvlhmf.exe
Size

1.0MB
MD5

a292bdca006158fd2cc02e0c2293cbca
SHA1

6fd0976cb34cfe79a8a78542d5c86dab3c8cb378
SHA256

53656ceb9f5aed65e7a632f485e6807e2587a354d745978cf036ae14d942ae7a
SHA512

e8a6fb67d7227bd67a468975f423cc40b7540c8c6cd4fbeed3ed8be00a6f98d83580fd83db96b215dd5e7ff6847767eb81acb68033e2b453804cf343fdd33c76

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

rewiimhi.exerewiimhi.exe

pid process

1488 rewiimhi.exe
1580 rewiimhi.exe
Loads dropped DLL 2 IoCs

Processes:

gvlhmf.exe

pid process

292 gvlhmf.exe
292 gvlhmf.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

904 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

gvlhmf.exegvlhmf.exerewiimhi.exerewiimhi.exeexplorer.exegvlhmf.exe

pid process

292 gvlhmf.exe
1256 gvlhmf.exe
1256 gvlhmf.exe
1488 rewiimhi.exe
1580 rewiimhi.exe
1580 rewiimhi.exe
268 explorer.exe
268 explorer.exe
1340 gvlhmf.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rewiimhi.exe

pid process

1488 rewiimhi.exe

pid	process
1488	rewiimhi.exe
1580	rewiimhi.exe

pid	process
292	gvlhmf.exe
292	gvlhmf.exe

pid	process
904	schtasks.exe

pid	process
292	gvlhmf.exe
1256	gvlhmf.exe
1256	gvlhmf.exe
1488	rewiimhi.exe
1580	rewiimhi.exe
1580	rewiimhi.exe
268	explorer.exe
268	explorer.exe
1340	gvlhmf.exe

pid	process
1488	rewiimhi.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

gvlhmf.exerewiimhi.exetaskeng.exe

description	pid	process	target process
PID 292 wrote to memory of 1256	292	gvlhmf.exe	gvlhmf.exe
PID 292 wrote to memory of 1256	292	gvlhmf.exe	gvlhmf.exe
PID 292 wrote to memory of 1256	292	gvlhmf.exe	gvlhmf.exe
PID 292 wrote to memory of 1256	292	gvlhmf.exe	gvlhmf.exe
PID 292 wrote to memory of 1488	292	gvlhmf.exe	rewiimhi.exe
PID 292 wrote to memory of 1488	292	gvlhmf.exe	rewiimhi.exe
PID 292 wrote to memory of 1488	292	gvlhmf.exe	rewiimhi.exe
PID 292 wrote to memory of 1488	292	gvlhmf.exe	rewiimhi.exe
PID 292 wrote to memory of 904	292	gvlhmf.exe	schtasks.exe
PID 292 wrote to memory of 904	292	gvlhmf.exe	schtasks.exe
PID 292 wrote to memory of 904	292	gvlhmf.exe	schtasks.exe
PID 292 wrote to memory of 904	292	gvlhmf.exe	schtasks.exe
PID 1488 wrote to memory of 1580	1488	rewiimhi.exe	rewiimhi.exe
PID 1488 wrote to memory of 1580	1488	rewiimhi.exe	rewiimhi.exe
PID 1488 wrote to memory of 1580	1488	rewiimhi.exe	rewiimhi.exe
PID 1488 wrote to memory of 1580	1488	rewiimhi.exe	rewiimhi.exe
PID 1488 wrote to memory of 268	1488	rewiimhi.exe	explorer.exe
PID 1488 wrote to memory of 268	1488	rewiimhi.exe	explorer.exe
PID 1488 wrote to memory of 268	1488	rewiimhi.exe	explorer.exe
PID 1488 wrote to memory of 268	1488	rewiimhi.exe	explorer.exe
PID 1488 wrote to memory of 268	1488	rewiimhi.exe	explorer.exe
PID 760 wrote to memory of 1340	760	taskeng.exe	gvlhmf.exe
PID 760 wrote to memory of 1340	760	taskeng.exe	gvlhmf.exe
PID 760 wrote to memory of 1340	760	taskeng.exe	gvlhmf.exe
PID 760 wrote to memory of 1340	760	taskeng.exe	gvlhmf.exe

C:\Users\Admin\AppData\Local\Temp\gvlhmf.exe
"C:\Users\Admin\AppData\Local\Temp\gvlhmf.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:292

C:\Users\Admin\AppData\Local\Temp\gvlhmf.exe
C:\Users\Admin\AppData\Local\Temp\gvlhmf.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1256

C:\Users\Admin\AppData\Roaming\Microsoft\Ehwjynid\rewiimhi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ehwjynid\rewiimhi.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1488

C:\Users\Admin\AppData\Roaming\Microsoft\Ehwjynid\rewiimhi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ehwjynid\rewiimhi.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1580

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:268

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wcllamx /tr "\"C:\Users\Admin\AppData\Local\Temp\gvlhmf.exe\" /I wcllamx" /SC ONCE /Z /ST 14:45 /ET 14:57
2⤵
- Creates scheduled task(s)
PID:904

C:\Windows\system32\taskeng.exe
taskeng.exe {3CD9064C-29C2-4DB6-90E7-EAC8DF29A660} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:760

C:\Users\Admin\AppData\Local\Temp\gvlhmf.exe
C:\Users\Admin\AppData\Local\Temp\gvlhmf.exe /I wcllamx
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1340

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Ehwjynid\rewiimhi.dat
MD5
8c8eb2f797c98170587060563cbf77ef

SHA1
8c3768f7ef45a74f18bd9c79a409bed220f8ca99

SHA256
a7782a9ab1a18590bb1458f5afaa5de8432e96b2d8877c68e6f64dc8b72499e9

SHA512
1f4b39fb0f383dc221c9c54e2ef6c427c09ac669ab23df01788a718964237a157cfd883ed819aeecbc9a225112be390ee837bc7c37441b810fb4b46563156a76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ehwjynid\rewiimhi.exe
MD5
a292bdca006158fd2cc02e0c2293cbca

SHA1
6fd0976cb34cfe79a8a78542d5c86dab3c8cb378

SHA256
53656ceb9f5aed65e7a632f485e6807e2587a354d745978cf036ae14d942ae7a

SHA512
e8a6fb67d7227bd67a468975f423cc40b7540c8c6cd4fbeed3ed8be00a6f98d83580fd83db96b215dd5e7ff6847767eb81acb68033e2b453804cf343fdd33c76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ehwjynid\rewiimhi.exe
MD5
a292bdca006158fd2cc02e0c2293cbca

SHA1
6fd0976cb34cfe79a8a78542d5c86dab3c8cb378

SHA256
53656ceb9f5aed65e7a632f485e6807e2587a354d745978cf036ae14d942ae7a

SHA512
e8a6fb67d7227bd67a468975f423cc40b7540c8c6cd4fbeed3ed8be00a6f98d83580fd83db96b215dd5e7ff6847767eb81acb68033e2b453804cf343fdd33c76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ehwjynid\rewiimhi.exe
MD5
a292bdca006158fd2cc02e0c2293cbca

SHA1
6fd0976cb34cfe79a8a78542d5c86dab3c8cb378

SHA256
53656ceb9f5aed65e7a632f485e6807e2587a354d745978cf036ae14d942ae7a

SHA512
e8a6fb67d7227bd67a468975f423cc40b7540c8c6cd4fbeed3ed8be00a6f98d83580fd83db96b215dd5e7ff6847767eb81acb68033e2b453804cf343fdd33c76

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Ehwjynid\rewiimhi.exe
MD5
a292bdca006158fd2cc02e0c2293cbca

SHA1
6fd0976cb34cfe79a8a78542d5c86dab3c8cb378

SHA256
53656ceb9f5aed65e7a632f485e6807e2587a354d745978cf036ae14d942ae7a

SHA512
e8a6fb67d7227bd67a468975f423cc40b7540c8c6cd4fbeed3ed8be00a6f98d83580fd83db96b215dd5e7ff6847767eb81acb68033e2b453804cf343fdd33c76

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Ehwjynid\rewiimhi.exe
MD5
a292bdca006158fd2cc02e0c2293cbca

SHA1
6fd0976cb34cfe79a8a78542d5c86dab3c8cb378

SHA256
53656ceb9f5aed65e7a632f485e6807e2587a354d745978cf036ae14d942ae7a

SHA512
e8a6fb67d7227bd67a468975f423cc40b7540c8c6cd4fbeed3ed8be00a6f98d83580fd83db96b215dd5e7ff6847767eb81acb68033e2b453804cf343fdd33c76

Download Submit
memory/268-12-0x0000000000000000-mapping.dmp

Download
memory/904-6-0x0000000000000000-mapping.dmp

Download
memory/1256-0-0x0000000000000000-mapping.dmp

Download
memory/1256-1-0x00000000026D0000-0x00000000026E1000-memory.dmp

Filesize
68KB

Download
memory/1340-14-0x0000000000000000-mapping.dmp

Download
memory/1488-4-0x0000000000000000-mapping.dmp

Download
memory/1488-11-0x00000000003C0000-0x00000000003FA000-memory.dmp

Filesize
232KB

Download
memory/1580-8-0x0000000000000000-mapping.dmp

Download
memory/1580-10-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads