qakbot | e2ef4aa79c8551f10dad20864d099e06763d45a6ac44f85f1a3e336e03e54853

General

Target

rgxbyw.exe
Size

1.0MB
MD5

ac98794fe0731fa2dd1e52262ac8ca29
SHA1

ef428539087cc89cc15aa66efccd606c20c1cc36
SHA256

e2ef4aa79c8551f10dad20864d099e06763d45a6ac44f85f1a3e336e03e54853
SHA512

e66a2ff7432b82c2c054ea25d56e8fe357c496ee0b51c8ccbf9eb04dfdf2b7698330c93080b816d86e08f9ada78c24cdd668e27d60d3e7fc42a8d93dc96c1a6a

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

uewhdqf.exeuewhdqf.exe

pid process

1064 uewhdqf.exe
1372 uewhdqf.exe
Loads dropped DLL 2 IoCs

Processes:

rgxbyw.exe

pid process

1764 rgxbyw.exe
1764 rgxbyw.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2044 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

rgxbyw.exergxbyw.exeuewhdqf.exeuewhdqf.exeexplorer.exergxbyw.exe

pid process

1764 rgxbyw.exe
1800 rgxbyw.exe
1800 rgxbyw.exe
1064 uewhdqf.exe
1372 uewhdqf.exe
1372 uewhdqf.exe
1308 explorer.exe
1308 explorer.exe
1152 rgxbyw.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

uewhdqf.exe

pid process

1064 uewhdqf.exe

pid	process
1064	uewhdqf.exe
1372	uewhdqf.exe

pid	process
1764	rgxbyw.exe
1764	rgxbyw.exe

pid	process
2044	schtasks.exe

pid	process
1764	rgxbyw.exe
1800	rgxbyw.exe
1800	rgxbyw.exe
1064	uewhdqf.exe
1372	uewhdqf.exe
1372	uewhdqf.exe
1308	explorer.exe
1308	explorer.exe
1152	rgxbyw.exe

pid	process
1064	uewhdqf.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

rgxbyw.exeuewhdqf.exetaskeng.exe

description	pid	process	target process
PID 1764 wrote to memory of 1800	1764	rgxbyw.exe	rgxbyw.exe
PID 1764 wrote to memory of 1800	1764	rgxbyw.exe	rgxbyw.exe
PID 1764 wrote to memory of 1800	1764	rgxbyw.exe	rgxbyw.exe
PID 1764 wrote to memory of 1800	1764	rgxbyw.exe	rgxbyw.exe
PID 1764 wrote to memory of 1064	1764	rgxbyw.exe	uewhdqf.exe
PID 1764 wrote to memory of 1064	1764	rgxbyw.exe	uewhdqf.exe
PID 1764 wrote to memory of 1064	1764	rgxbyw.exe	uewhdqf.exe
PID 1764 wrote to memory of 1064	1764	rgxbyw.exe	uewhdqf.exe
PID 1764 wrote to memory of 2044	1764	rgxbyw.exe	schtasks.exe
PID 1764 wrote to memory of 2044	1764	rgxbyw.exe	schtasks.exe
PID 1764 wrote to memory of 2044	1764	rgxbyw.exe	schtasks.exe
PID 1764 wrote to memory of 2044	1764	rgxbyw.exe	schtasks.exe
PID 1064 wrote to memory of 1372	1064	uewhdqf.exe	uewhdqf.exe
PID 1064 wrote to memory of 1372	1064	uewhdqf.exe	uewhdqf.exe
PID 1064 wrote to memory of 1372	1064	uewhdqf.exe	uewhdqf.exe
PID 1064 wrote to memory of 1372	1064	uewhdqf.exe	uewhdqf.exe
PID 1064 wrote to memory of 1308	1064	uewhdqf.exe	explorer.exe
PID 1064 wrote to memory of 1308	1064	uewhdqf.exe	explorer.exe
PID 1064 wrote to memory of 1308	1064	uewhdqf.exe	explorer.exe
PID 1064 wrote to memory of 1308	1064	uewhdqf.exe	explorer.exe
PID 1064 wrote to memory of 1308	1064	uewhdqf.exe	explorer.exe
PID 928 wrote to memory of 1152	928	taskeng.exe	rgxbyw.exe
PID 928 wrote to memory of 1152	928	taskeng.exe	rgxbyw.exe
PID 928 wrote to memory of 1152	928	taskeng.exe	rgxbyw.exe
PID 928 wrote to memory of 1152	928	taskeng.exe	rgxbyw.exe

C:\Users\Admin\AppData\Local\Temp\rgxbyw.exe
"C:\Users\Admin\AppData\Local\Temp\rgxbyw.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1764

C:\Users\Admin\AppData\Local\Temp\rgxbyw.exe
C:\Users\Admin\AppData\Local\Temp\rgxbyw.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1800

C:\Users\Admin\AppData\Roaming\Microsoft\Scnnvaszdxo\uewhdqf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Scnnvaszdxo\uewhdqf.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1064

C:\Users\Admin\AppData\Roaming\Microsoft\Scnnvaszdxo\uewhdqf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Scnnvaszdxo\uewhdqf.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1372

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1308

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xlvldndf /tr "\"C:\Users\Admin\AppData\Local\Temp\rgxbyw.exe\" /I xlvldndf" /SC ONCE /Z /ST 15:47 /ET 15:59
2⤵
- Creates scheduled task(s)
PID:2044

C:\Windows\system32\taskeng.exe
taskeng.exe {EA22C685-5E8E-4A40-855C-555833081082} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:928

C:\Users\Admin\AppData\Local\Temp\rgxbyw.exe
C:\Users\Admin\AppData\Local\Temp\rgxbyw.exe /I xlvldndf
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1152

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Scnnvaszdxo\uewhdqf.dat
MD5
a2fcd1b7023f1fbb1a6b83ace293cd98

SHA1
f43af40970ffab1547d16cf6d9d2fd8bab9e3c53

SHA256
274bb46e2b80a87ddd3d4945a2a115d9fa3ed13c5c651927afad0b0ed7cf278a

SHA512
743048b83261c97e466216f465d9343615654b8d97c9ea6a461b826cd19977baa0ec8be02b2d6f3de8c5750b05bdcf57384d65868adb13468bff9e8f2a85f3ac

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Scnnvaszdxo\uewhdqf.exe
MD5
ac98794fe0731fa2dd1e52262ac8ca29

SHA1
ef428539087cc89cc15aa66efccd606c20c1cc36

SHA256
e2ef4aa79c8551f10dad20864d099e06763d45a6ac44f85f1a3e336e03e54853

SHA512
e66a2ff7432b82c2c054ea25d56e8fe357c496ee0b51c8ccbf9eb04dfdf2b7698330c93080b816d86e08f9ada78c24cdd668e27d60d3e7fc42a8d93dc96c1a6a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Scnnvaszdxo\uewhdqf.exe
MD5
ac98794fe0731fa2dd1e52262ac8ca29

SHA1
ef428539087cc89cc15aa66efccd606c20c1cc36

SHA256
e2ef4aa79c8551f10dad20864d099e06763d45a6ac44f85f1a3e336e03e54853

SHA512
e66a2ff7432b82c2c054ea25d56e8fe357c496ee0b51c8ccbf9eb04dfdf2b7698330c93080b816d86e08f9ada78c24cdd668e27d60d3e7fc42a8d93dc96c1a6a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Scnnvaszdxo\uewhdqf.exe
MD5
ac98794fe0731fa2dd1e52262ac8ca29

SHA1
ef428539087cc89cc15aa66efccd606c20c1cc36

SHA256
e2ef4aa79c8551f10dad20864d099e06763d45a6ac44f85f1a3e336e03e54853

SHA512
e66a2ff7432b82c2c054ea25d56e8fe357c496ee0b51c8ccbf9eb04dfdf2b7698330c93080b816d86e08f9ada78c24cdd668e27d60d3e7fc42a8d93dc96c1a6a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Scnnvaszdxo\uewhdqf.exe
MD5
ac98794fe0731fa2dd1e52262ac8ca29

SHA1
ef428539087cc89cc15aa66efccd606c20c1cc36

SHA256
e2ef4aa79c8551f10dad20864d099e06763d45a6ac44f85f1a3e336e03e54853

SHA512
e66a2ff7432b82c2c054ea25d56e8fe357c496ee0b51c8ccbf9eb04dfdf2b7698330c93080b816d86e08f9ada78c24cdd668e27d60d3e7fc42a8d93dc96c1a6a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Scnnvaszdxo\uewhdqf.exe
MD5
ac98794fe0731fa2dd1e52262ac8ca29

SHA1
ef428539087cc89cc15aa66efccd606c20c1cc36

SHA256
e2ef4aa79c8551f10dad20864d099e06763d45a6ac44f85f1a3e336e03e54853

SHA512
e66a2ff7432b82c2c054ea25d56e8fe357c496ee0b51c8ccbf9eb04dfdf2b7698330c93080b816d86e08f9ada78c24cdd668e27d60d3e7fc42a8d93dc96c1a6a

Download Submit
memory/1064-4-0x0000000000000000-mapping.dmp

Download
memory/1064-11-0x0000000002500000-0x000000000253A000-memory.dmp

Filesize
232KB

Download
memory/1152-14-0x0000000000000000-mapping.dmp

Download
memory/1308-12-0x0000000000000000-mapping.dmp

Download
memory/1372-8-0x0000000000000000-mapping.dmp

Download
memory/1372-10-0x0000000002610000-0x0000000002621000-memory.dmp

Filesize
68KB

Download
memory/1800-0-0x0000000000000000-mapping.dmp

Download
memory/1800-1-0x0000000002580000-0x0000000002591000-memory.dmp

Filesize
68KB

Download
memory/2044-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads