qakbot | 4ef522d3426001395a3acbdb2037cb3f8f79a91fc0ebfe235fac386d6b12257d

General

Target

krzcfi.exe
Size

1.0MB
MD5

3142cb390e6f2c895ed414cbd6b29c6d
SHA1

e61c794f7f825413ec4836b9f683b4265d98f142
SHA256

4ef522d3426001395a3acbdb2037cb3f8f79a91fc0ebfe235fac386d6b12257d
SHA512

4f4ddc24e8352005c5d9de6f11ddb13277596f67484b8db3213e1f7565002891930c92c1a216d55891d8a35882256041b14917fadbf69d21c94743ff8cf8d003

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

jsdlop.exejsdlop.exe

pid process

1792 jsdlop.exe
1500 jsdlop.exe
Loads dropped DLL 2 IoCs

Processes:

krzcfi.exe

pid process

1632 krzcfi.exe
1632 krzcfi.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1668 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

krzcfi.exekrzcfi.exejsdlop.exejsdlop.exeexplorer.exe

pid process

1632 krzcfi.exe
612 krzcfi.exe
612 krzcfi.exe
1792 jsdlop.exe
1500 jsdlop.exe
1500 jsdlop.exe
1004 explorer.exe
1004 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

jsdlop.exe

pid process

1792 jsdlop.exe

pid	process
1792	jsdlop.exe
1500	jsdlop.exe

pid	process
1632	krzcfi.exe
1632	krzcfi.exe

pid	process
1668	schtasks.exe

pid	process
1632	krzcfi.exe
612	krzcfi.exe
612	krzcfi.exe
1792	jsdlop.exe
1500	jsdlop.exe
1500	jsdlop.exe
1004	explorer.exe
1004	explorer.exe

pid	process
1792	jsdlop.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

krzcfi.exejsdlop.exetaskeng.exe

description	pid	process	target process
PID 1632 wrote to memory of 612	1632	krzcfi.exe	krzcfi.exe
PID 1632 wrote to memory of 612	1632	krzcfi.exe	krzcfi.exe
PID 1632 wrote to memory of 612	1632	krzcfi.exe	krzcfi.exe
PID 1632 wrote to memory of 612	1632	krzcfi.exe	krzcfi.exe
PID 1632 wrote to memory of 1792	1632	krzcfi.exe	jsdlop.exe
PID 1632 wrote to memory of 1792	1632	krzcfi.exe	jsdlop.exe
PID 1632 wrote to memory of 1792	1632	krzcfi.exe	jsdlop.exe
PID 1632 wrote to memory of 1792	1632	krzcfi.exe	jsdlop.exe
PID 1632 wrote to memory of 1668	1632	krzcfi.exe	schtasks.exe
PID 1632 wrote to memory of 1668	1632	krzcfi.exe	schtasks.exe
PID 1632 wrote to memory of 1668	1632	krzcfi.exe	schtasks.exe
PID 1632 wrote to memory of 1668	1632	krzcfi.exe	schtasks.exe
PID 1792 wrote to memory of 1500	1792	jsdlop.exe	jsdlop.exe
PID 1792 wrote to memory of 1500	1792	jsdlop.exe	jsdlop.exe
PID 1792 wrote to memory of 1500	1792	jsdlop.exe	jsdlop.exe
PID 1792 wrote to memory of 1500	1792	jsdlop.exe	jsdlop.exe
PID 1792 wrote to memory of 1004	1792	jsdlop.exe	explorer.exe
PID 1792 wrote to memory of 1004	1792	jsdlop.exe	explorer.exe
PID 1792 wrote to memory of 1004	1792	jsdlop.exe	explorer.exe
PID 1792 wrote to memory of 1004	1792	jsdlop.exe	explorer.exe
PID 1792 wrote to memory of 1004	1792	jsdlop.exe	explorer.exe
PID 1096 wrote to memory of 432	1096	taskeng.exe	krzcfi.exe
PID 1096 wrote to memory of 432	1096	taskeng.exe	krzcfi.exe
PID 1096 wrote to memory of 432	1096	taskeng.exe	krzcfi.exe
PID 1096 wrote to memory of 432	1096	taskeng.exe	krzcfi.exe

C:\Users\Admin\AppData\Local\Temp\krzcfi.exe
"C:\Users\Admin\AppData\Local\Temp\krzcfi.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\krzcfi.exe
C:\Users\Admin\AppData\Local\Temp\krzcfi.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:612

C:\Users\Admin\AppData\Roaming\Microsoft\Pujunee\jsdlop.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Pujunee\jsdlop.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1792

C:\Users\Admin\AppData\Roaming\Microsoft\Pujunee\jsdlop.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Pujunee\jsdlop.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1500

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1004

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yomyixbud /tr "\"C:\Users\Admin\AppData\Local\Temp\krzcfi.exe\" /I yomyixbud" /SC ONCE /Z /ST 15:48 /ET 16:00
2⤵
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\taskeng.exe
taskeng.exe {84CA954A-EF39-46DC-8561-4E735327D35F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\AppData\Local\Temp\krzcfi.exe
C:\Users\Admin\AppData\Local\Temp\krzcfi.exe /I yomyixbud
2⤵
PID:432

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Pujunee\jsdlop.dat
MD5
f3ecbc8b273da17106c1ddf038231a12

SHA1
309cd884e2365ccde7ac92edd9cd6ebf5746e677

SHA256
385bc2f909888a5af2eff524dd04ef463f3c11972714f20105eeadf2f68603c4

SHA512
182bc201d417a06d04050ba73881f494ddd63cda5ad36c9b672a5dbce4fab0b0f105b3b99fbb024b6b917d3eeb17bb6db12c65cea95dda64693c6eff2bab1144

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Pujunee\jsdlop.exe
MD5
3142cb390e6f2c895ed414cbd6b29c6d

SHA1
e61c794f7f825413ec4836b9f683b4265d98f142

SHA256
4ef522d3426001395a3acbdb2037cb3f8f79a91fc0ebfe235fac386d6b12257d

SHA512
4f4ddc24e8352005c5d9de6f11ddb13277596f67484b8db3213e1f7565002891930c92c1a216d55891d8a35882256041b14917fadbf69d21c94743ff8cf8d003

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Pujunee\jsdlop.exe
MD5
3142cb390e6f2c895ed414cbd6b29c6d

SHA1
e61c794f7f825413ec4836b9f683b4265d98f142

SHA256
4ef522d3426001395a3acbdb2037cb3f8f79a91fc0ebfe235fac386d6b12257d

SHA512
4f4ddc24e8352005c5d9de6f11ddb13277596f67484b8db3213e1f7565002891930c92c1a216d55891d8a35882256041b14917fadbf69d21c94743ff8cf8d003

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Pujunee\jsdlop.exe
MD5
3142cb390e6f2c895ed414cbd6b29c6d

SHA1
e61c794f7f825413ec4836b9f683b4265d98f142

SHA256
4ef522d3426001395a3acbdb2037cb3f8f79a91fc0ebfe235fac386d6b12257d

SHA512
4f4ddc24e8352005c5d9de6f11ddb13277596f67484b8db3213e1f7565002891930c92c1a216d55891d8a35882256041b14917fadbf69d21c94743ff8cf8d003

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Pujunee\jsdlop.exe
MD5
3142cb390e6f2c895ed414cbd6b29c6d

SHA1
e61c794f7f825413ec4836b9f683b4265d98f142

SHA256
4ef522d3426001395a3acbdb2037cb3f8f79a91fc0ebfe235fac386d6b12257d

SHA512
4f4ddc24e8352005c5d9de6f11ddb13277596f67484b8db3213e1f7565002891930c92c1a216d55891d8a35882256041b14917fadbf69d21c94743ff8cf8d003

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Pujunee\jsdlop.exe
MD5
3142cb390e6f2c895ed414cbd6b29c6d

SHA1
e61c794f7f825413ec4836b9f683b4265d98f142

SHA256
4ef522d3426001395a3acbdb2037cb3f8f79a91fc0ebfe235fac386d6b12257d

SHA512
4f4ddc24e8352005c5d9de6f11ddb13277596f67484b8db3213e1f7565002891930c92c1a216d55891d8a35882256041b14917fadbf69d21c94743ff8cf8d003

Download Submit
memory/432-14-0x0000000000000000-mapping.dmp

Download
memory/612-0-0x0000000000000000-mapping.dmp

Download
memory/612-1-0x00000000025E0000-0x00000000025F1000-memory.dmp

Filesize
68KB

Download
memory/1004-12-0x0000000000000000-mapping.dmp

Download
memory/1500-8-0x0000000000000000-mapping.dmp

Download
memory/1500-10-0x00000000025C0000-0x00000000025D1000-memory.dmp

Filesize
68KB

Download
memory/1668-6-0x0000000000000000-mapping.dmp

Download
memory/1792-4-0x0000000000000000-mapping.dmp

Download
memory/1792-11-0x0000000000330000-0x000000000036A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads