qakbot | 41d658180fe32196696b83474391c9b6dcea953e8b99289152b23a50e3d143cb

General

Target

wegbdg.exe
Size

1.0MB
MD5

6f41291d40a7aa2dc3ab118390709df8
SHA1

dfc63029cd98667e92dd50c0e0e6a9c2c6593c50
SHA256

41d658180fe32196696b83474391c9b6dcea953e8b99289152b23a50e3d143cb
SHA512

759030b0ecc8227108cdc201ffaf2a77c865ade9a326a29bf43fcaa87284f5082789446f7669411786c3a8e8fc0dacd847b7289224df39b2e51e8f01be593d62

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

myhqlks.exemyhqlks.exe

pid process

1660 myhqlks.exe
1808 myhqlks.exe
Loads dropped DLL 2 IoCs

Processes:

wegbdg.exe

pid process

1032 wegbdg.exe
1032 wegbdg.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1620 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

wegbdg.exewegbdg.exemyhqlks.exemyhqlks.exeexplorer.exewegbdg.exe

pid process

1032 wegbdg.exe
1512 wegbdg.exe
1512 wegbdg.exe
1660 myhqlks.exe
1808 myhqlks.exe
1808 myhqlks.exe
1484 explorer.exe
1484 explorer.exe
556 wegbdg.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

myhqlks.exe

pid process

1660 myhqlks.exe

pid	process
1660	myhqlks.exe
1808	myhqlks.exe

pid	process
1032	wegbdg.exe
1032	wegbdg.exe

pid	process
1620	schtasks.exe

pid	process
1032	wegbdg.exe
1512	wegbdg.exe
1512	wegbdg.exe
1660	myhqlks.exe
1808	myhqlks.exe
1808	myhqlks.exe
1484	explorer.exe
1484	explorer.exe
556	wegbdg.exe

pid	process
1660	myhqlks.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

wegbdg.exemyhqlks.exetaskeng.exe

description	pid	process	target process
PID 1032 wrote to memory of 1512	1032	wegbdg.exe	wegbdg.exe
PID 1032 wrote to memory of 1512	1032	wegbdg.exe	wegbdg.exe
PID 1032 wrote to memory of 1512	1032	wegbdg.exe	wegbdg.exe
PID 1032 wrote to memory of 1512	1032	wegbdg.exe	wegbdg.exe
PID 1032 wrote to memory of 1660	1032	wegbdg.exe	myhqlks.exe
PID 1032 wrote to memory of 1660	1032	wegbdg.exe	myhqlks.exe
PID 1032 wrote to memory of 1660	1032	wegbdg.exe	myhqlks.exe
PID 1032 wrote to memory of 1660	1032	wegbdg.exe	myhqlks.exe
PID 1032 wrote to memory of 1620	1032	wegbdg.exe	schtasks.exe
PID 1032 wrote to memory of 1620	1032	wegbdg.exe	schtasks.exe
PID 1032 wrote to memory of 1620	1032	wegbdg.exe	schtasks.exe
PID 1032 wrote to memory of 1620	1032	wegbdg.exe	schtasks.exe
PID 1660 wrote to memory of 1808	1660	myhqlks.exe	myhqlks.exe
PID 1660 wrote to memory of 1808	1660	myhqlks.exe	myhqlks.exe
PID 1660 wrote to memory of 1808	1660	myhqlks.exe	myhqlks.exe
PID 1660 wrote to memory of 1808	1660	myhqlks.exe	myhqlks.exe
PID 1660 wrote to memory of 1484	1660	myhqlks.exe	explorer.exe
PID 1660 wrote to memory of 1484	1660	myhqlks.exe	explorer.exe
PID 1660 wrote to memory of 1484	1660	myhqlks.exe	explorer.exe
PID 1660 wrote to memory of 1484	1660	myhqlks.exe	explorer.exe
PID 1660 wrote to memory of 1484	1660	myhqlks.exe	explorer.exe
PID 776 wrote to memory of 556	776	taskeng.exe	wegbdg.exe
PID 776 wrote to memory of 556	776	taskeng.exe	wegbdg.exe
PID 776 wrote to memory of 556	776	taskeng.exe	wegbdg.exe
PID 776 wrote to memory of 556	776	taskeng.exe	wegbdg.exe

C:\Users\Admin\AppData\Local\Temp\wegbdg.exe
"C:\Users\Admin\AppData\Local\Temp\wegbdg.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1032

C:\Users\Admin\AppData\Local\Temp\wegbdg.exe
C:\Users\Admin\AppData\Local\Temp\wegbdg.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1512

C:\Users\Admin\AppData\Roaming\Microsoft\Aywoour\myhqlks.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Aywoour\myhqlks.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1660

C:\Users\Admin\AppData\Roaming\Microsoft\Aywoour\myhqlks.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Aywoour\myhqlks.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1808

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1484

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lsvefiopo /tr "\"C:\Users\Admin\AppData\Local\Temp\wegbdg.exe\" /I lsvefiopo" /SC ONCE /Z /ST 15:47 /ET 15:59
2⤵
- Creates scheduled task(s)
PID:1620

C:\Windows\system32\taskeng.exe
taskeng.exe {4C6BD3DA-9726-4AA1-AA3E-775C1526F91B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Users\Admin\AppData\Local\Temp\wegbdg.exe
C:\Users\Admin\AppData\Local\Temp\wegbdg.exe /I lsvefiopo
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:556

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Aywoour\myhqlks.dat
MD5
e1f90cac302965244046c9490df90c91

SHA1
9fe291dafe8781f21d9af4189e4aeabc337b470a

SHA256
85852f7932212a20437312f7ac4dc8d7407828a532a8df43620f93f1ea382b6f

SHA512
5a763280779804a7d401546b3fc01553d7655fe958df66922f047ebf826b150ffb337c12ec17288b4de286c880429b603a88b723e2a9519e97bdf4aad84d5b23

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Aywoour\myhqlks.exe
MD5
6f41291d40a7aa2dc3ab118390709df8

SHA1
dfc63029cd98667e92dd50c0e0e6a9c2c6593c50

SHA256
41d658180fe32196696b83474391c9b6dcea953e8b99289152b23a50e3d143cb

SHA512
759030b0ecc8227108cdc201ffaf2a77c865ade9a326a29bf43fcaa87284f5082789446f7669411786c3a8e8fc0dacd847b7289224df39b2e51e8f01be593d62

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Aywoour\myhqlks.exe
MD5
6f41291d40a7aa2dc3ab118390709df8

SHA1
dfc63029cd98667e92dd50c0e0e6a9c2c6593c50

SHA256
41d658180fe32196696b83474391c9b6dcea953e8b99289152b23a50e3d143cb

SHA512
759030b0ecc8227108cdc201ffaf2a77c865ade9a326a29bf43fcaa87284f5082789446f7669411786c3a8e8fc0dacd847b7289224df39b2e51e8f01be593d62

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Aywoour\myhqlks.exe
MD5
6f41291d40a7aa2dc3ab118390709df8

SHA1
dfc63029cd98667e92dd50c0e0e6a9c2c6593c50

SHA256
41d658180fe32196696b83474391c9b6dcea953e8b99289152b23a50e3d143cb

SHA512
759030b0ecc8227108cdc201ffaf2a77c865ade9a326a29bf43fcaa87284f5082789446f7669411786c3a8e8fc0dacd847b7289224df39b2e51e8f01be593d62

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Aywoour\myhqlks.exe
MD5
6f41291d40a7aa2dc3ab118390709df8

SHA1
dfc63029cd98667e92dd50c0e0e6a9c2c6593c50

SHA256
41d658180fe32196696b83474391c9b6dcea953e8b99289152b23a50e3d143cb

SHA512
759030b0ecc8227108cdc201ffaf2a77c865ade9a326a29bf43fcaa87284f5082789446f7669411786c3a8e8fc0dacd847b7289224df39b2e51e8f01be593d62

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Aywoour\myhqlks.exe
MD5
6f41291d40a7aa2dc3ab118390709df8

SHA1
dfc63029cd98667e92dd50c0e0e6a9c2c6593c50

SHA256
41d658180fe32196696b83474391c9b6dcea953e8b99289152b23a50e3d143cb

SHA512
759030b0ecc8227108cdc201ffaf2a77c865ade9a326a29bf43fcaa87284f5082789446f7669411786c3a8e8fc0dacd847b7289224df39b2e51e8f01be593d62

Download Submit
memory/556-14-0x0000000000000000-mapping.dmp

Download
memory/1484-12-0x0000000000000000-mapping.dmp

Download
memory/1512-1-0x00000000025E0000-0x00000000025F1000-memory.dmp

Filesize
68KB

Download
memory/1512-0-0x0000000000000000-mapping.dmp

Download
memory/1620-6-0x0000000000000000-mapping.dmp

Download
memory/1660-11-0x0000000000610000-0x000000000064A000-memory.dmp

Filesize
232KB

Download
memory/1660-4-0x0000000000000000-mapping.dmp

Download
memory/1808-10-0x0000000002620000-0x0000000002631000-memory.dmp

Filesize
68KB

Download
memory/1808-8-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads