qakbot | ff8bc1b83e0205a005ebd6500e78d0d9216d52e240b180aebc8f8fdd577b0062

General

Target

miedvs.exe
Size

1.0MB
MD5

2d6cad1004799967e120d439ee3b2c24
SHA1

0bf55530d598c6afa34ffafa39488b1132179be2
SHA256

ff8bc1b83e0205a005ebd6500e78d0d9216d52e240b180aebc8f8fdd577b0062
SHA512

2ed248a4699978f47500b7931310ca48d9214aab213850a99929a0253b39cf538aaa9c4c63f8ee3bdc3e43a194e2866471efff6f21e03d61c0e097ec2efc74d1

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

ybuzv.exeybuzv.exe

pid process

1524 ybuzv.exe
332 ybuzv.exe
Loads dropped DLL 2 IoCs

Processes:

miedvs.exe

pid process

484 miedvs.exe
484 miedvs.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1676 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

miedvs.exemiedvs.exeybuzv.exeybuzv.exeexplorer.exemiedvs.exe

pid process

484 miedvs.exe
1268 miedvs.exe
1268 miedvs.exe
1524 ybuzv.exe
332 ybuzv.exe
332 ybuzv.exe
756 explorer.exe
756 explorer.exe
1632 miedvs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ybuzv.exe

pid process

1524 ybuzv.exe

pid	process
1524	ybuzv.exe
332	ybuzv.exe

pid	process
484	miedvs.exe
484	miedvs.exe

pid	process
1676	schtasks.exe

pid	process
484	miedvs.exe
1268	miedvs.exe
1268	miedvs.exe
1524	ybuzv.exe
332	ybuzv.exe
332	ybuzv.exe
756	explorer.exe
756	explorer.exe
1632	miedvs.exe

pid	process
1524	ybuzv.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

miedvs.exeybuzv.exetaskeng.exe

description	pid	process	target process
PID 484 wrote to memory of 1268	484	miedvs.exe	miedvs.exe
PID 484 wrote to memory of 1268	484	miedvs.exe	miedvs.exe
PID 484 wrote to memory of 1268	484	miedvs.exe	miedvs.exe
PID 484 wrote to memory of 1268	484	miedvs.exe	miedvs.exe
PID 484 wrote to memory of 1524	484	miedvs.exe	ybuzv.exe
PID 484 wrote to memory of 1524	484	miedvs.exe	ybuzv.exe
PID 484 wrote to memory of 1524	484	miedvs.exe	ybuzv.exe
PID 484 wrote to memory of 1524	484	miedvs.exe	ybuzv.exe
PID 484 wrote to memory of 1676	484	miedvs.exe	schtasks.exe
PID 484 wrote to memory of 1676	484	miedvs.exe	schtasks.exe
PID 484 wrote to memory of 1676	484	miedvs.exe	schtasks.exe
PID 484 wrote to memory of 1676	484	miedvs.exe	schtasks.exe
PID 1524 wrote to memory of 332	1524	ybuzv.exe	ybuzv.exe
PID 1524 wrote to memory of 332	1524	ybuzv.exe	ybuzv.exe
PID 1524 wrote to memory of 332	1524	ybuzv.exe	ybuzv.exe
PID 1524 wrote to memory of 332	1524	ybuzv.exe	ybuzv.exe
PID 1524 wrote to memory of 756	1524	ybuzv.exe	explorer.exe
PID 1524 wrote to memory of 756	1524	ybuzv.exe	explorer.exe
PID 1524 wrote to memory of 756	1524	ybuzv.exe	explorer.exe
PID 1524 wrote to memory of 756	1524	ybuzv.exe	explorer.exe
PID 1524 wrote to memory of 756	1524	ybuzv.exe	explorer.exe
PID 1016 wrote to memory of 1632	1016	taskeng.exe	miedvs.exe
PID 1016 wrote to memory of 1632	1016	taskeng.exe	miedvs.exe
PID 1016 wrote to memory of 1632	1016	taskeng.exe	miedvs.exe
PID 1016 wrote to memory of 1632	1016	taskeng.exe	miedvs.exe

C:\Users\Admin\AppData\Local\Temp\miedvs.exe
"C:\Users\Admin\AppData\Local\Temp\miedvs.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:484

C:\Users\Admin\AppData\Local\Temp\miedvs.exe
C:\Users\Admin\AppData\Local\Temp\miedvs.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1268

C:\Users\Admin\AppData\Roaming\Microsoft\Naejljf\ybuzv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Naejljf\ybuzv.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1524

C:\Users\Admin\AppData\Roaming\Microsoft\Naejljf\ybuzv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Naejljf\ybuzv.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:332

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:756

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hzitbbe /tr "\"C:\Users\Admin\AppData\Local\Temp\miedvs.exe\" /I hzitbbe" /SC ONCE /Z /ST 14:40 /ET 14:52
2⤵
- Creates scheduled task(s)
PID:1676

C:\Windows\system32\taskeng.exe
taskeng.exe {275AC778-68F8-43BD-9715-34A8BC199641} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1016

C:\Users\Admin\AppData\Local\Temp\miedvs.exe
C:\Users\Admin\AppData\Local\Temp\miedvs.exe /I hzitbbe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1632

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Naejljf\ybuzv.dat
MD5
24085d0fbe8599e2a7514c3864eb5a79

SHA1
207810addfb83485c8e4f8617d87bf3128f0a343

SHA256
a5e2656443ed70ef71e7cce9334309ebcac7acd58e384c79c81aaabfb259b687

SHA512
11ed60506f42c40c383fb133cfa8e332dbc4c6ae430b662222f8827eee8501094fa0f30f2496e4a5ce00682ba74e10131cfeb3784d8e7ebc8a857f1e43e1fa15

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Naejljf\ybuzv.exe
MD5
2d6cad1004799967e120d439ee3b2c24

SHA1
0bf55530d598c6afa34ffafa39488b1132179be2

SHA256
ff8bc1b83e0205a005ebd6500e78d0d9216d52e240b180aebc8f8fdd577b0062

SHA512
2ed248a4699978f47500b7931310ca48d9214aab213850a99929a0253b39cf538aaa9c4c63f8ee3bdc3e43a194e2866471efff6f21e03d61c0e097ec2efc74d1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Naejljf\ybuzv.exe
MD5
2d6cad1004799967e120d439ee3b2c24

SHA1
0bf55530d598c6afa34ffafa39488b1132179be2

SHA256
ff8bc1b83e0205a005ebd6500e78d0d9216d52e240b180aebc8f8fdd577b0062

SHA512
2ed248a4699978f47500b7931310ca48d9214aab213850a99929a0253b39cf538aaa9c4c63f8ee3bdc3e43a194e2866471efff6f21e03d61c0e097ec2efc74d1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Naejljf\ybuzv.exe
MD5
2d6cad1004799967e120d439ee3b2c24

SHA1
0bf55530d598c6afa34ffafa39488b1132179be2

SHA256
ff8bc1b83e0205a005ebd6500e78d0d9216d52e240b180aebc8f8fdd577b0062

SHA512
2ed248a4699978f47500b7931310ca48d9214aab213850a99929a0253b39cf538aaa9c4c63f8ee3bdc3e43a194e2866471efff6f21e03d61c0e097ec2efc74d1

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Naejljf\ybuzv.exe
MD5
2d6cad1004799967e120d439ee3b2c24

SHA1
0bf55530d598c6afa34ffafa39488b1132179be2

SHA256
ff8bc1b83e0205a005ebd6500e78d0d9216d52e240b180aebc8f8fdd577b0062

SHA512
2ed248a4699978f47500b7931310ca48d9214aab213850a99929a0253b39cf538aaa9c4c63f8ee3bdc3e43a194e2866471efff6f21e03d61c0e097ec2efc74d1

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Naejljf\ybuzv.exe
MD5
2d6cad1004799967e120d439ee3b2c24

SHA1
0bf55530d598c6afa34ffafa39488b1132179be2

SHA256
ff8bc1b83e0205a005ebd6500e78d0d9216d52e240b180aebc8f8fdd577b0062

SHA512
2ed248a4699978f47500b7931310ca48d9214aab213850a99929a0253b39cf538aaa9c4c63f8ee3bdc3e43a194e2866471efff6f21e03d61c0e097ec2efc74d1

Download Submit
memory/332-8-0x0000000000000000-mapping.dmp

Download
memory/332-10-0x0000000002500000-0x0000000002511000-memory.dmp

Filesize
68KB

Download
memory/756-12-0x0000000000000000-mapping.dmp

Download
memory/1268-0-0x0000000000000000-mapping.dmp

Download
memory/1268-1-0x0000000002530000-0x0000000002541000-memory.dmp

Filesize
68KB

Download
memory/1524-11-0x0000000001E70000-0x0000000001EAA000-memory.dmp

Filesize
232KB

Download
memory/1524-4-0x0000000000000000-mapping.dmp

Download
memory/1632-15-0x0000000000000000-mapping.dmp

Download
memory/1676-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads