qakbot | d1aac94e49625f6b57d7db8621d5cf939d1e1593062113ff8a3d1b6f099b32d3

General

Target

ivfket.exe
Size

1.0MB
MD5

30bdbfef781b26e5ee3b21cb979e1c9d
SHA1

45e9eeba87ee3c064189756b090207ab98266639
SHA256

d1aac94e49625f6b57d7db8621d5cf939d1e1593062113ff8a3d1b6f099b32d3
SHA512

480af08f8976a04f824aa7cc1ab1cb403fb4d6fdc94c0878c71b05889c70e9c1b222769c8d8f6f82b17fa085d2c6b9c5ebcc59b5c0410474e06337fb6807c198

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

otvrf.exeotvrf.exe

pid process

1604 otvrf.exe
604 otvrf.exe
Loads dropped DLL 2 IoCs

Processes:

ivfket.exe

pid process

1128 ivfket.exe
1128 ivfket.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1540 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

ivfket.exeivfket.exeotvrf.exeotvrf.exeexplorer.exe

pid process

1128 ivfket.exe
1364 ivfket.exe
1364 ivfket.exe
1604 otvrf.exe
604 otvrf.exe
604 otvrf.exe
744 explorer.exe
744 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

otvrf.exe

pid process

1604 otvrf.exe

pid	process
1604	otvrf.exe
604	otvrf.exe

pid	process
1128	ivfket.exe
1128	ivfket.exe

pid	process
1540	schtasks.exe

pid	process
1128	ivfket.exe
1364	ivfket.exe
1364	ivfket.exe
1604	otvrf.exe
604	otvrf.exe
604	otvrf.exe
744	explorer.exe
744	explorer.exe

pid	process
1604	otvrf.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

ivfket.exeotvrf.exetaskeng.exe

description	pid	process	target process
PID 1128 wrote to memory of 1364	1128	ivfket.exe	ivfket.exe
PID 1128 wrote to memory of 1364	1128	ivfket.exe	ivfket.exe
PID 1128 wrote to memory of 1364	1128	ivfket.exe	ivfket.exe
PID 1128 wrote to memory of 1364	1128	ivfket.exe	ivfket.exe
PID 1128 wrote to memory of 1604	1128	ivfket.exe	otvrf.exe
PID 1128 wrote to memory of 1604	1128	ivfket.exe	otvrf.exe
PID 1128 wrote to memory of 1604	1128	ivfket.exe	otvrf.exe
PID 1128 wrote to memory of 1604	1128	ivfket.exe	otvrf.exe
PID 1128 wrote to memory of 1540	1128	ivfket.exe	schtasks.exe
PID 1128 wrote to memory of 1540	1128	ivfket.exe	schtasks.exe
PID 1128 wrote to memory of 1540	1128	ivfket.exe	schtasks.exe
PID 1128 wrote to memory of 1540	1128	ivfket.exe	schtasks.exe
PID 1604 wrote to memory of 604	1604	otvrf.exe	otvrf.exe
PID 1604 wrote to memory of 604	1604	otvrf.exe	otvrf.exe
PID 1604 wrote to memory of 604	1604	otvrf.exe	otvrf.exe
PID 1604 wrote to memory of 604	1604	otvrf.exe	otvrf.exe
PID 1604 wrote to memory of 744	1604	otvrf.exe	explorer.exe
PID 1604 wrote to memory of 744	1604	otvrf.exe	explorer.exe
PID 1604 wrote to memory of 744	1604	otvrf.exe	explorer.exe
PID 1604 wrote to memory of 744	1604	otvrf.exe	explorer.exe
PID 1604 wrote to memory of 744	1604	otvrf.exe	explorer.exe
PID 860 wrote to memory of 544	860	taskeng.exe	ivfket.exe
PID 860 wrote to memory of 544	860	taskeng.exe	ivfket.exe
PID 860 wrote to memory of 544	860	taskeng.exe	ivfket.exe
PID 860 wrote to memory of 544	860	taskeng.exe	ivfket.exe

C:\Users\Admin\AppData\Local\Temp\ivfket.exe
"C:\Users\Admin\AppData\Local\Temp\ivfket.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1128

C:\Users\Admin\AppData\Local\Temp\ivfket.exe
C:\Users\Admin\AppData\Local\Temp\ivfket.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1364

C:\Users\Admin\AppData\Roaming\Microsoft\Wqkers\otvrf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Wqkers\otvrf.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1604

C:\Users\Admin\AppData\Roaming\Microsoft\Wqkers\otvrf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Wqkers\otvrf.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:604

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:744

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yospbehtmp /tr "\"C:\Users\Admin\AppData\Local\Temp\ivfket.exe\" /I yospbehtmp" /SC ONCE /Z /ST 15:39 /ET 15:51
2⤵
- Creates scheduled task(s)
PID:1540

C:\Windows\system32\taskeng.exe
taskeng.exe {B2E260FF-CE13-49F5-BDA3-AC53F32CA64D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:860

C:\Users\Admin\AppData\Local\Temp\ivfket.exe
C:\Users\Admin\AppData\Local\Temp\ivfket.exe /I yospbehtmp
2⤵
PID:544

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Wqkers\otvrf.dat
MD5
6c045a3aa99d0907075b8c7c14156f5a

SHA1
23044a1efb8c5442025882117b95db35618776d9

SHA256
9343e85990d431ef03d2951857ee7ed477e0da487a25a0dc4f63aac970329d94

SHA512
926ed325a7ae037856f863178b928654d607b0c2db4b892530acac14654448b5d760ecfc9d78ce98e9793d5575d408dc634309e7b3e103d3326e05db7fc54c5c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Wqkers\otvrf.exe
MD5
30bdbfef781b26e5ee3b21cb979e1c9d

SHA1
45e9eeba87ee3c064189756b090207ab98266639

SHA256
d1aac94e49625f6b57d7db8621d5cf939d1e1593062113ff8a3d1b6f099b32d3

SHA512
480af08f8976a04f824aa7cc1ab1cb403fb4d6fdc94c0878c71b05889c70e9c1b222769c8d8f6f82b17fa085d2c6b9c5ebcc59b5c0410474e06337fb6807c198

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Wqkers\otvrf.exe
MD5
30bdbfef781b26e5ee3b21cb979e1c9d

SHA1
45e9eeba87ee3c064189756b090207ab98266639

SHA256
d1aac94e49625f6b57d7db8621d5cf939d1e1593062113ff8a3d1b6f099b32d3

SHA512
480af08f8976a04f824aa7cc1ab1cb403fb4d6fdc94c0878c71b05889c70e9c1b222769c8d8f6f82b17fa085d2c6b9c5ebcc59b5c0410474e06337fb6807c198

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Wqkers\otvrf.exe
MD5
30bdbfef781b26e5ee3b21cb979e1c9d

SHA1
45e9eeba87ee3c064189756b090207ab98266639

SHA256
d1aac94e49625f6b57d7db8621d5cf939d1e1593062113ff8a3d1b6f099b32d3

SHA512
480af08f8976a04f824aa7cc1ab1cb403fb4d6fdc94c0878c71b05889c70e9c1b222769c8d8f6f82b17fa085d2c6b9c5ebcc59b5c0410474e06337fb6807c198

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Wqkers\otvrf.exe
MD5
30bdbfef781b26e5ee3b21cb979e1c9d

SHA1
45e9eeba87ee3c064189756b090207ab98266639

SHA256
d1aac94e49625f6b57d7db8621d5cf939d1e1593062113ff8a3d1b6f099b32d3

SHA512
480af08f8976a04f824aa7cc1ab1cb403fb4d6fdc94c0878c71b05889c70e9c1b222769c8d8f6f82b17fa085d2c6b9c5ebcc59b5c0410474e06337fb6807c198

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Wqkers\otvrf.exe
MD5
30bdbfef781b26e5ee3b21cb979e1c9d

SHA1
45e9eeba87ee3c064189756b090207ab98266639

SHA256
d1aac94e49625f6b57d7db8621d5cf939d1e1593062113ff8a3d1b6f099b32d3

SHA512
480af08f8976a04f824aa7cc1ab1cb403fb4d6fdc94c0878c71b05889c70e9c1b222769c8d8f6f82b17fa085d2c6b9c5ebcc59b5c0410474e06337fb6807c198

Download Submit
memory/544-14-0x0000000000000000-mapping.dmp

Download
memory/604-8-0x0000000000000000-mapping.dmp

Download
memory/604-10-0x0000000002590000-0x00000000025A1000-memory.dmp

Filesize
68KB

Download
memory/744-12-0x0000000000000000-mapping.dmp

Download
memory/1364-0-0x0000000000000000-mapping.dmp

Download
memory/1364-1-0x00000000026A0000-0x00000000026B1000-memory.dmp

Filesize
68KB

Download
memory/1540-6-0x0000000000000000-mapping.dmp

Download
memory/1604-4-0x0000000000000000-mapping.dmp

Download
memory/1604-11-0x00000000024D0000-0x000000000250A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads