qakbot | ef10467e404390bf1097103ff154636911734a8eaa93c3de12a76391e20ddbd5

General

Target

vucogl.exe
Size

1.0MB
MD5

96b58cf3de718c5837100e30980bb024
SHA1

9266451c3c831cee79db0c6e06e360fc48309e47
SHA256

ef10467e404390bf1097103ff154636911734a8eaa93c3de12a76391e20ddbd5
SHA512

59c76459bc8456bcfc364e27f815030dd89272129abcd601ee0b216f9652a11f1ad86de80617a5dab2cc14dcf49daafb5c33a110db7020a244d471cf4b77b1f2

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

elwav.exeelwav.exe

pid process

1224 elwav.exe
1832 elwav.exe
Loads dropped DLL 2 IoCs

Processes:

vucogl.exe

pid process

1776 vucogl.exe
1776 vucogl.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1084 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

vucogl.exevucogl.exeelwav.exeelwav.exeexplorer.exevucogl.exe

pid process

1776 vucogl.exe
616 vucogl.exe
616 vucogl.exe
1224 elwav.exe
1832 elwav.exe
1832 elwav.exe
1056 explorer.exe
1056 explorer.exe
1764 vucogl.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

elwav.exe

pid process

1224 elwav.exe

pid	process
1224	elwav.exe
1832	elwav.exe

pid	process
1776	vucogl.exe
1776	vucogl.exe

pid	process
1084	schtasks.exe

pid	process
1776	vucogl.exe
616	vucogl.exe
616	vucogl.exe
1224	elwav.exe
1832	elwav.exe
1832	elwav.exe
1056	explorer.exe
1056	explorer.exe
1764	vucogl.exe

pid	process
1224	elwav.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

vucogl.exeelwav.exetaskeng.exe

description	pid	process	target process
PID 1776 wrote to memory of 616	1776	vucogl.exe	vucogl.exe
PID 1776 wrote to memory of 616	1776	vucogl.exe	vucogl.exe
PID 1776 wrote to memory of 616	1776	vucogl.exe	vucogl.exe
PID 1776 wrote to memory of 616	1776	vucogl.exe	vucogl.exe
PID 1776 wrote to memory of 1224	1776	vucogl.exe	elwav.exe
PID 1776 wrote to memory of 1224	1776	vucogl.exe	elwav.exe
PID 1776 wrote to memory of 1224	1776	vucogl.exe	elwav.exe
PID 1776 wrote to memory of 1224	1776	vucogl.exe	elwav.exe
PID 1776 wrote to memory of 1084	1776	vucogl.exe	schtasks.exe
PID 1776 wrote to memory of 1084	1776	vucogl.exe	schtasks.exe
PID 1776 wrote to memory of 1084	1776	vucogl.exe	schtasks.exe
PID 1776 wrote to memory of 1084	1776	vucogl.exe	schtasks.exe
PID 1224 wrote to memory of 1832	1224	elwav.exe	elwav.exe
PID 1224 wrote to memory of 1832	1224	elwav.exe	elwav.exe
PID 1224 wrote to memory of 1832	1224	elwav.exe	elwav.exe
PID 1224 wrote to memory of 1832	1224	elwav.exe	elwav.exe
PID 1224 wrote to memory of 1056	1224	elwav.exe	explorer.exe
PID 1224 wrote to memory of 1056	1224	elwav.exe	explorer.exe
PID 1224 wrote to memory of 1056	1224	elwav.exe	explorer.exe
PID 1224 wrote to memory of 1056	1224	elwav.exe	explorer.exe
PID 1224 wrote to memory of 1056	1224	elwav.exe	explorer.exe
PID 532 wrote to memory of 1764	532	taskeng.exe	vucogl.exe
PID 532 wrote to memory of 1764	532	taskeng.exe	vucogl.exe
PID 532 wrote to memory of 1764	532	taskeng.exe	vucogl.exe
PID 532 wrote to memory of 1764	532	taskeng.exe	vucogl.exe

C:\Users\Admin\AppData\Local\Temp\vucogl.exe
"C:\Users\Admin\AppData\Local\Temp\vucogl.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1776

C:\Users\Admin\AppData\Local\Temp\vucogl.exe
C:\Users\Admin\AppData\Local\Temp\vucogl.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:616

C:\Users\Admin\AppData\Roaming\Microsoft\Gniofuyd\elwav.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Gniofuyd\elwav.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1224

C:\Users\Admin\AppData\Roaming\Microsoft\Gniofuyd\elwav.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Gniofuyd\elwav.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1832

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1056

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn erqppfs /tr "\"C:\Users\Admin\AppData\Local\Temp\vucogl.exe\" /I erqppfs" /SC ONCE /Z /ST 15:47 /ET 15:59
2⤵
- Creates scheduled task(s)
PID:1084

C:\Windows\system32\taskeng.exe
taskeng.exe {D8B55B59-BCF4-4DB2-B162-B5A465798B74} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:532

C:\Users\Admin\AppData\Local\Temp\vucogl.exe
C:\Users\Admin\AppData\Local\Temp\vucogl.exe /I erqppfs
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1764

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Gniofuyd\elwav.dat
MD5
ed2d4f5760005176c5fc521880c58394

SHA1
55983fa82e1eb7a43c184d55d0c08af819bc7c95

SHA256
c51aba038700444114a22cc97018f47163b36312485c7e899f777eb36946607d

SHA512
433a8fb5128a9dfc8a91ce3e888d3cf315f0ca678c28e33218ed5282fd819ca83fd06f6dd0da986820e0dc87748d542fe67834d906c7af0480f7ec90b30f6636

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Gniofuyd\elwav.exe
MD5
96b58cf3de718c5837100e30980bb024

SHA1
9266451c3c831cee79db0c6e06e360fc48309e47

SHA256
ef10467e404390bf1097103ff154636911734a8eaa93c3de12a76391e20ddbd5

SHA512
59c76459bc8456bcfc364e27f815030dd89272129abcd601ee0b216f9652a11f1ad86de80617a5dab2cc14dcf49daafb5c33a110db7020a244d471cf4b77b1f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Gniofuyd\elwav.exe
MD5
96b58cf3de718c5837100e30980bb024

SHA1
9266451c3c831cee79db0c6e06e360fc48309e47

SHA256
ef10467e404390bf1097103ff154636911734a8eaa93c3de12a76391e20ddbd5

SHA512
59c76459bc8456bcfc364e27f815030dd89272129abcd601ee0b216f9652a11f1ad86de80617a5dab2cc14dcf49daafb5c33a110db7020a244d471cf4b77b1f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Gniofuyd\elwav.exe
MD5
96b58cf3de718c5837100e30980bb024

SHA1
9266451c3c831cee79db0c6e06e360fc48309e47

SHA256
ef10467e404390bf1097103ff154636911734a8eaa93c3de12a76391e20ddbd5

SHA512
59c76459bc8456bcfc364e27f815030dd89272129abcd601ee0b216f9652a11f1ad86de80617a5dab2cc14dcf49daafb5c33a110db7020a244d471cf4b77b1f2

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Gniofuyd\elwav.exe
MD5
96b58cf3de718c5837100e30980bb024

SHA1
9266451c3c831cee79db0c6e06e360fc48309e47

SHA256
ef10467e404390bf1097103ff154636911734a8eaa93c3de12a76391e20ddbd5

SHA512
59c76459bc8456bcfc364e27f815030dd89272129abcd601ee0b216f9652a11f1ad86de80617a5dab2cc14dcf49daafb5c33a110db7020a244d471cf4b77b1f2

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Gniofuyd\elwav.exe
MD5
96b58cf3de718c5837100e30980bb024

SHA1
9266451c3c831cee79db0c6e06e360fc48309e47

SHA256
ef10467e404390bf1097103ff154636911734a8eaa93c3de12a76391e20ddbd5

SHA512
59c76459bc8456bcfc364e27f815030dd89272129abcd601ee0b216f9652a11f1ad86de80617a5dab2cc14dcf49daafb5c33a110db7020a244d471cf4b77b1f2

Download Submit
memory/616-1-0x0000000002590000-0x00000000025A1000-memory.dmp

Filesize
68KB

Download
memory/616-0-0x0000000000000000-mapping.dmp

Download
memory/1056-12-0x0000000000000000-mapping.dmp

Download
memory/1084-6-0x0000000000000000-mapping.dmp

Download
memory/1224-11-0x00000000003C0000-0x00000000003FA000-memory.dmp

Filesize
232KB

Download
memory/1224-4-0x0000000000000000-mapping.dmp

Download
memory/1764-14-0x0000000000000000-mapping.dmp

Download
memory/1832-10-0x0000000002640000-0x0000000002651000-memory.dmp

Filesize
68KB

Download
memory/1832-8-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads