qakbot | ee67c56c9cb660666ffdb580f3a784d7562b075f42d95819cb9bc000753cb8a4

General

Target

dbnrvz.exe
Size

1.0MB
MD5

c3b3b42e6026a642d0f1d70d8dc83c3f
SHA1

ffd037260ee9b685743f622d61e16ed32d97064c
SHA256

ee67c56c9cb660666ffdb580f3a784d7562b075f42d95819cb9bc000753cb8a4
SHA512

ad5f5cdfb8e95b2e89ad0a7e47ea7b151276ebb037aee7a23bcf53f66f610f325f2b8d1ebc87d236f418096ab10c72857b349918782f44f0926314419b6a43fe

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

bgamf.exebgamf.exe

pid process

1228 bgamf.exe
436 bgamf.exe
Loads dropped DLL 2 IoCs

Processes:

dbnrvz.exe

pid process

1588 dbnrvz.exe
1588 dbnrvz.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

888 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

dbnrvz.exedbnrvz.exebgamf.exebgamf.exeexplorer.exedbnrvz.exe

pid process

1588 dbnrvz.exe
2040 dbnrvz.exe
2040 dbnrvz.exe
1228 bgamf.exe
436 bgamf.exe
436 bgamf.exe
1996 explorer.exe
1996 explorer.exe
1464 dbnrvz.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

bgamf.exe

pid process

1228 bgamf.exe

pid	process
1228	bgamf.exe
436	bgamf.exe

pid	process
1588	dbnrvz.exe
1588	dbnrvz.exe

pid	process
888	schtasks.exe

pid	process
1588	dbnrvz.exe
2040	dbnrvz.exe
2040	dbnrvz.exe
1228	bgamf.exe
436	bgamf.exe
436	bgamf.exe
1996	explorer.exe
1996	explorer.exe
1464	dbnrvz.exe

pid	process
1228	bgamf.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

dbnrvz.exebgamf.exetaskeng.exe

description	pid	process	target process
PID 1588 wrote to memory of 2040	1588	dbnrvz.exe	dbnrvz.exe
PID 1588 wrote to memory of 2040	1588	dbnrvz.exe	dbnrvz.exe
PID 1588 wrote to memory of 2040	1588	dbnrvz.exe	dbnrvz.exe
PID 1588 wrote to memory of 2040	1588	dbnrvz.exe	dbnrvz.exe
PID 1588 wrote to memory of 1228	1588	dbnrvz.exe	bgamf.exe
PID 1588 wrote to memory of 1228	1588	dbnrvz.exe	bgamf.exe
PID 1588 wrote to memory of 1228	1588	dbnrvz.exe	bgamf.exe
PID 1588 wrote to memory of 1228	1588	dbnrvz.exe	bgamf.exe
PID 1588 wrote to memory of 888	1588	dbnrvz.exe	schtasks.exe
PID 1588 wrote to memory of 888	1588	dbnrvz.exe	schtasks.exe
PID 1588 wrote to memory of 888	1588	dbnrvz.exe	schtasks.exe
PID 1588 wrote to memory of 888	1588	dbnrvz.exe	schtasks.exe
PID 1228 wrote to memory of 436	1228	bgamf.exe	bgamf.exe
PID 1228 wrote to memory of 436	1228	bgamf.exe	bgamf.exe
PID 1228 wrote to memory of 436	1228	bgamf.exe	bgamf.exe
PID 1228 wrote to memory of 436	1228	bgamf.exe	bgamf.exe
PID 1228 wrote to memory of 1996	1228	bgamf.exe	explorer.exe
PID 1228 wrote to memory of 1996	1228	bgamf.exe	explorer.exe
PID 1228 wrote to memory of 1996	1228	bgamf.exe	explorer.exe
PID 1228 wrote to memory of 1996	1228	bgamf.exe	explorer.exe
PID 1228 wrote to memory of 1996	1228	bgamf.exe	explorer.exe
PID 684 wrote to memory of 1464	684	taskeng.exe	dbnrvz.exe
PID 684 wrote to memory of 1464	684	taskeng.exe	dbnrvz.exe
PID 684 wrote to memory of 1464	684	taskeng.exe	dbnrvz.exe
PID 684 wrote to memory of 1464	684	taskeng.exe	dbnrvz.exe

C:\Users\Admin\AppData\Local\Temp\dbnrvz.exe
"C:\Users\Admin\AppData\Local\Temp\dbnrvz.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1588

C:\Users\Admin\AppData\Local\Temp\dbnrvz.exe
C:\Users\Admin\AppData\Local\Temp\dbnrvz.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040

C:\Users\Admin\AppData\Roaming\Microsoft\Ueyilnnzp\bgamf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ueyilnnzp\bgamf.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1228

C:\Users\Admin\AppData\Roaming\Microsoft\Ueyilnnzp\bgamf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ueyilnnzp\bgamf.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:436

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1996

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bbycxqlyg /tr "\"C:\Users\Admin\AppData\Local\Temp\dbnrvz.exe\" /I bbycxqlyg" /SC ONCE /Z /ST 14:40 /ET 14:52
2⤵
- Creates scheduled task(s)
PID:888

C:\Windows\system32\taskeng.exe
taskeng.exe {70384644-1E7D-45AE-AFF3-C1B4DA038AC1} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:684

C:\Users\Admin\AppData\Local\Temp\dbnrvz.exe
C:\Users\Admin\AppData\Local\Temp\dbnrvz.exe /I bbycxqlyg
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1464

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Ueyilnnzp\bgamf.dat
MD5
35fab76a96cf76b1cb4b1d626df43dfe

SHA1
21e6658dbf31c6c7b241bd6ba0653f2d32488279

SHA256
2817ea015f9c7b827ef0f46d53ab40b7ac8f86fad06dde3d774cbf6b4c7e559c

SHA512
f8db05c30cf13a1cfeed12b1f5fc6040f94a4d54898c571575ca6a68a5dd5e60c3a570968a5be9892e3ee0ad39fc67e43f55369033a1f31ea9085fb1853b383e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ueyilnnzp\bgamf.exe
MD5
c3b3b42e6026a642d0f1d70d8dc83c3f

SHA1
ffd037260ee9b685743f622d61e16ed32d97064c

SHA256
ee67c56c9cb660666ffdb580f3a784d7562b075f42d95819cb9bc000753cb8a4

SHA512
ad5f5cdfb8e95b2e89ad0a7e47ea7b151276ebb037aee7a23bcf53f66f610f325f2b8d1ebc87d236f418096ab10c72857b349918782f44f0926314419b6a43fe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ueyilnnzp\bgamf.exe
MD5
c3b3b42e6026a642d0f1d70d8dc83c3f

SHA1
ffd037260ee9b685743f622d61e16ed32d97064c

SHA256
ee67c56c9cb660666ffdb580f3a784d7562b075f42d95819cb9bc000753cb8a4

SHA512
ad5f5cdfb8e95b2e89ad0a7e47ea7b151276ebb037aee7a23bcf53f66f610f325f2b8d1ebc87d236f418096ab10c72857b349918782f44f0926314419b6a43fe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ueyilnnzp\bgamf.exe
MD5
c3b3b42e6026a642d0f1d70d8dc83c3f

SHA1
ffd037260ee9b685743f622d61e16ed32d97064c

SHA256
ee67c56c9cb660666ffdb580f3a784d7562b075f42d95819cb9bc000753cb8a4

SHA512
ad5f5cdfb8e95b2e89ad0a7e47ea7b151276ebb037aee7a23bcf53f66f610f325f2b8d1ebc87d236f418096ab10c72857b349918782f44f0926314419b6a43fe

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Ueyilnnzp\bgamf.exe
MD5
c3b3b42e6026a642d0f1d70d8dc83c3f

SHA1
ffd037260ee9b685743f622d61e16ed32d97064c

SHA256
ee67c56c9cb660666ffdb580f3a784d7562b075f42d95819cb9bc000753cb8a4

SHA512
ad5f5cdfb8e95b2e89ad0a7e47ea7b151276ebb037aee7a23bcf53f66f610f325f2b8d1ebc87d236f418096ab10c72857b349918782f44f0926314419b6a43fe

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Ueyilnnzp\bgamf.exe
MD5
c3b3b42e6026a642d0f1d70d8dc83c3f

SHA1
ffd037260ee9b685743f622d61e16ed32d97064c

SHA256
ee67c56c9cb660666ffdb580f3a784d7562b075f42d95819cb9bc000753cb8a4

SHA512
ad5f5cdfb8e95b2e89ad0a7e47ea7b151276ebb037aee7a23bcf53f66f610f325f2b8d1ebc87d236f418096ab10c72857b349918782f44f0926314419b6a43fe

Download Submit
memory/436-8-0x0000000000000000-mapping.dmp

Download
memory/436-10-0x0000000002740000-0x0000000002751000-memory.dmp

Filesize
68KB

Download
memory/888-6-0x0000000000000000-mapping.dmp

Download
memory/1228-4-0x0000000000000000-mapping.dmp

Download
memory/1228-11-0x00000000024D0000-0x000000000250A000-memory.dmp

Filesize
232KB

Download
memory/1464-14-0x0000000000000000-mapping.dmp

Download
memory/1996-12-0x0000000000000000-mapping.dmp

Download
memory/2040-0-0x0000000000000000-mapping.dmp

Download
memory/2040-1-0x0000000002650000-0x0000000002661000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads