qakbot | 943cd528b2510e0ad0397cf2593ff6eaac016b5a07c67e0d0dc229ffc535824f

General

Target

incdem.exe
Size

1.0MB
MD5

445cedf2efb077382a17554a7744f355
SHA1

a25251beb0b882454629888cbbfb122d51b0ab01
SHA256

943cd528b2510e0ad0397cf2593ff6eaac016b5a07c67e0d0dc229ffc535824f
SHA512

4584b03814bbd83403daa7a57be690a7b3cf44dc759aa373bccaaadeba30e00ce400d3950dcefb9c09ed44ee457c4219865de0a31575ad317767b5b277c15efc

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

ycbtwa.exeycbtwa.exe

pid process

1308 ycbtwa.exe
1640 ycbtwa.exe
Loads dropped DLL 2 IoCs

Processes:

incdem.exe

pid process

1700 incdem.exe
1700 incdem.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1360 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

incdem.exeincdem.exeycbtwa.exeycbtwa.exeexplorer.exeincdem.exe

pid process

1700 incdem.exe
1720 incdem.exe
1720 incdem.exe
1308 ycbtwa.exe
1640 ycbtwa.exe
1640 ycbtwa.exe
1500 explorer.exe
1500 explorer.exe
1004 incdem.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ycbtwa.exe

pid process

1308 ycbtwa.exe

pid	process
1308	ycbtwa.exe
1640	ycbtwa.exe

pid	process
1700	incdem.exe
1700	incdem.exe

pid	process
1360	schtasks.exe

pid	process
1700	incdem.exe
1720	incdem.exe
1720	incdem.exe
1308	ycbtwa.exe
1640	ycbtwa.exe
1640	ycbtwa.exe
1500	explorer.exe
1500	explorer.exe
1004	incdem.exe

pid	process
1308	ycbtwa.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

incdem.exeycbtwa.exetaskeng.exe

description	pid	process	target process
PID 1700 wrote to memory of 1720	1700	incdem.exe	incdem.exe
PID 1700 wrote to memory of 1720	1700	incdem.exe	incdem.exe
PID 1700 wrote to memory of 1720	1700	incdem.exe	incdem.exe
PID 1700 wrote to memory of 1720	1700	incdem.exe	incdem.exe
PID 1700 wrote to memory of 1308	1700	incdem.exe	ycbtwa.exe
PID 1700 wrote to memory of 1308	1700	incdem.exe	ycbtwa.exe
PID 1700 wrote to memory of 1308	1700	incdem.exe	ycbtwa.exe
PID 1700 wrote to memory of 1308	1700	incdem.exe	ycbtwa.exe
PID 1700 wrote to memory of 1360	1700	incdem.exe	schtasks.exe
PID 1700 wrote to memory of 1360	1700	incdem.exe	schtasks.exe
PID 1700 wrote to memory of 1360	1700	incdem.exe	schtasks.exe
PID 1700 wrote to memory of 1360	1700	incdem.exe	schtasks.exe
PID 1308 wrote to memory of 1640	1308	ycbtwa.exe	ycbtwa.exe
PID 1308 wrote to memory of 1640	1308	ycbtwa.exe	ycbtwa.exe
PID 1308 wrote to memory of 1640	1308	ycbtwa.exe	ycbtwa.exe
PID 1308 wrote to memory of 1640	1308	ycbtwa.exe	ycbtwa.exe
PID 1308 wrote to memory of 1500	1308	ycbtwa.exe	explorer.exe
PID 1308 wrote to memory of 1500	1308	ycbtwa.exe	explorer.exe
PID 1308 wrote to memory of 1500	1308	ycbtwa.exe	explorer.exe
PID 1308 wrote to memory of 1500	1308	ycbtwa.exe	explorer.exe
PID 1308 wrote to memory of 1500	1308	ycbtwa.exe	explorer.exe
PID 672 wrote to memory of 1004	672	taskeng.exe	incdem.exe
PID 672 wrote to memory of 1004	672	taskeng.exe	incdem.exe
PID 672 wrote to memory of 1004	672	taskeng.exe	incdem.exe
PID 672 wrote to memory of 1004	672	taskeng.exe	incdem.exe

C:\Users\Admin\AppData\Local\Temp\incdem.exe
"C:\Users\Admin\AppData\Local\Temp\incdem.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1700

C:\Users\Admin\AppData\Local\Temp\incdem.exe
C:\Users\Admin\AppData\Local\Temp\incdem.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1720

C:\Users\Admin\AppData\Roaming\Microsoft\Ufchoaubao\ycbtwa.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ufchoaubao\ycbtwa.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1308

C:\Users\Admin\AppData\Roaming\Microsoft\Ufchoaubao\ycbtwa.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Ufchoaubao\ycbtwa.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1640

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1500

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn tvczreboz /tr "\"C:\Users\Admin\AppData\Local\Temp\incdem.exe\" /I tvczreboz" /SC ONCE /Z /ST 14:39 /ET 14:51
2⤵
- Creates scheduled task(s)
PID:1360

C:\Windows\system32\taskeng.exe
taskeng.exe {2E8AA278-2415-4561-A2E2-A111C37FD9F0} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:672

C:\Users\Admin\AppData\Local\Temp\incdem.exe
C:\Users\Admin\AppData\Local\Temp\incdem.exe /I tvczreboz
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1004

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Ufchoaubao\ycbtwa.dat
MD5
31ad0ba78648d2bc5ae13be50c51e459

SHA1
83f94c69ae1c46b2aaa596f0c962020781faaf52

SHA256
ebc8766df436ad5fe620bf46c2054a9cd5f7a3ffcbd20c3723c6b2779331b619

SHA512
f3d40e0bf79a05ec5963bbfd115bee99465e1efd67a8e68d37eb9359cf0ee3beae3a2593c14964e19ae0dda381bcd1dd3b5f2ca11b67f146fdba1d8ede9ed6de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ufchoaubao\ycbtwa.exe
MD5
445cedf2efb077382a17554a7744f355

SHA1
a25251beb0b882454629888cbbfb122d51b0ab01

SHA256
943cd528b2510e0ad0397cf2593ff6eaac016b5a07c67e0d0dc229ffc535824f

SHA512
4584b03814bbd83403daa7a57be690a7b3cf44dc759aa373bccaaadeba30e00ce400d3950dcefb9c09ed44ee457c4219865de0a31575ad317767b5b277c15efc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ufchoaubao\ycbtwa.exe
MD5
445cedf2efb077382a17554a7744f355

SHA1
a25251beb0b882454629888cbbfb122d51b0ab01

SHA256
943cd528b2510e0ad0397cf2593ff6eaac016b5a07c67e0d0dc229ffc535824f

SHA512
4584b03814bbd83403daa7a57be690a7b3cf44dc759aa373bccaaadeba30e00ce400d3950dcefb9c09ed44ee457c4219865de0a31575ad317767b5b277c15efc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Ufchoaubao\ycbtwa.exe
MD5
445cedf2efb077382a17554a7744f355

SHA1
a25251beb0b882454629888cbbfb122d51b0ab01

SHA256
943cd528b2510e0ad0397cf2593ff6eaac016b5a07c67e0d0dc229ffc535824f

SHA512
4584b03814bbd83403daa7a57be690a7b3cf44dc759aa373bccaaadeba30e00ce400d3950dcefb9c09ed44ee457c4219865de0a31575ad317767b5b277c15efc

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Ufchoaubao\ycbtwa.exe
MD5
445cedf2efb077382a17554a7744f355

SHA1
a25251beb0b882454629888cbbfb122d51b0ab01

SHA256
943cd528b2510e0ad0397cf2593ff6eaac016b5a07c67e0d0dc229ffc535824f

SHA512
4584b03814bbd83403daa7a57be690a7b3cf44dc759aa373bccaaadeba30e00ce400d3950dcefb9c09ed44ee457c4219865de0a31575ad317767b5b277c15efc

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Ufchoaubao\ycbtwa.exe
MD5
445cedf2efb077382a17554a7744f355

SHA1
a25251beb0b882454629888cbbfb122d51b0ab01

SHA256
943cd528b2510e0ad0397cf2593ff6eaac016b5a07c67e0d0dc229ffc535824f

SHA512
4584b03814bbd83403daa7a57be690a7b3cf44dc759aa373bccaaadeba30e00ce400d3950dcefb9c09ed44ee457c4219865de0a31575ad317767b5b277c15efc

Download Submit
memory/1004-14-0x0000000000000000-mapping.dmp

Download
memory/1308-11-0x00000000003B0000-0x00000000003EA000-memory.dmp

Filesize
232KB

Download
memory/1308-4-0x0000000000000000-mapping.dmp

Download
memory/1360-6-0x0000000000000000-mapping.dmp

Download
memory/1500-12-0x0000000000000000-mapping.dmp

Download
memory/1640-10-0x0000000002560000-0x0000000002571000-memory.dmp

Filesize
68KB

Download
memory/1640-8-0x0000000000000000-mapping.dmp

Download
memory/1720-0-0x0000000000000000-mapping.dmp

Download
memory/1720-1-0x0000000002590000-0x00000000025A1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads