qakbot | ed9e1f788646697ced8b4e3137fe129760a18940d899a3d33bfe10723d36d8c0

General

Target

iipvyt.exe
Size

1.0MB
MD5

5d44ba452a15465f7be205da6c03a8b8
SHA1

d843e3cdefdd6e037a4fe1eeaa8e6b94698c52ca
SHA256

ed9e1f788646697ced8b4e3137fe129760a18940d899a3d33bfe10723d36d8c0
SHA512

af779a12764beebb9491612c5229eb01e096f5420980f4bc6e7d7341be83a57d029b6cca5bcbb13cdd9d359036f6ab2348d948ebb169eabaa9b8ea3f31f609d0

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

cwhsy.execwhsy.exe

pid process

1088 cwhsy.exe
1912 cwhsy.exe
Loads dropped DLL 2 IoCs

Processes:

iipvyt.exe

pid process

2012 iipvyt.exe
2012 iipvyt.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

740 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

iipvyt.exeiipvyt.execwhsy.execwhsy.exeexplorer.exe

pid process

2012 iipvyt.exe
796 iipvyt.exe
796 iipvyt.exe
1088 cwhsy.exe
1912 cwhsy.exe
1912 cwhsy.exe
1488 explorer.exe
1488 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

cwhsy.exe

pid process

1088 cwhsy.exe

pid	process
1088	cwhsy.exe
1912	cwhsy.exe

pid	process
2012	iipvyt.exe
2012	iipvyt.exe

pid	process
740	schtasks.exe

pid	process
2012	iipvyt.exe
796	iipvyt.exe
796	iipvyt.exe
1088	cwhsy.exe
1912	cwhsy.exe
1912	cwhsy.exe
1488	explorer.exe
1488	explorer.exe

pid	process
1088	cwhsy.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

iipvyt.execwhsy.exetaskeng.exe

description	pid	process	target process
PID 2012 wrote to memory of 796	2012	iipvyt.exe	iipvyt.exe
PID 2012 wrote to memory of 796	2012	iipvyt.exe	iipvyt.exe
PID 2012 wrote to memory of 796	2012	iipvyt.exe	iipvyt.exe
PID 2012 wrote to memory of 796	2012	iipvyt.exe	iipvyt.exe
PID 2012 wrote to memory of 1088	2012	iipvyt.exe	cwhsy.exe
PID 2012 wrote to memory of 1088	2012	iipvyt.exe	cwhsy.exe
PID 2012 wrote to memory of 1088	2012	iipvyt.exe	cwhsy.exe
PID 2012 wrote to memory of 1088	2012	iipvyt.exe	cwhsy.exe
PID 2012 wrote to memory of 740	2012	iipvyt.exe	schtasks.exe
PID 2012 wrote to memory of 740	2012	iipvyt.exe	schtasks.exe
PID 2012 wrote to memory of 740	2012	iipvyt.exe	schtasks.exe
PID 2012 wrote to memory of 740	2012	iipvyt.exe	schtasks.exe
PID 1088 wrote to memory of 1912	1088	cwhsy.exe	cwhsy.exe
PID 1088 wrote to memory of 1912	1088	cwhsy.exe	cwhsy.exe
PID 1088 wrote to memory of 1912	1088	cwhsy.exe	cwhsy.exe
PID 1088 wrote to memory of 1912	1088	cwhsy.exe	cwhsy.exe
PID 1088 wrote to memory of 1488	1088	cwhsy.exe	explorer.exe
PID 1088 wrote to memory of 1488	1088	cwhsy.exe	explorer.exe
PID 1088 wrote to memory of 1488	1088	cwhsy.exe	explorer.exe
PID 1088 wrote to memory of 1488	1088	cwhsy.exe	explorer.exe
PID 1088 wrote to memory of 1488	1088	cwhsy.exe	explorer.exe
PID 1808 wrote to memory of 1900	1808	taskeng.exe	iipvyt.exe
PID 1808 wrote to memory of 1900	1808	taskeng.exe	iipvyt.exe
PID 1808 wrote to memory of 1900	1808	taskeng.exe	iipvyt.exe
PID 1808 wrote to memory of 1900	1808	taskeng.exe	iipvyt.exe

C:\Users\Admin\AppData\Local\Temp\iipvyt.exe
"C:\Users\Admin\AppData\Local\Temp\iipvyt.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2012

C:\Users\Admin\AppData\Local\Temp\iipvyt.exe
C:\Users\Admin\AppData\Local\Temp\iipvyt.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:796

C:\Users\Admin\AppData\Roaming\Microsoft\Exogwlnel\cwhsy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Exogwlnel\cwhsy.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1088

C:\Users\Admin\AppData\Roaming\Microsoft\Exogwlnel\cwhsy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Exogwlnel\cwhsy.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1912

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1488

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ogwpkzjtm /tr "\"C:\Users\Admin\AppData\Local\Temp\iipvyt.exe\" /I ogwpkzjtm" /SC ONCE /Z /ST 14:41 /ET 14:53
2⤵
- Creates scheduled task(s)
PID:740

C:\Windows\system32\taskeng.exe
taskeng.exe {3E0C2BC4-7F45-46F4-8E27-BC3661EFB620} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Users\Admin\AppData\Local\Temp\iipvyt.exe
C:\Users\Admin\AppData\Local\Temp\iipvyt.exe /I ogwpkzjtm
2⤵
PID:1900

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Exogwlnel\cwhsy.dat
MD5
09e19858c8a34c0e766d1f854a683a7f

SHA1
c38a7a567670e036140c98be43b4e6f1f0ee8b4b

SHA256
b6aee08284f1ab03da09c2c6642c92a93cf7b5069c099c12bf458b03fd2ca0a3

SHA512
6fe92f1adc78c221ce42b8ce6fbe9f3bd556ee915094b1b3b1cbce5e60f059ed4883e3dc663ad82918339dee51ddebae945a9c6fd5f79092e93d4b7acea2baa8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Exogwlnel\cwhsy.exe
MD5
5d44ba452a15465f7be205da6c03a8b8

SHA1
d843e3cdefdd6e037a4fe1eeaa8e6b94698c52ca

SHA256
ed9e1f788646697ced8b4e3137fe129760a18940d899a3d33bfe10723d36d8c0

SHA512
af779a12764beebb9491612c5229eb01e096f5420980f4bc6e7d7341be83a57d029b6cca5bcbb13cdd9d359036f6ab2348d948ebb169eabaa9b8ea3f31f609d0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Exogwlnel\cwhsy.exe
MD5
5d44ba452a15465f7be205da6c03a8b8

SHA1
d843e3cdefdd6e037a4fe1eeaa8e6b94698c52ca

SHA256
ed9e1f788646697ced8b4e3137fe129760a18940d899a3d33bfe10723d36d8c0

SHA512
af779a12764beebb9491612c5229eb01e096f5420980f4bc6e7d7341be83a57d029b6cca5bcbb13cdd9d359036f6ab2348d948ebb169eabaa9b8ea3f31f609d0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Exogwlnel\cwhsy.exe
MD5
5d44ba452a15465f7be205da6c03a8b8

SHA1
d843e3cdefdd6e037a4fe1eeaa8e6b94698c52ca

SHA256
ed9e1f788646697ced8b4e3137fe129760a18940d899a3d33bfe10723d36d8c0

SHA512
af779a12764beebb9491612c5229eb01e096f5420980f4bc6e7d7341be83a57d029b6cca5bcbb13cdd9d359036f6ab2348d948ebb169eabaa9b8ea3f31f609d0

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Exogwlnel\cwhsy.exe
MD5
5d44ba452a15465f7be205da6c03a8b8

SHA1
d843e3cdefdd6e037a4fe1eeaa8e6b94698c52ca

SHA256
ed9e1f788646697ced8b4e3137fe129760a18940d899a3d33bfe10723d36d8c0

SHA512
af779a12764beebb9491612c5229eb01e096f5420980f4bc6e7d7341be83a57d029b6cca5bcbb13cdd9d359036f6ab2348d948ebb169eabaa9b8ea3f31f609d0

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Exogwlnel\cwhsy.exe
MD5
5d44ba452a15465f7be205da6c03a8b8

SHA1
d843e3cdefdd6e037a4fe1eeaa8e6b94698c52ca

SHA256
ed9e1f788646697ced8b4e3137fe129760a18940d899a3d33bfe10723d36d8c0

SHA512
af779a12764beebb9491612c5229eb01e096f5420980f4bc6e7d7341be83a57d029b6cca5bcbb13cdd9d359036f6ab2348d948ebb169eabaa9b8ea3f31f609d0

Download Submit
memory/740-6-0x0000000000000000-mapping.dmp

Download
memory/796-0-0x0000000000000000-mapping.dmp

Download
memory/796-1-0x0000000002590000-0x00000000025A1000-memory.dmp

Filesize
68KB

Download
memory/1088-4-0x0000000000000000-mapping.dmp

Download
memory/1088-11-0x00000000006A0000-0x00000000006DA000-memory.dmp

Filesize
232KB

Download
memory/1488-12-0x0000000000000000-mapping.dmp

Download
memory/1900-14-0x0000000000000000-mapping.dmp

Download
memory/1912-8-0x0000000000000000-mapping.dmp

Download
memory/1912-10-0x00000000024E0000-0x00000000024F1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads