qakbot | 3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033

General

Target

xyjsca.exe
Size

3.4MB
MD5

abddab5ff34dbfae92c8fca7a524a06f
SHA1

6deec6f703c76e34cd415e83e8a574ac2c97751d
SHA256

3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033
SHA512

29d5b76ccf268bd92d48f79c86c2b037a1fa95c72e0289bfe5d7396f87fe1c5ba0872bc9b15255591f379bab63eab0100b523fb5c7f12fdf0255eb7a01491298

Score

10^/10

qakbot notset 1596817234 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1596817234

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

47.44.217.98:443

86.97.146.204:2222

65.60.228.130:443

216.201.162.158:443

94.59.24.79:995

108.46.145.30:443

24.139.132.70:443

47.206.174.82:443

188.52.106.206:20

72.204.242.138:6881

173.173.72.199:443

71.163.224.206:443

63.155.9.141:995

100.34.195.237:443

47.39.177.171:2222

96.20.108.17:2222

115.21.224.117:443

70.164.39.91:443

45.47.65.191:443

207.155.107.111:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

iqajk.exeiqajk.exe

pid process

520 iqajk.exe
568 iqajk.exe
Loads dropped DLL 2 IoCs

Processes:

xyjsca.exe

pid process

1804 xyjsca.exe
1804 xyjsca.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

856 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

xyjsca.exexyjsca.exeiqajk.exeiqajk.exeexplorer.exe

pid process

1804 xyjsca.exe
1592 xyjsca.exe
1592 xyjsca.exe
520 iqajk.exe
568 iqajk.exe
568 iqajk.exe
1088 explorer.exe
1088 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

iqajk.exe

pid process

520 iqajk.exe

pid	process
520	iqajk.exe
568	iqajk.exe

pid	process
1804	xyjsca.exe
1804	xyjsca.exe

pid	process
856	schtasks.exe

pid	process
1804	xyjsca.exe
1592	xyjsca.exe
1592	xyjsca.exe
520	iqajk.exe
568	iqajk.exe
568	iqajk.exe
1088	explorer.exe
1088	explorer.exe

pid	process
520	iqajk.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

xyjsca.exeiqajk.exe

description	pid	process	target process
PID 1804 wrote to memory of 1592	1804	xyjsca.exe	xyjsca.exe
PID 1804 wrote to memory of 1592	1804	xyjsca.exe	xyjsca.exe
PID 1804 wrote to memory of 1592	1804	xyjsca.exe	xyjsca.exe
PID 1804 wrote to memory of 1592	1804	xyjsca.exe	xyjsca.exe
PID 1804 wrote to memory of 520	1804	xyjsca.exe	iqajk.exe
PID 1804 wrote to memory of 520	1804	xyjsca.exe	iqajk.exe
PID 1804 wrote to memory of 520	1804	xyjsca.exe	iqajk.exe
PID 1804 wrote to memory of 520	1804	xyjsca.exe	iqajk.exe
PID 1804 wrote to memory of 856	1804	xyjsca.exe	schtasks.exe
PID 1804 wrote to memory of 856	1804	xyjsca.exe	schtasks.exe
PID 1804 wrote to memory of 856	1804	xyjsca.exe	schtasks.exe
PID 1804 wrote to memory of 856	1804	xyjsca.exe	schtasks.exe
PID 520 wrote to memory of 568	520	iqajk.exe	iqajk.exe
PID 520 wrote to memory of 568	520	iqajk.exe	iqajk.exe
PID 520 wrote to memory of 568	520	iqajk.exe	iqajk.exe
PID 520 wrote to memory of 568	520	iqajk.exe	iqajk.exe
PID 520 wrote to memory of 1088	520	iqajk.exe	explorer.exe
PID 520 wrote to memory of 1088	520	iqajk.exe	explorer.exe
PID 520 wrote to memory of 1088	520	iqajk.exe	explorer.exe
PID 520 wrote to memory of 1088	520	iqajk.exe	explorer.exe
PID 520 wrote to memory of 1088	520	iqajk.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\xyjsca.exe
"C:\Users\Admin\AppData\Local\Temp\xyjsca.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1804

C:\Users\Admin\AppData\Local\Temp\xyjsca.exe
C:\Users\Admin\AppData\Local\Temp\xyjsca.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1592

C:\Users\Admin\AppData\Roaming\Microsoft\Afdmavspox\iqajk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Afdmavspox\iqajk.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:520

C:\Users\Admin\AppData\Roaming\Microsoft\Afdmavspox\iqajk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Afdmavspox\iqajk.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:568

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1088

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wfyebjvjex /tr "\"C:\Users\Admin\AppData\Local\Temp\xyjsca.exe\" /I wfyebjvjex" /SC ONCE /Z /ST 16:54 /ET 17:06
2⤵
- Creates scheduled task(s)
PID:856

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Afdmavspox\iqajk.dat
MD5
e16d1d9feaacff3f4ffd439bf053cc8f

SHA1
2f493547c551020e9ca727699845243fa6362e6b

SHA256
d1577d6f88aa05835807e9e61c0b271059883d4c9c088b6e0024f1999e305920

SHA512
93807d4860fd5323ccf60907fbc4ae782499ab6538bbabadad36c798a59c72460f08ff6a834fe942915ff9df32038190f7a285bb3458fadba3b3edcf97b603d8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Afdmavspox\iqajk.exe
MD5
abddab5ff34dbfae92c8fca7a524a06f

SHA1
6deec6f703c76e34cd415e83e8a574ac2c97751d

SHA256
3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033

SHA512
29d5b76ccf268bd92d48f79c86c2b037a1fa95c72e0289bfe5d7396f87fe1c5ba0872bc9b15255591f379bab63eab0100b523fb5c7f12fdf0255eb7a01491298

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Afdmavspox\iqajk.exe
MD5
abddab5ff34dbfae92c8fca7a524a06f

SHA1
6deec6f703c76e34cd415e83e8a574ac2c97751d

SHA256
3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033

SHA512
29d5b76ccf268bd92d48f79c86c2b037a1fa95c72e0289bfe5d7396f87fe1c5ba0872bc9b15255591f379bab63eab0100b523fb5c7f12fdf0255eb7a01491298

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Afdmavspox\iqajk.exe
MD5
abddab5ff34dbfae92c8fca7a524a06f

SHA1
6deec6f703c76e34cd415e83e8a574ac2c97751d

SHA256
3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033

SHA512
29d5b76ccf268bd92d48f79c86c2b037a1fa95c72e0289bfe5d7396f87fe1c5ba0872bc9b15255591f379bab63eab0100b523fb5c7f12fdf0255eb7a01491298

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Afdmavspox\iqajk.exe
MD5
abddab5ff34dbfae92c8fca7a524a06f

SHA1
6deec6f703c76e34cd415e83e8a574ac2c97751d

SHA256
3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033

SHA512
29d5b76ccf268bd92d48f79c86c2b037a1fa95c72e0289bfe5d7396f87fe1c5ba0872bc9b15255591f379bab63eab0100b523fb5c7f12fdf0255eb7a01491298

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Afdmavspox\iqajk.exe
MD5
abddab5ff34dbfae92c8fca7a524a06f

SHA1
6deec6f703c76e34cd415e83e8a574ac2c97751d

SHA256
3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033

SHA512
29d5b76ccf268bd92d48f79c86c2b037a1fa95c72e0289bfe5d7396f87fe1c5ba0872bc9b15255591f379bab63eab0100b523fb5c7f12fdf0255eb7a01491298

Download Submit
memory/520-17-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/520-12-0x0000000000000000-mapping.dmp

Download
memory/568-19-0x0000000000000000-mapping.dmp

Download
memory/568-24-0x0000000002860000-0x0000000002871000-memory.dmp

Filesize
68KB

Download
memory/856-15-0x0000000000000000-mapping.dmp

Download
memory/1088-28-0x0000000000080000-0x00000000000C7000-memory.dmp

Filesize
284KB

Download
memory/1088-29-0x00000000001F0000-0x0000000000227000-memory.dmp

Filesize
220KB

Download
memory/1088-25-0x0000000000000000-mapping.dmp

Download
memory/1088-27-0x0000000075121000-0x0000000075123000-memory.dmp

Filesize
8KB

Download
memory/1592-9-0x00000000028B0000-0x00000000028C1000-memory.dmp

Filesize
68KB

Download
memory/1592-5-0x0000000000000000-mapping.dmp

Download
memory/1804-2-0x00000000767C1000-0x00000000767C3000-memory.dmp

Filesize
8KB

Download
memory/1804-4-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1804-3-0x00000000002D0000-0x0000000000314000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads