qakbot | 53b4b521ba57363330e4113c1b1883168441d95ed5db2f06438bd2e5e3ddb5e1

General

Target

C.137675.exe
Size

3.4MB
MD5

4c35956aafde8bc2c58868baa53db923
SHA1

53def6e75c769a4d2e874ccac24aa4b0261d90d1
SHA256

53b4b521ba57363330e4113c1b1883168441d95ed5db2f06438bd2e5e3ddb5e1
SHA512

8d05424d6f01f1139918b17b9986125ad3788c5ddebfce100795767931a4e9f6a1b96a30717487da0730c46fc895832c37d460c27ccab9f31d064982c1054096

Score

10^/10

qakbot notset 1596817234 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1596817234

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

47.44.217.98:443

86.97.146.204:2222

65.60.228.130:443

216.201.162.158:443

94.59.24.79:995

108.46.145.30:443

24.139.132.70:443

47.206.174.82:443

188.52.106.206:20

72.204.242.138:6881

173.173.72.199:443

71.163.224.206:443

63.155.9.141:995

100.34.195.237:443

47.39.177.171:2222

96.20.108.17:2222

115.21.224.117:443

70.164.39.91:443

45.47.65.191:443

207.155.107.111:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

rxqefi.exerxqefi.exe

pid process

1604 rxqefi.exe
620 rxqefi.exe
Loads dropped DLL 2 IoCs

Processes:

C.137675.exe

pid process

892 C.137675.exe
892 C.137675.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

516 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

C.137675.exeC.137675.exerxqefi.exerxqefi.exeexplorer.exeC.137675.exe

pid process

892 C.137675.exe
1060 C.137675.exe
1060 C.137675.exe
1604 rxqefi.exe
620 rxqefi.exe
620 rxqefi.exe
1236 explorer.exe
1236 explorer.exe
1596 C.137675.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rxqefi.exe

pid process

1604 rxqefi.exe

pid	process
1604	rxqefi.exe
620	rxqefi.exe

pid	process
892	C.137675.exe
892	C.137675.exe

pid	process
516	schtasks.exe

pid	process
892	C.137675.exe
1060	C.137675.exe
1060	C.137675.exe
1604	rxqefi.exe
620	rxqefi.exe
620	rxqefi.exe
1236	explorer.exe
1236	explorer.exe
1596	C.137675.exe

pid	process
1604	rxqefi.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

C.137675.exerxqefi.exetaskeng.exe

description	pid	process	target process
PID 892 wrote to memory of 1060	892	C.137675.exe	C.137675.exe
PID 892 wrote to memory of 1060	892	C.137675.exe	C.137675.exe
PID 892 wrote to memory of 1060	892	C.137675.exe	C.137675.exe
PID 892 wrote to memory of 1060	892	C.137675.exe	C.137675.exe
PID 892 wrote to memory of 1604	892	C.137675.exe	rxqefi.exe
PID 892 wrote to memory of 1604	892	C.137675.exe	rxqefi.exe
PID 892 wrote to memory of 1604	892	C.137675.exe	rxqefi.exe
PID 892 wrote to memory of 1604	892	C.137675.exe	rxqefi.exe
PID 892 wrote to memory of 516	892	C.137675.exe	schtasks.exe
PID 892 wrote to memory of 516	892	C.137675.exe	schtasks.exe
PID 892 wrote to memory of 516	892	C.137675.exe	schtasks.exe
PID 892 wrote to memory of 516	892	C.137675.exe	schtasks.exe
PID 1604 wrote to memory of 620	1604	rxqefi.exe	rxqefi.exe
PID 1604 wrote to memory of 620	1604	rxqefi.exe	rxqefi.exe
PID 1604 wrote to memory of 620	1604	rxqefi.exe	rxqefi.exe
PID 1604 wrote to memory of 620	1604	rxqefi.exe	rxqefi.exe
PID 1604 wrote to memory of 1236	1604	rxqefi.exe	explorer.exe
PID 1604 wrote to memory of 1236	1604	rxqefi.exe	explorer.exe
PID 1604 wrote to memory of 1236	1604	rxqefi.exe	explorer.exe
PID 1604 wrote to memory of 1236	1604	rxqefi.exe	explorer.exe
PID 1604 wrote to memory of 1236	1604	rxqefi.exe	explorer.exe
PID 1524 wrote to memory of 1596	1524	taskeng.exe	C.137675.exe
PID 1524 wrote to memory of 1596	1524	taskeng.exe	C.137675.exe
PID 1524 wrote to memory of 1596	1524	taskeng.exe	C.137675.exe
PID 1524 wrote to memory of 1596	1524	taskeng.exe	C.137675.exe

C:\Users\Admin\AppData\Local\Temp\C.137675.exe
"C:\Users\Admin\AppData\Local\Temp\C.137675.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:892

C:\Users\Admin\AppData\Local\Temp\C.137675.exe
C:\Users\Admin\AppData\Local\Temp\C.137675.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1060

C:\Users\Admin\AppData\Roaming\Microsoft\Dseyznm\rxqefi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Dseyznm\rxqefi.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1604

C:\Users\Admin\AppData\Roaming\Microsoft\Dseyznm\rxqefi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Dseyznm\rxqefi.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:620

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1236

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn shlsgustn /tr "\"C:\Users\Admin\AppData\Local\Temp\C.137675.exe\" /I shlsgustn" /SC ONCE /Z /ST 17:11 /ET 17:23
2⤵
- Creates scheduled task(s)
PID:516

C:\Windows\system32\taskeng.exe
taskeng.exe {9E98ED65-87CD-40C8-B842-6D362C03E124} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Users\Admin\AppData\Local\Temp\C.137675.exe
C:\Users\Admin\AppData\Local\Temp\C.137675.exe /I shlsgustn
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1596

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Dseyznm\rxqefi.dat
MD5
bce5b92e023606d5ba73e2c03e165798

SHA1
b2547feda52790c59aa03964886805fc730fd4f6

SHA256
0e6938f0d83ba946fdd36bf57b218a9eaaaee406a01aa7e7f0b25f55a5aa4a9e

SHA512
25ea2e87b59ab44ceed0c8acf8ca9aac5980da3733f40a87756da80a794411a5e97725bd19e48fd7ec2649c3a8d50485ed5398c435f7f57ddb2eb015afc048a5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Dseyznm\rxqefi.exe
MD5
4c35956aafde8bc2c58868baa53db923

SHA1
53def6e75c769a4d2e874ccac24aa4b0261d90d1

SHA256
53b4b521ba57363330e4113c1b1883168441d95ed5db2f06438bd2e5e3ddb5e1

SHA512
8d05424d6f01f1139918b17b9986125ad3788c5ddebfce100795767931a4e9f6a1b96a30717487da0730c46fc895832c37d460c27ccab9f31d064982c1054096

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Dseyznm\rxqefi.exe
MD5
4c35956aafde8bc2c58868baa53db923

SHA1
53def6e75c769a4d2e874ccac24aa4b0261d90d1

SHA256
53b4b521ba57363330e4113c1b1883168441d95ed5db2f06438bd2e5e3ddb5e1

SHA512
8d05424d6f01f1139918b17b9986125ad3788c5ddebfce100795767931a4e9f6a1b96a30717487da0730c46fc895832c37d460c27ccab9f31d064982c1054096

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Dseyznm\rxqefi.exe
MD5
4c35956aafde8bc2c58868baa53db923

SHA1
53def6e75c769a4d2e874ccac24aa4b0261d90d1

SHA256
53b4b521ba57363330e4113c1b1883168441d95ed5db2f06438bd2e5e3ddb5e1

SHA512
8d05424d6f01f1139918b17b9986125ad3788c5ddebfce100795767931a4e9f6a1b96a30717487da0730c46fc895832c37d460c27ccab9f31d064982c1054096

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Dseyznm\rxqefi.exe
MD5
4c35956aafde8bc2c58868baa53db923

SHA1
53def6e75c769a4d2e874ccac24aa4b0261d90d1

SHA256
53b4b521ba57363330e4113c1b1883168441d95ed5db2f06438bd2e5e3ddb5e1

SHA512
8d05424d6f01f1139918b17b9986125ad3788c5ddebfce100795767931a4e9f6a1b96a30717487da0730c46fc895832c37d460c27ccab9f31d064982c1054096

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Dseyznm\rxqefi.exe
MD5
4c35956aafde8bc2c58868baa53db923

SHA1
53def6e75c769a4d2e874ccac24aa4b0261d90d1

SHA256
53b4b521ba57363330e4113c1b1883168441d95ed5db2f06438bd2e5e3ddb5e1

SHA512
8d05424d6f01f1139918b17b9986125ad3788c5ddebfce100795767931a4e9f6a1b96a30717487da0730c46fc895832c37d460c27ccab9f31d064982c1054096

Download Submit
memory/516-15-0x0000000000000000-mapping.dmp

Download
memory/620-24-0x0000000002900000-0x0000000002911000-memory.dmp

Filesize
68KB

Download
memory/620-19-0x0000000000000000-mapping.dmp

Download
memory/892-2-0x0000000074D91000-0x0000000074D93000-memory.dmp

Filesize
8KB

Download
memory/892-4-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/892-3-0x0000000000220000-0x0000000000264000-memory.dmp

Filesize
272KB

Download
memory/1060-9-0x00000000027E0000-0x00000000027F1000-memory.dmp

Filesize
68KB

Download
memory/1060-5-0x0000000000000000-mapping.dmp

Download
memory/1236-25-0x0000000000000000-mapping.dmp

Download
memory/1236-27-0x00000000748A1000-0x00000000748A3000-memory.dmp

Filesize
8KB

Download
memory/1236-28-0x0000000000080000-0x00000000000C7000-memory.dmp

Filesize
284KB

Download
memory/1236-29-0x0000000000510000-0x0000000000547000-memory.dmp

Filesize
220KB

Download
memory/1596-31-0x0000000000000000-mapping.dmp

Download
memory/1604-17-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1604-12-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads