qakbot | 3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033

General

Target

oechye.exe
Size

3.4MB
MD5

abddab5ff34dbfae92c8fca7a524a06f
SHA1

6deec6f703c76e34cd415e83e8a574ac2c97751d
SHA256

3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033
SHA512

29d5b76ccf268bd92d48f79c86c2b037a1fa95c72e0289bfe5d7396f87fe1c5ba0872bc9b15255591f379bab63eab0100b523fb5c7f12fdf0255eb7a01491298

Score

10^/10

qakbot notset 1596817234 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1596817234

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

47.44.217.98:443

86.97.146.204:2222

65.60.228.130:443

216.201.162.158:443

94.59.24.79:995

108.46.145.30:443

24.139.132.70:443

47.206.174.82:443

188.52.106.206:20

72.204.242.138:6881

173.173.72.199:443

71.163.224.206:443

63.155.9.141:995

100.34.195.237:443

47.39.177.171:2222

96.20.108.17:2222

115.21.224.117:443

70.164.39.91:443

45.47.65.191:443

207.155.107.111:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

oduofi.exeoduofi.exe

pid process

936 oduofi.exe
848 oduofi.exe
Loads dropped DLL 2 IoCs

Processes:

oechye.exe

pid process

1932 oechye.exe
1932 oechye.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1844 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

oechye.exeoechye.exeoduofi.exeoduofi.exeexplorer.exeoechye.exe

pid process

1932 oechye.exe
1612 oechye.exe
1612 oechye.exe
936 oduofi.exe
848 oduofi.exe
848 oduofi.exe
1508 explorer.exe
1508 explorer.exe
1516 oechye.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

oduofi.exe

pid process

936 oduofi.exe

pid	process
936	oduofi.exe
848	oduofi.exe

pid	process
1932	oechye.exe
1932	oechye.exe

pid	process
1844	schtasks.exe

pid	process
1932	oechye.exe
1612	oechye.exe
1612	oechye.exe
936	oduofi.exe
848	oduofi.exe
848	oduofi.exe
1508	explorer.exe
1508	explorer.exe
1516	oechye.exe

pid	process
936	oduofi.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

oechye.exeoduofi.exetaskeng.exe

description	pid	process	target process
PID 1932 wrote to memory of 1612	1932	oechye.exe	oechye.exe
PID 1932 wrote to memory of 1612	1932	oechye.exe	oechye.exe
PID 1932 wrote to memory of 1612	1932	oechye.exe	oechye.exe
PID 1932 wrote to memory of 1612	1932	oechye.exe	oechye.exe
PID 1932 wrote to memory of 936	1932	oechye.exe	oduofi.exe
PID 1932 wrote to memory of 936	1932	oechye.exe	oduofi.exe
PID 1932 wrote to memory of 936	1932	oechye.exe	oduofi.exe
PID 1932 wrote to memory of 936	1932	oechye.exe	oduofi.exe
PID 1932 wrote to memory of 1844	1932	oechye.exe	schtasks.exe
PID 1932 wrote to memory of 1844	1932	oechye.exe	schtasks.exe
PID 1932 wrote to memory of 1844	1932	oechye.exe	schtasks.exe
PID 1932 wrote to memory of 1844	1932	oechye.exe	schtasks.exe
PID 936 wrote to memory of 848	936	oduofi.exe	oduofi.exe
PID 936 wrote to memory of 848	936	oduofi.exe	oduofi.exe
PID 936 wrote to memory of 848	936	oduofi.exe	oduofi.exe
PID 936 wrote to memory of 848	936	oduofi.exe	oduofi.exe
PID 936 wrote to memory of 1508	936	oduofi.exe	explorer.exe
PID 936 wrote to memory of 1508	936	oduofi.exe	explorer.exe
PID 936 wrote to memory of 1508	936	oduofi.exe	explorer.exe
PID 936 wrote to memory of 1508	936	oduofi.exe	explorer.exe
PID 936 wrote to memory of 1508	936	oduofi.exe	explorer.exe
PID 1156 wrote to memory of 1516	1156	taskeng.exe	oechye.exe
PID 1156 wrote to memory of 1516	1156	taskeng.exe	oechye.exe
PID 1156 wrote to memory of 1516	1156	taskeng.exe	oechye.exe
PID 1156 wrote to memory of 1516	1156	taskeng.exe	oechye.exe

C:\Users\Admin\AppData\Local\Temp\oechye.exe
"C:\Users\Admin\AppData\Local\Temp\oechye.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\AppData\Local\Temp\oechye.exe
C:\Users\Admin\AppData\Local\Temp\oechye.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1612

C:\Users\Admin\AppData\Roaming\Microsoft\Axzfjm\oduofi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Axzfjm\oduofi.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:936

C:\Users\Admin\AppData\Roaming\Microsoft\Axzfjm\oduofi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Axzfjm\oduofi.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:848

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1508

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rtogvwf /tr "\"C:\Users\Admin\AppData\Local\Temp\oechye.exe\" /I rtogvwf" /SC ONCE /Z /ST 20:30 /ET 20:42
2⤵
- Creates scheduled task(s)
PID:1844

C:\Windows\system32\taskeng.exe
taskeng.exe {69F14A5C-DD9F-491C-804E-DDD52A35F0E0} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1156

C:\Users\Admin\AppData\Local\Temp\oechye.exe
C:\Users\Admin\AppData\Local\Temp\oechye.exe /I rtogvwf
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1516

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Axzfjm\oduofi.dat
MD5
ec079dd485fa348af005b104dc8d6fa5

SHA1
838bb89dc77de27f817f64e8fd0085889be6fdc5

SHA256
ac8b8971fc08871aad02f218dc9b243b26270571e9563e2bbeb63e87919f053b

SHA512
5dd2be4ce9699ead6947a32f3b3f3ed0f3fb922af4032d22dd02e092318e30cd8b3a2dbae0d491656817541bdbebe0ffc67bde44f0984077e829948ebb7dc65f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Axzfjm\oduofi.exe
MD5
abddab5ff34dbfae92c8fca7a524a06f

SHA1
6deec6f703c76e34cd415e83e8a574ac2c97751d

SHA256
3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033

SHA512
29d5b76ccf268bd92d48f79c86c2b037a1fa95c72e0289bfe5d7396f87fe1c5ba0872bc9b15255591f379bab63eab0100b523fb5c7f12fdf0255eb7a01491298

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Axzfjm\oduofi.exe
MD5
abddab5ff34dbfae92c8fca7a524a06f

SHA1
6deec6f703c76e34cd415e83e8a574ac2c97751d

SHA256
3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033

SHA512
29d5b76ccf268bd92d48f79c86c2b037a1fa95c72e0289bfe5d7396f87fe1c5ba0872bc9b15255591f379bab63eab0100b523fb5c7f12fdf0255eb7a01491298

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Axzfjm\oduofi.exe
MD5
abddab5ff34dbfae92c8fca7a524a06f

SHA1
6deec6f703c76e34cd415e83e8a574ac2c97751d

SHA256
3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033

SHA512
29d5b76ccf268bd92d48f79c86c2b037a1fa95c72e0289bfe5d7396f87fe1c5ba0872bc9b15255591f379bab63eab0100b523fb5c7f12fdf0255eb7a01491298

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Axzfjm\oduofi.exe
MD5
abddab5ff34dbfae92c8fca7a524a06f

SHA1
6deec6f703c76e34cd415e83e8a574ac2c97751d

SHA256
3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033

SHA512
29d5b76ccf268bd92d48f79c86c2b037a1fa95c72e0289bfe5d7396f87fe1c5ba0872bc9b15255591f379bab63eab0100b523fb5c7f12fdf0255eb7a01491298

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Axzfjm\oduofi.exe
MD5
abddab5ff34dbfae92c8fca7a524a06f

SHA1
6deec6f703c76e34cd415e83e8a574ac2c97751d

SHA256
3d7d056acc758c78d5e3741389d6fa62e551b4738a57d199f171332f4ea8c033

SHA512
29d5b76ccf268bd92d48f79c86c2b037a1fa95c72e0289bfe5d7396f87fe1c5ba0872bc9b15255591f379bab63eab0100b523fb5c7f12fdf0255eb7a01491298

Download Submit
memory/848-24-0x0000000002820000-0x0000000002831000-memory.dmp

Filesize
68KB

Download
memory/848-19-0x0000000000000000-mapping.dmp

Download
memory/936-17-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/936-12-0x0000000000000000-mapping.dmp

Download
memory/1508-25-0x0000000000000000-mapping.dmp

Download
memory/1508-27-0x0000000074261000-0x0000000074263000-memory.dmp

Filesize
8KB

Download
memory/1508-28-0x0000000000080000-0x00000000000C7000-memory.dmp

Filesize
284KB

Download
memory/1508-29-0x0000000000210000-0x0000000000247000-memory.dmp

Filesize
220KB

Download
memory/1516-31-0x0000000000000000-mapping.dmp

Download
memory/1612-9-0x0000000002770000-0x0000000002781000-memory.dmp

Filesize
68KB

Download
memory/1612-5-0x0000000000000000-mapping.dmp

Download
memory/1844-15-0x0000000000000000-mapping.dmp

Download
memory/1932-2-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1932-4-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1932-3-0x00000000002A0000-0x00000000002E4000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads