qakbot | 73ae67036a0d291c18208037010de359520cd613dda2f9eabfde3fec5558324f

Target

update2.exe
Size

746KB
MD5

0bfb4a1efbb20a7291fcc022dec7d58b
SHA1

faec2a0afe296224f980ac059cf63f18eba800ce
SHA256

73ae67036a0d291c18208037010de359520cd613dda2f9eabfde3fec5558324f
SHA512

eae0e585ef29f56f27da897783ec582b228124437a6355cfd7b56be229558913dfd87d3005482c0fe54ba8f5e79fb1d50f869bd0e619b0ca7318ac055c62b425

Score

10^/10

qakbot 1572863946 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

323.91

Campaign

1572863946

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
[email protected]
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
[email protected]
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
[email protected]
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
[email protected]
Password:
eQyicNLzzqPN

112.171.126.153:443

67.200.146.98:2222

174.16.234.171:993

71.30.56.170:443

71.77.231.251:443

72.213.98.233:443

2.50.170.151:443

184.180.157.203:2222

96.35.170.82:2222

64.19.74.29:995

104.32.185.213:2222

104.3.91.20:995

173.22.120.11:2222

173.3.132.17:995

74.194.4.181:443

75.131.72.82:443

68.238.144.55:443

100.4.185.8:443

104.34.122.18:443

65.30.12.240:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

vokune.exevokune.exe

pid process

1708 vokune.exe
556 vokune.exe
Loads dropped DLL 9 IoCs

Processes:

update2.exevokune.exevokune.exe

pid process

1888 update2.exe
1888 update2.exe
1708 vokune.exe
1708 vokune.exe
1708 vokune.exe
1708 vokune.exe
556 vokune.exe
556 vokune.exe
556 vokune.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1536 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

update2.exeupdate2.exevokune.exevokune.exeexplorer.exe

pid process

1888 update2.exe
296 update2.exe
296 update2.exe
1708 vokune.exe
556 vokune.exe
556 vokune.exe
1172 explorer.exe
1172 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

vokune.exe

pid process

1708 vokune.exe

pid	process
1708	vokune.exe
556	vokune.exe

pid	process
1888	update2.exe
1888	update2.exe
1708	vokune.exe
1708	vokune.exe
1708	vokune.exe
1708	vokune.exe
556	vokune.exe
556	vokune.exe
556	vokune.exe

pid	process
1536	schtasks.exe

pid	process
1888	update2.exe
296	update2.exe
296	update2.exe
1708	vokune.exe
556	vokune.exe
556	vokune.exe
1172	explorer.exe
1172	explorer.exe

pid	process
1708	vokune.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

update2.exevokune.exe

description	pid	process	target process
PID 1888 wrote to memory of 296	1888	update2.exe	update2.exe
PID 1888 wrote to memory of 296	1888	update2.exe	update2.exe
PID 1888 wrote to memory of 296	1888	update2.exe	update2.exe
PID 1888 wrote to memory of 296	1888	update2.exe	update2.exe
PID 1888 wrote to memory of 296	1888	update2.exe	update2.exe
PID 1888 wrote to memory of 296	1888	update2.exe	update2.exe
PID 1888 wrote to memory of 296	1888	update2.exe	update2.exe
PID 1888 wrote to memory of 1708	1888	update2.exe	vokune.exe
PID 1888 wrote to memory of 1708	1888	update2.exe	vokune.exe
PID 1888 wrote to memory of 1708	1888	update2.exe	vokune.exe
PID 1888 wrote to memory of 1708	1888	update2.exe	vokune.exe
PID 1888 wrote to memory of 1708	1888	update2.exe	vokune.exe
PID 1888 wrote to memory of 1708	1888	update2.exe	vokune.exe
PID 1888 wrote to memory of 1708	1888	update2.exe	vokune.exe
PID 1888 wrote to memory of 1536	1888	update2.exe	schtasks.exe
PID 1888 wrote to memory of 1536	1888	update2.exe	schtasks.exe
PID 1888 wrote to memory of 1536	1888	update2.exe	schtasks.exe
PID 1888 wrote to memory of 1536	1888	update2.exe	schtasks.exe
PID 1888 wrote to memory of 1536	1888	update2.exe	schtasks.exe
PID 1888 wrote to memory of 1536	1888	update2.exe	schtasks.exe
PID 1888 wrote to memory of 1536	1888	update2.exe	schtasks.exe
PID 1708 wrote to memory of 556	1708	vokune.exe	vokune.exe
PID 1708 wrote to memory of 556	1708	vokune.exe	vokune.exe
PID 1708 wrote to memory of 556	1708	vokune.exe	vokune.exe
PID 1708 wrote to memory of 556	1708	vokune.exe	vokune.exe
PID 1708 wrote to memory of 556	1708	vokune.exe	vokune.exe
PID 1708 wrote to memory of 556	1708	vokune.exe	vokune.exe
PID 1708 wrote to memory of 556	1708	vokune.exe	vokune.exe
PID 1708 wrote to memory of 1172	1708	vokune.exe	explorer.exe
PID 1708 wrote to memory of 1172	1708	vokune.exe	explorer.exe
PID 1708 wrote to memory of 1172	1708	vokune.exe	explorer.exe
PID 1708 wrote to memory of 1172	1708	vokune.exe	explorer.exe
PID 1708 wrote to memory of 1172	1708	vokune.exe	explorer.exe
PID 1708 wrote to memory of 1172	1708	vokune.exe	explorer.exe
PID 1708 wrote to memory of 1172	1708	vokune.exe	explorer.exe
PID 1708 wrote to memory of 1172	1708	vokune.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\update2.exe
"C:\Users\Admin\AppData\Local\Temp\update2.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\update2.exe
  C:\Users\Admin\AppData\Local\Temp\update2.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:296
- C:\Users\Admin\AppData\Roaming\Microsoft\Auluzojyye\vokune.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Auluzojyye\vokune.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Users\Admin\AppData\Roaming\Microsoft\Auluzojyye\vokune.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Auluzojyye\vokune.exe /C
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:556
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1172
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zfzyctso /tr "\"C:\Users\Admin\AppData\Local\Temp\update2.exe\" /I zfzyctso" /SC ONCE /Z /ST 12:27 /ET 12:39
  2⤵
  - Creates scheduled task(s)
  PID:1536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Auluzojyye\vokune.dat

MD5
7036f63954301c11cc3082d55cd912f6

SHA1
ec75da6a4409100d1264daaedbbe2ac0a7b7aa5e

SHA256
347c3fc553dd2afce937236e92b4f8d31397698f33918e45cb7b467396dce53b

SHA512
1fe943347136559fe78906b9e02824e90c274e47d6ba8be53aefb0b982baf9921f3b9426e2b61d3f060ffb848f0fa5fa5b486776c7989f6c5b8e012345efc8d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Auluzojyye\vokune.exe

MD5
0bfb4a1efbb20a7291fcc022dec7d58b

SHA1
faec2a0afe296224f980ac059cf63f18eba800ce

SHA256
73ae67036a0d291c18208037010de359520cd613dda2f9eabfde3fec5558324f

SHA512
eae0e585ef29f56f27da897783ec582b228124437a6355cfd7b56be229558913dfd87d3005482c0fe54ba8f5e79fb1d50f869bd0e619b0ca7318ac055c62b425

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Auluzojyye\vokune.exe

MD5
0bfb4a1efbb20a7291fcc022dec7d58b

SHA1
faec2a0afe296224f980ac059cf63f18eba800ce

SHA256
73ae67036a0d291c18208037010de359520cd613dda2f9eabfde3fec5558324f

SHA512
eae0e585ef29f56f27da897783ec582b228124437a6355cfd7b56be229558913dfd87d3005482c0fe54ba8f5e79fb1d50f869bd0e619b0ca7318ac055c62b425

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Auluzojyye\vokune.exe

MD5
0bfb4a1efbb20a7291fcc022dec7d58b

SHA1
faec2a0afe296224f980ac059cf63f18eba800ce

SHA256
73ae67036a0d291c18208037010de359520cd613dda2f9eabfde3fec5558324f

SHA512
eae0e585ef29f56f27da897783ec582b228124437a6355cfd7b56be229558913dfd87d3005482c0fe54ba8f5e79fb1d50f869bd0e619b0ca7318ac055c62b425

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Auluzojyye\vokune.exe

MD5
0bfb4a1efbb20a7291fcc022dec7d58b

SHA1
faec2a0afe296224f980ac059cf63f18eba800ce

SHA256
73ae67036a0d291c18208037010de359520cd613dda2f9eabfde3fec5558324f

SHA512
eae0e585ef29f56f27da897783ec582b228124437a6355cfd7b56be229558913dfd87d3005482c0fe54ba8f5e79fb1d50f869bd0e619b0ca7318ac055c62b425

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Auluzojyye\vokune.exe

MD5
0bfb4a1efbb20a7291fcc022dec7d58b

SHA1
faec2a0afe296224f980ac059cf63f18eba800ce

SHA256
73ae67036a0d291c18208037010de359520cd613dda2f9eabfde3fec5558324f

SHA512
eae0e585ef29f56f27da897783ec582b228124437a6355cfd7b56be229558913dfd87d3005482c0fe54ba8f5e79fb1d50f869bd0e619b0ca7318ac055c62b425

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Auluzojyye\vokune.exe

MD5
0bfb4a1efbb20a7291fcc022dec7d58b

SHA1
faec2a0afe296224f980ac059cf63f18eba800ce

SHA256
73ae67036a0d291c18208037010de359520cd613dda2f9eabfde3fec5558324f

SHA512
eae0e585ef29f56f27da897783ec582b228124437a6355cfd7b56be229558913dfd87d3005482c0fe54ba8f5e79fb1d50f869bd0e619b0ca7318ac055c62b425

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Auluzojyye\vokune.exe

MD5
0bfb4a1efbb20a7291fcc022dec7d58b

SHA1
faec2a0afe296224f980ac059cf63f18eba800ce

SHA256
73ae67036a0d291c18208037010de359520cd613dda2f9eabfde3fec5558324f

SHA512
eae0e585ef29f56f27da897783ec582b228124437a6355cfd7b56be229558913dfd87d3005482c0fe54ba8f5e79fb1d50f869bd0e619b0ca7318ac055c62b425

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Auluzojyye\vokune.exe

MD5
0bfb4a1efbb20a7291fcc022dec7d58b

SHA1
faec2a0afe296224f980ac059cf63f18eba800ce

SHA256
73ae67036a0d291c18208037010de359520cd613dda2f9eabfde3fec5558324f

SHA512
eae0e585ef29f56f27da897783ec582b228124437a6355cfd7b56be229558913dfd87d3005482c0fe54ba8f5e79fb1d50f869bd0e619b0ca7318ac055c62b425

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Auluzojyye\vokune.exe

MD5
0bfb4a1efbb20a7291fcc022dec7d58b

SHA1
faec2a0afe296224f980ac059cf63f18eba800ce

SHA256
73ae67036a0d291c18208037010de359520cd613dda2f9eabfde3fec5558324f

SHA512
eae0e585ef29f56f27da897783ec582b228124437a6355cfd7b56be229558913dfd87d3005482c0fe54ba8f5e79fb1d50f869bd0e619b0ca7318ac055c62b425

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Auluzojyye\vokune.exe

MD5
0bfb4a1efbb20a7291fcc022dec7d58b

SHA1
faec2a0afe296224f980ac059cf63f18eba800ce

SHA256
73ae67036a0d291c18208037010de359520cd613dda2f9eabfde3fec5558324f

SHA512
eae0e585ef29f56f27da897783ec582b228124437a6355cfd7b56be229558913dfd87d3005482c0fe54ba8f5e79fb1d50f869bd0e619b0ca7318ac055c62b425

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Auluzojyye\vokune.exe

MD5
0bfb4a1efbb20a7291fcc022dec7d58b

SHA1
faec2a0afe296224f980ac059cf63f18eba800ce

SHA256
73ae67036a0d291c18208037010de359520cd613dda2f9eabfde3fec5558324f

SHA512
eae0e585ef29f56f27da897783ec582b228124437a6355cfd7b56be229558913dfd87d3005482c0fe54ba8f5e79fb1d50f869bd0e619b0ca7318ac055c62b425

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Auluzojyye\vokune.exe

MD5
0bfb4a1efbb20a7291fcc022dec7d58b

SHA1
faec2a0afe296224f980ac059cf63f18eba800ce

SHA256
73ae67036a0d291c18208037010de359520cd613dda2f9eabfde3fec5558324f

SHA512
eae0e585ef29f56f27da897783ec582b228124437a6355cfd7b56be229558913dfd87d3005482c0fe54ba8f5e79fb1d50f869bd0e619b0ca7318ac055c62b425

Download Submit
memory/296-63-0x0000000000000000-mapping.dmp

Download
memory/556-81-0x0000000000000000-mapping.dmp

Download
memory/1172-93-0x0000000000150000-0x00000000001E2000-memory.dmp

Filesize
584KB

Download
memory/1172-94-0x00000000008B0000-0x00000000008F1000-memory.dmp

Filesize
260KB

Download
memory/1172-91-0x00000000741E1000-0x00000000741E3000-memory.dmp

Filesize
8KB

Download
memory/1172-89-0x0000000000000000-mapping.dmp

Download
memory/1536-78-0x0000000000000000-mapping.dmp

Download
memory/1708-69-0x0000000000000000-mapping.dmp

Download
memory/1888-59-0x0000000075161000-0x0000000075163000-memory.dmp

Filesize
8KB

Download
memory/1888-62-0x0000000002090000-0x0000000002122000-memory.dmp

Filesize
584KB

Download
memory/1888-60-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download