qakbot | b92c0aafb4e9b0fc2b023dbb14d7e848249f29e02b0e4cd8624ce27e55c9ac4c

General

Target

qakbot.exe
Size

2.7MB
MD5

6f9e304b289770a66e089ae2be83952c
SHA1

629c55b8e3e4fd9a6c0a4463ef5d30ceda133eb8
SHA256

b92c0aafb4e9b0fc2b023dbb14d7e848249f29e02b0e4cd8624ce27e55c9ac4c
SHA512

c621eb4c8f51bae2e75cbffd53db8173d91340e2987cccd15453a2a2c048d9820b26b64e0d51fbfb441e5dbf4f9108cfbe46bda872f2980491028d93fcb33f94
SSDEEP

12288:hmJnJHUrcxNxDxfxNxnxNxIWxNxsyRxNxRxNx0xNxrjG8zme:w5cir

Score

10^/10

qakbot spx156 1597661994 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

spx156

Campaign

1597661994

C2

98.26.50.62:995

46.53.40.244:443

86.98.89.40:2222

108.30.125.94:443

189.130.26.216:443

96.37.113.36:993

216.201.162.158:443

24.37.178.158:443

73.228.1.246:443

175.111.128.234:443

95.77.144.238:443

41.36.58.89:995

84.247.55.190:443

66.215.32.224:443

67.6.3.51:443

197.37.219.90:993

144.202.48.107:443

49.191.130.48:443

73.214.248.17:995

24.44.142.213:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

ejmyh.exeejmyh.exe

pid process

2632 ejmyh.exe
2548 ejmyh.exe
Loads dropped DLL 2 IoCs

Processes:

qakbot.exe

pid process

2604 qakbot.exe
2604 qakbot.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2680 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

qakbot.exeqakbot.exeejmyh.exeejmyh.exeexplorer.exeqakbot.exe

pid process

2604 qakbot.exe
2540 qakbot.exe
2540 qakbot.exe
2632 ejmyh.exe
2548 ejmyh.exe
2548 ejmyh.exe
2820 explorer.exe
2820 explorer.exe
1460 qakbot.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ejmyh.exe

pid process

2632 ejmyh.exe

pid	process
2632	ejmyh.exe
2548	ejmyh.exe

pid	process
2604	qakbot.exe
2604	qakbot.exe

pid	process
2680	schtasks.exe

pid	process
2604	qakbot.exe
2540	qakbot.exe
2540	qakbot.exe
2632	ejmyh.exe
2548	ejmyh.exe
2548	ejmyh.exe
2820	explorer.exe
2820	explorer.exe
1460	qakbot.exe

pid	process
2632	ejmyh.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

qakbot.exeejmyh.exetaskeng.exe

description	pid	process	target process
PID 2604 wrote to memory of 2540	2604	qakbot.exe	qakbot.exe
PID 2604 wrote to memory of 2540	2604	qakbot.exe	qakbot.exe
PID 2604 wrote to memory of 2540	2604	qakbot.exe	qakbot.exe
PID 2604 wrote to memory of 2540	2604	qakbot.exe	qakbot.exe
PID 2604 wrote to memory of 2632	2604	qakbot.exe	ejmyh.exe
PID 2604 wrote to memory of 2632	2604	qakbot.exe	ejmyh.exe
PID 2604 wrote to memory of 2632	2604	qakbot.exe	ejmyh.exe
PID 2604 wrote to memory of 2632	2604	qakbot.exe	ejmyh.exe
PID 2604 wrote to memory of 2680	2604	qakbot.exe	schtasks.exe
PID 2604 wrote to memory of 2680	2604	qakbot.exe	schtasks.exe
PID 2604 wrote to memory of 2680	2604	qakbot.exe	schtasks.exe
PID 2604 wrote to memory of 2680	2604	qakbot.exe	schtasks.exe
PID 2632 wrote to memory of 2548	2632	ejmyh.exe	ejmyh.exe
PID 2632 wrote to memory of 2548	2632	ejmyh.exe	ejmyh.exe
PID 2632 wrote to memory of 2548	2632	ejmyh.exe	ejmyh.exe
PID 2632 wrote to memory of 2548	2632	ejmyh.exe	ejmyh.exe
PID 2632 wrote to memory of 2820	2632	ejmyh.exe	explorer.exe
PID 2632 wrote to memory of 2820	2632	ejmyh.exe	explorer.exe
PID 2632 wrote to memory of 2820	2632	ejmyh.exe	explorer.exe
PID 2632 wrote to memory of 2820	2632	ejmyh.exe	explorer.exe
PID 2632 wrote to memory of 2820	2632	ejmyh.exe	explorer.exe
PID 1564 wrote to memory of 1460	1564	taskeng.exe	qakbot.exe
PID 1564 wrote to memory of 1460	1564	taskeng.exe	qakbot.exe
PID 1564 wrote to memory of 1460	1564	taskeng.exe	qakbot.exe
PID 1564 wrote to memory of 1460	1564	taskeng.exe	qakbot.exe

C:\Users\Admin\AppData\Local\Temp\qakbot.exe
"C:\Users\Admin\AppData\Local\Temp\qakbot.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Users\Admin\AppData\Local\Temp\qakbot.exe
  C:\Users\Admin\AppData\Local\Temp\qakbot.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2540
- C:\Users\Admin\AppData\Roaming\Microsoft\Zjsahhviec\ejmyh.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Zjsahhviec\ejmyh.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Users\Admin\AppData\Roaming\Microsoft\Zjsahhviec\ejmyh.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Zjsahhviec\ejmyh.exe /C
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2548
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2820
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dmjbopnhk /tr "\"C:\Users\Admin\AppData\Local\Temp\qakbot.exe\" /I dmjbopnhk" /SC ONCE /Z /ST 16:39 /ET 16:51
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2680

C:\Windows\system32\taskeng.exe
taskeng.exe {A51D10DB-809D-41D4-891B-A48986FF4352} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Local\Temp\qakbot.exe
  C:\Users\Admin\AppData\Local\Temp\qakbot.exe /I dmjbopnhk
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Zjsahhviec\ejmyh.dat

Filesize
63B

MD5
e7587d9d3a639baf67e9e2f148bad430

SHA1
63c06e43e8331fe713488580d715a1eb23fa8095

SHA256
e37b699dffecf893a7d67df81852862068c2c0f8133e61070d6c21728877ffb4

SHA512
7f5e21dd3bcc899c6e691924dd9d967c602f0805050d46429b2b320f7d130ae307319b0d2e09d744e65dc7b5072b3d444546a85e3921e2a95db2a8be22272c44

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Zjsahhviec\ejmyh.exe

Filesize
2.7MB

MD5
6f9e304b289770a66e089ae2be83952c

SHA1
629c55b8e3e4fd9a6c0a4463ef5d30ceda133eb8

SHA256
b92c0aafb4e9b0fc2b023dbb14d7e848249f29e02b0e4cd8624ce27e55c9ac4c

SHA512
c621eb4c8f51bae2e75cbffd53db8173d91340e2987cccd15453a2a2c048d9820b26b64e0d51fbfb441e5dbf4f9108cfbe46bda872f2980491028d93fcb33f94

Download Submit
memory/1460-36-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2540-5-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2540-4-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2540-6-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2548-23-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2604-18-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2604-0-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2604-3-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2604-2-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2604-1-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2632-20-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2632-24-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2632-28-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2820-25-0x0000000000CD0000-0x0000000000CFE000-memory.dmp

Filesize
184KB

Download
memory/2820-30-0x0000000000CD0000-0x0000000000CFE000-memory.dmp

Filesize
184KB

Download
memory/2820-29-0x0000000000CD0000-0x0000000000CFE000-memory.dmp

Filesize
184KB

Download
memory/2820-32-0x0000000000CD0000-0x0000000000CFE000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads