qakbot | 0932d35419de1b82ec5bc2e38a00f414345ee6b61fd5a442b87fd2fd02df9ef7

General

Target

pkuefs.exe
Size

1.0MB
MD5

ce5b6824ebac103f3cce10b0f7ef5264
SHA1

b2e618460c519e401615b8a66b635cc07707f34f
SHA256

0932d35419de1b82ec5bc2e38a00f414345ee6b61fd5a442b87fd2fd02df9ef7
SHA512

5a3645ab1cb1eb65bd7f867dcf3cc827cabc162ed1c3560d0562ad10e244ce13f642a942329e505c714ffe1aa9d6702ab44a5f6073a4a9f90f4c042d06b02968

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

olqccaih.exeolqccaih.exe

pid process

1420 olqccaih.exe
1588 olqccaih.exe
Loads dropped DLL 2 IoCs

Processes:

pkuefs.exe

pid process

596 pkuefs.exe
596 pkuefs.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1368 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

pkuefs.exepkuefs.exeolqccaih.exeolqccaih.exeexplorer.exepkuefs.exe

pid process

596 pkuefs.exe
876 pkuefs.exe
876 pkuefs.exe
1420 olqccaih.exe
1588 olqccaih.exe
1588 olqccaih.exe
732 explorer.exe
732 explorer.exe
2040 pkuefs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

olqccaih.exe

pid process

1420 olqccaih.exe

pid	process
1420	olqccaih.exe
1588	olqccaih.exe

pid	process
596	pkuefs.exe
596	pkuefs.exe

pid	process
1368	schtasks.exe

pid	process
596	pkuefs.exe
876	pkuefs.exe
876	pkuefs.exe
1420	olqccaih.exe
1588	olqccaih.exe
1588	olqccaih.exe
732	explorer.exe
732	explorer.exe
2040	pkuefs.exe

pid	process
1420	olqccaih.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

pkuefs.exeolqccaih.exetaskeng.exe

description	pid	process	target process
PID 596 wrote to memory of 876	596	pkuefs.exe	pkuefs.exe
PID 596 wrote to memory of 876	596	pkuefs.exe	pkuefs.exe
PID 596 wrote to memory of 876	596	pkuefs.exe	pkuefs.exe
PID 596 wrote to memory of 876	596	pkuefs.exe	pkuefs.exe
PID 596 wrote to memory of 1420	596	pkuefs.exe	olqccaih.exe
PID 596 wrote to memory of 1420	596	pkuefs.exe	olqccaih.exe
PID 596 wrote to memory of 1420	596	pkuefs.exe	olqccaih.exe
PID 596 wrote to memory of 1420	596	pkuefs.exe	olqccaih.exe
PID 596 wrote to memory of 1368	596	pkuefs.exe	schtasks.exe
PID 596 wrote to memory of 1368	596	pkuefs.exe	schtasks.exe
PID 596 wrote to memory of 1368	596	pkuefs.exe	schtasks.exe
PID 596 wrote to memory of 1368	596	pkuefs.exe	schtasks.exe
PID 1420 wrote to memory of 1588	1420	olqccaih.exe	olqccaih.exe
PID 1420 wrote to memory of 1588	1420	olqccaih.exe	olqccaih.exe
PID 1420 wrote to memory of 1588	1420	olqccaih.exe	olqccaih.exe
PID 1420 wrote to memory of 1588	1420	olqccaih.exe	olqccaih.exe
PID 1420 wrote to memory of 732	1420	olqccaih.exe	explorer.exe
PID 1420 wrote to memory of 732	1420	olqccaih.exe	explorer.exe
PID 1420 wrote to memory of 732	1420	olqccaih.exe	explorer.exe
PID 1420 wrote to memory of 732	1420	olqccaih.exe	explorer.exe
PID 1420 wrote to memory of 732	1420	olqccaih.exe	explorer.exe
PID 1856 wrote to memory of 2040	1856	taskeng.exe	pkuefs.exe
PID 1856 wrote to memory of 2040	1856	taskeng.exe	pkuefs.exe
PID 1856 wrote to memory of 2040	1856	taskeng.exe	pkuefs.exe
PID 1856 wrote to memory of 2040	1856	taskeng.exe	pkuefs.exe

C:\Users\Admin\AppData\Local\Temp\pkuefs.exe
"C:\Users\Admin\AppData\Local\Temp\pkuefs.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:596

C:\Users\Admin\AppData\Local\Temp\pkuefs.exe
C:\Users\Admin\AppData\Local\Temp\pkuefs.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:876

C:\Users\Admin\AppData\Roaming\Microsoft\Yseixiy\olqccaih.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Yseixiy\olqccaih.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1420

C:\Users\Admin\AppData\Roaming\Microsoft\Yseixiy\olqccaih.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Yseixiy\olqccaih.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1588

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:732

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn otfyxqe /tr "\"C:\Users\Admin\AppData\Local\Temp\pkuefs.exe\" /I otfyxqe" /SC ONCE /Z /ST 14:44 /ET 14:56
2⤵
- Creates scheduled task(s)
PID:1368

C:\Windows\system32\taskeng.exe
taskeng.exe {7D63C0B4-2EE4-49C2-A22B-99F58E76BB2E} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1856

C:\Users\Admin\AppData\Local\Temp\pkuefs.exe
C:\Users\Admin\AppData\Local\Temp\pkuefs.exe /I otfyxqe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Yseixiy\olqccaih.dat
MD5
2c4fb906a017f57ff8c1410584b8a0bd

SHA1
aa6f8f256bdf06e9789b38fa128dc0c63a55a070

SHA256
f86748de0464415f3269daecc56073bd098e10ca0c43cada5c899e342809ba79

SHA512
8a36cb0dea831b75c88dd762d2077c86be7285a06ec87923e7aefd67c94ed101ace094908fc392623ad0084a9539ce3240b17b5965c2649fdf8f62e369505716

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yseixiy\olqccaih.exe
MD5
ce5b6824ebac103f3cce10b0f7ef5264

SHA1
b2e618460c519e401615b8a66b635cc07707f34f

SHA256
0932d35419de1b82ec5bc2e38a00f414345ee6b61fd5a442b87fd2fd02df9ef7

SHA512
5a3645ab1cb1eb65bd7f867dcf3cc827cabc162ed1c3560d0562ad10e244ce13f642a942329e505c714ffe1aa9d6702ab44a5f6073a4a9f90f4c042d06b02968

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yseixiy\olqccaih.exe
MD5
ce5b6824ebac103f3cce10b0f7ef5264

SHA1
b2e618460c519e401615b8a66b635cc07707f34f

SHA256
0932d35419de1b82ec5bc2e38a00f414345ee6b61fd5a442b87fd2fd02df9ef7

SHA512
5a3645ab1cb1eb65bd7f867dcf3cc827cabc162ed1c3560d0562ad10e244ce13f642a942329e505c714ffe1aa9d6702ab44a5f6073a4a9f90f4c042d06b02968

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yseixiy\olqccaih.exe
MD5
ce5b6824ebac103f3cce10b0f7ef5264

SHA1
b2e618460c519e401615b8a66b635cc07707f34f

SHA256
0932d35419de1b82ec5bc2e38a00f414345ee6b61fd5a442b87fd2fd02df9ef7

SHA512
5a3645ab1cb1eb65bd7f867dcf3cc827cabc162ed1c3560d0562ad10e244ce13f642a942329e505c714ffe1aa9d6702ab44a5f6073a4a9f90f4c042d06b02968

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Yseixiy\olqccaih.exe
MD5
ce5b6824ebac103f3cce10b0f7ef5264

SHA1
b2e618460c519e401615b8a66b635cc07707f34f

SHA256
0932d35419de1b82ec5bc2e38a00f414345ee6b61fd5a442b87fd2fd02df9ef7

SHA512
5a3645ab1cb1eb65bd7f867dcf3cc827cabc162ed1c3560d0562ad10e244ce13f642a942329e505c714ffe1aa9d6702ab44a5f6073a4a9f90f4c042d06b02968

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Yseixiy\olqccaih.exe
MD5
ce5b6824ebac103f3cce10b0f7ef5264

SHA1
b2e618460c519e401615b8a66b635cc07707f34f

SHA256
0932d35419de1b82ec5bc2e38a00f414345ee6b61fd5a442b87fd2fd02df9ef7

SHA512
5a3645ab1cb1eb65bd7f867dcf3cc827cabc162ed1c3560d0562ad10e244ce13f642a942329e505c714ffe1aa9d6702ab44a5f6073a4a9f90f4c042d06b02968

Download Submit
memory/732-13-0x0000000000000000-mapping.dmp

Download
memory/876-0-0x0000000000000000-mapping.dmp

Download
memory/876-1-0x0000000002630000-0x0000000002641000-memory.dmp

Filesize
68KB

Download
memory/1368-6-0x0000000000000000-mapping.dmp

Download
memory/1420-4-0x0000000000000000-mapping.dmp

Download
memory/1420-12-0x0000000001F30000-0x0000000001F6A000-memory.dmp

Filesize
232KB

Download
memory/1588-8-0x0000000000000000-mapping.dmp

Download
memory/1588-11-0x00000000025D0000-0x00000000025E1000-memory.dmp

Filesize
68KB

Download
memory/2040-15-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads