qakbot | cf7c320f20f7dc29a14a2663a6ab9b82a261b5b5f6784a17f954749df712e0ea

General

Target

pkwdud.exe
Size

1.0MB
MD5

84f20cd866ea0a01154b8eeec8191e92
SHA1

74b004421b5b3516d5ba4b8d8a00124b9e740060
SHA256

cf7c320f20f7dc29a14a2663a6ab9b82a261b5b5f6784a17f954749df712e0ea
SHA512

4df51f648dea4dc782c987e7c54d269c287f83c956109d0a0054373fa4d2677c69d539b7f817da4ec7234bf191e97305ee6771e8ed6779df4d7dc742b2e55789

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

hyoim.exehyoim.exe

pid process

1656 hyoim.exe
336 hyoim.exe
Loads dropped DLL 2 IoCs

Processes:

pkwdud.exe

pid process

2028 pkwdud.exe
2028 pkwdud.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2004 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

pkwdud.exepkwdud.exehyoim.exehyoim.exeexplorer.exepkwdud.exe

pid process

2028 pkwdud.exe
1100 pkwdud.exe
1100 pkwdud.exe
1656 hyoim.exe
336 hyoim.exe
336 hyoim.exe
1480 explorer.exe
1480 explorer.exe
344 pkwdud.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

hyoim.exe

pid process

1656 hyoim.exe

pid	process
1656	hyoim.exe
336	hyoim.exe

pid	process
2028	pkwdud.exe
2028	pkwdud.exe

pid	process
2004	schtasks.exe

pid	process
2028	pkwdud.exe
1100	pkwdud.exe
1100	pkwdud.exe
1656	hyoim.exe
336	hyoim.exe
336	hyoim.exe
1480	explorer.exe
1480	explorer.exe
344	pkwdud.exe

pid	process
1656	hyoim.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

pkwdud.exehyoim.exetaskeng.exe

description	pid	process	target process
PID 2028 wrote to memory of 1100	2028	pkwdud.exe	pkwdud.exe
PID 2028 wrote to memory of 1100	2028	pkwdud.exe	pkwdud.exe
PID 2028 wrote to memory of 1100	2028	pkwdud.exe	pkwdud.exe
PID 2028 wrote to memory of 1100	2028	pkwdud.exe	pkwdud.exe
PID 2028 wrote to memory of 1656	2028	pkwdud.exe	hyoim.exe
PID 2028 wrote to memory of 1656	2028	pkwdud.exe	hyoim.exe
PID 2028 wrote to memory of 1656	2028	pkwdud.exe	hyoim.exe
PID 2028 wrote to memory of 1656	2028	pkwdud.exe	hyoim.exe
PID 2028 wrote to memory of 2004	2028	pkwdud.exe	schtasks.exe
PID 2028 wrote to memory of 2004	2028	pkwdud.exe	schtasks.exe
PID 2028 wrote to memory of 2004	2028	pkwdud.exe	schtasks.exe
PID 2028 wrote to memory of 2004	2028	pkwdud.exe	schtasks.exe
PID 1656 wrote to memory of 336	1656	hyoim.exe	hyoim.exe
PID 1656 wrote to memory of 336	1656	hyoim.exe	hyoim.exe
PID 1656 wrote to memory of 336	1656	hyoim.exe	hyoim.exe
PID 1656 wrote to memory of 336	1656	hyoim.exe	hyoim.exe
PID 1656 wrote to memory of 1480	1656	hyoim.exe	explorer.exe
PID 1656 wrote to memory of 1480	1656	hyoim.exe	explorer.exe
PID 1656 wrote to memory of 1480	1656	hyoim.exe	explorer.exe
PID 1656 wrote to memory of 1480	1656	hyoim.exe	explorer.exe
PID 1656 wrote to memory of 1480	1656	hyoim.exe	explorer.exe
PID 1940 wrote to memory of 344	1940	taskeng.exe	pkwdud.exe
PID 1940 wrote to memory of 344	1940	taskeng.exe	pkwdud.exe
PID 1940 wrote to memory of 344	1940	taskeng.exe	pkwdud.exe
PID 1940 wrote to memory of 344	1940	taskeng.exe	pkwdud.exe

C:\Users\Admin\AppData\Local\Temp\pkwdud.exe
"C:\Users\Admin\AppData\Local\Temp\pkwdud.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\pkwdud.exe
C:\Users\Admin\AppData\Local\Temp\pkwdud.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1100

C:\Users\Admin\AppData\Roaming\Microsoft\Odcuelptxpbe\hyoim.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Odcuelptxpbe\hyoim.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\AppData\Roaming\Microsoft\Odcuelptxpbe\hyoim.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Odcuelptxpbe\hyoim.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:336

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1480

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ldzvgit /tr "\"C:\Users\Admin\AppData\Local\Temp\pkwdud.exe\" /I ldzvgit" /SC ONCE /Z /ST 14:46 /ET 14:58
2⤵
- Creates scheduled task(s)
PID:2004

C:\Windows\system32\taskeng.exe
taskeng.exe {105CB81B-282E-4616-A859-E2B481E35E25} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Users\Admin\AppData\Local\Temp\pkwdud.exe
C:\Users\Admin\AppData\Local\Temp\pkwdud.exe /I ldzvgit
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:344

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Odcuelptxpbe\hyoim.dat
MD5
9590f9efeb9e8b3ba5eaba8fe01f9799

SHA1
a39fb2af8d97db7a14ab70509f4a415c9b0a8d5b

SHA256
4c81d3749133cfcb536c79ceb4e1e94f364e8a69f07c5ff8d7af39e33e368a64

SHA512
321b828e1690f6db6353ce31f3f769b4ca89e1c379a4c3d6048637d161f128263e27733eb0a59d59f078563109c5b7c657814c630522cba342671905d7a60610

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Odcuelptxpbe\hyoim.exe
MD5
84f20cd866ea0a01154b8eeec8191e92

SHA1
74b004421b5b3516d5ba4b8d8a00124b9e740060

SHA256
cf7c320f20f7dc29a14a2663a6ab9b82a261b5b5f6784a17f954749df712e0ea

SHA512
4df51f648dea4dc782c987e7c54d269c287f83c956109d0a0054373fa4d2677c69d539b7f817da4ec7234bf191e97305ee6771e8ed6779df4d7dc742b2e55789

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Odcuelptxpbe\hyoim.exe
MD5
84f20cd866ea0a01154b8eeec8191e92

SHA1
74b004421b5b3516d5ba4b8d8a00124b9e740060

SHA256
cf7c320f20f7dc29a14a2663a6ab9b82a261b5b5f6784a17f954749df712e0ea

SHA512
4df51f648dea4dc782c987e7c54d269c287f83c956109d0a0054373fa4d2677c69d539b7f817da4ec7234bf191e97305ee6771e8ed6779df4d7dc742b2e55789

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Odcuelptxpbe\hyoim.exe
MD5
84f20cd866ea0a01154b8eeec8191e92

SHA1
74b004421b5b3516d5ba4b8d8a00124b9e740060

SHA256
cf7c320f20f7dc29a14a2663a6ab9b82a261b5b5f6784a17f954749df712e0ea

SHA512
4df51f648dea4dc782c987e7c54d269c287f83c956109d0a0054373fa4d2677c69d539b7f817da4ec7234bf191e97305ee6771e8ed6779df4d7dc742b2e55789

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Odcuelptxpbe\hyoim.exe
MD5
84f20cd866ea0a01154b8eeec8191e92

SHA1
74b004421b5b3516d5ba4b8d8a00124b9e740060

SHA256
cf7c320f20f7dc29a14a2663a6ab9b82a261b5b5f6784a17f954749df712e0ea

SHA512
4df51f648dea4dc782c987e7c54d269c287f83c956109d0a0054373fa4d2677c69d539b7f817da4ec7234bf191e97305ee6771e8ed6779df4d7dc742b2e55789

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Odcuelptxpbe\hyoim.exe
MD5
84f20cd866ea0a01154b8eeec8191e92

SHA1
74b004421b5b3516d5ba4b8d8a00124b9e740060

SHA256
cf7c320f20f7dc29a14a2663a6ab9b82a261b5b5f6784a17f954749df712e0ea

SHA512
4df51f648dea4dc782c987e7c54d269c287f83c956109d0a0054373fa4d2677c69d539b7f817da4ec7234bf191e97305ee6771e8ed6779df4d7dc742b2e55789

Download Submit
memory/336-8-0x0000000000000000-mapping.dmp

Download
memory/336-10-0x0000000002620000-0x0000000002631000-memory.dmp

Filesize
68KB

Download
memory/344-14-0x0000000000000000-mapping.dmp

Download
memory/1100-0-0x0000000000000000-mapping.dmp

Download
memory/1100-1-0x00000000025E0000-0x00000000025F1000-memory.dmp

Filesize
68KB

Download
memory/1480-12-0x0000000000000000-mapping.dmp

Download
memory/1656-11-0x00000000003C0000-0x00000000003FA000-memory.dmp

Filesize
232KB

Download
memory/1656-4-0x0000000000000000-mapping.dmp

Download
memory/2004-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads