qakbot | 39bd8a9e78ba284ca93da76de92b8736db4b9a34762449905e5c457438dc3d1c

General

Target

xdueom.exe
Size

1.0MB
MD5

dd125f5fde7bd7993adc96eb1eecf0b3
SHA1

5aad20985286641cd4d9a4fab2f94a23ee9254fa
SHA256

39bd8a9e78ba284ca93da76de92b8736db4b9a34762449905e5c457438dc3d1c
SHA512

5ab6c590be637aaafee14537d8e8717453cf301e2c99c3faaaf18a9d5bba56b361cbc7d4c9d3478320804596d471b9e237061beeda35011ff31a82ccc017c41b

Score

10^/10

qakbot notset 1604404534 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

notset

Campaign

1604404534

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
logger@dustinkeeling.com
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
logger@misterexterior.com
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
cpanel@vivekharris-architects.com
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
cpanel@dovetailsolar.com
Password:
eQyicNLzzqPN

C2

67.6.55.77:443

89.136.39.108:443

2.50.58.76:443

188.25.158.61:443

45.63.107.192:995

45.32.154.10:443

94.52.160.116:443

45.63.107.192:2222

45.63.107.192:443

72.204.242.138:465

84.117.176.32:443

95.77.223.148:443

47.146.39.147:443

41.225.13.128:8443

80.14.209.42:2222

190.220.8.10:995

66.76.105.194:443

105.101.69.242:443

89.33.87.107:443

75.136.40.155:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Executes dropped EXE 2 IoCs

Processes:

bbdkdsag.exebbdkdsag.exe

pid process

1684 bbdkdsag.exe
752 bbdkdsag.exe
Loads dropped DLL 2 IoCs

Processes:

xdueom.exe

pid process

1056 xdueom.exe
1056 xdueom.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1632 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

xdueom.exexdueom.exebbdkdsag.exebbdkdsag.exeexplorer.exexdueom.exe

pid process

1056 xdueom.exe
840 xdueom.exe
840 xdueom.exe
1684 bbdkdsag.exe
752 bbdkdsag.exe
752 bbdkdsag.exe
968 explorer.exe
968 explorer.exe
1064 xdueom.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

bbdkdsag.exe

pid process

1684 bbdkdsag.exe

pid	process
1684	bbdkdsag.exe
752	bbdkdsag.exe

pid	process
1056	xdueom.exe
1056	xdueom.exe

pid	process
1632	schtasks.exe

pid	process
1056	xdueom.exe
840	xdueom.exe
840	xdueom.exe
1684	bbdkdsag.exe
752	bbdkdsag.exe
752	bbdkdsag.exe
968	explorer.exe
968	explorer.exe
1064	xdueom.exe

pid	process
1684	bbdkdsag.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

xdueom.exebbdkdsag.exetaskeng.exe

description	pid	process	target process
PID 1056 wrote to memory of 840	1056	xdueom.exe	xdueom.exe
PID 1056 wrote to memory of 840	1056	xdueom.exe	xdueom.exe
PID 1056 wrote to memory of 840	1056	xdueom.exe	xdueom.exe
PID 1056 wrote to memory of 840	1056	xdueom.exe	xdueom.exe
PID 1056 wrote to memory of 1684	1056	xdueom.exe	bbdkdsag.exe
PID 1056 wrote to memory of 1684	1056	xdueom.exe	bbdkdsag.exe
PID 1056 wrote to memory of 1684	1056	xdueom.exe	bbdkdsag.exe
PID 1056 wrote to memory of 1684	1056	xdueom.exe	bbdkdsag.exe
PID 1056 wrote to memory of 1632	1056	xdueom.exe	schtasks.exe
PID 1056 wrote to memory of 1632	1056	xdueom.exe	schtasks.exe
PID 1056 wrote to memory of 1632	1056	xdueom.exe	schtasks.exe
PID 1056 wrote to memory of 1632	1056	xdueom.exe	schtasks.exe
PID 1684 wrote to memory of 752	1684	bbdkdsag.exe	bbdkdsag.exe
PID 1684 wrote to memory of 752	1684	bbdkdsag.exe	bbdkdsag.exe
PID 1684 wrote to memory of 752	1684	bbdkdsag.exe	bbdkdsag.exe
PID 1684 wrote to memory of 752	1684	bbdkdsag.exe	bbdkdsag.exe
PID 1684 wrote to memory of 968	1684	bbdkdsag.exe	explorer.exe
PID 1684 wrote to memory of 968	1684	bbdkdsag.exe	explorer.exe
PID 1684 wrote to memory of 968	1684	bbdkdsag.exe	explorer.exe
PID 1684 wrote to memory of 968	1684	bbdkdsag.exe	explorer.exe
PID 1684 wrote to memory of 968	1684	bbdkdsag.exe	explorer.exe
PID 556 wrote to memory of 1064	556	taskeng.exe	xdueom.exe
PID 556 wrote to memory of 1064	556	taskeng.exe	xdueom.exe
PID 556 wrote to memory of 1064	556	taskeng.exe	xdueom.exe
PID 556 wrote to memory of 1064	556	taskeng.exe	xdueom.exe

C:\Users\Admin\AppData\Local\Temp\xdueom.exe
"C:\Users\Admin\AppData\Local\Temp\xdueom.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056

C:\Users\Admin\AppData\Local\Temp\xdueom.exe
C:\Users\Admin\AppData\Local\Temp\xdueom.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:840

C:\Users\Admin\AppData\Roaming\Microsoft\Vvvjlhechoz\bbdkdsag.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Vvvjlhechoz\bbdkdsag.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1684

C:\Users\Admin\AppData\Roaming\Microsoft\Vvvjlhechoz\bbdkdsag.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Vvvjlhechoz\bbdkdsag.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:752

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:968

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hcgcrosjz /tr "\"C:\Users\Admin\AppData\Local\Temp\xdueom.exe\" /I hcgcrosjz" /SC ONCE /Z /ST 14:39 /ET 14:51
2⤵
- Creates scheduled task(s)
PID:1632

C:\Windows\system32\taskeng.exe
taskeng.exe {A4CBD170-7F51-4962-A4D6-31087DF9C101} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:556

C:\Users\Admin\AppData\Local\Temp\xdueom.exe
C:\Users\Admin\AppData\Local\Temp\xdueom.exe /I hcgcrosjz
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1064

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Vvvjlhechoz\bbdkdsag.dat
MD5
f9a0fd6aa9b63ed0eae14aa251cff368

SHA1
fa697d7b3806fa42f41acab04b32f54f79eed778

SHA256
143f8a0c5b883d14862134ae70415e751cb7e7745b59721791bd25d981baeba0

SHA512
cdace1c5ed5fe2d9c73aa70e42677e5684d8a90aab374d709ef6d1a306d65c9a2a0b1ca6bcd73f27909c0dbaa18a260bc4de9b4e7931ad6cb9fc4b10e2ca436b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Vvvjlhechoz\bbdkdsag.exe
MD5
dd125f5fde7bd7993adc96eb1eecf0b3

SHA1
5aad20985286641cd4d9a4fab2f94a23ee9254fa

SHA256
39bd8a9e78ba284ca93da76de92b8736db4b9a34762449905e5c457438dc3d1c

SHA512
5ab6c590be637aaafee14537d8e8717453cf301e2c99c3faaaf18a9d5bba56b361cbc7d4c9d3478320804596d471b9e237061beeda35011ff31a82ccc017c41b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Vvvjlhechoz\bbdkdsag.exe
MD5
dd125f5fde7bd7993adc96eb1eecf0b3

SHA1
5aad20985286641cd4d9a4fab2f94a23ee9254fa

SHA256
39bd8a9e78ba284ca93da76de92b8736db4b9a34762449905e5c457438dc3d1c

SHA512
5ab6c590be637aaafee14537d8e8717453cf301e2c99c3faaaf18a9d5bba56b361cbc7d4c9d3478320804596d471b9e237061beeda35011ff31a82ccc017c41b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Vvvjlhechoz\bbdkdsag.exe
MD5
dd125f5fde7bd7993adc96eb1eecf0b3

SHA1
5aad20985286641cd4d9a4fab2f94a23ee9254fa

SHA256
39bd8a9e78ba284ca93da76de92b8736db4b9a34762449905e5c457438dc3d1c

SHA512
5ab6c590be637aaafee14537d8e8717453cf301e2c99c3faaaf18a9d5bba56b361cbc7d4c9d3478320804596d471b9e237061beeda35011ff31a82ccc017c41b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Vvvjlhechoz\bbdkdsag.exe
MD5
dd125f5fde7bd7993adc96eb1eecf0b3

SHA1
5aad20985286641cd4d9a4fab2f94a23ee9254fa

SHA256
39bd8a9e78ba284ca93da76de92b8736db4b9a34762449905e5c457438dc3d1c

SHA512
5ab6c590be637aaafee14537d8e8717453cf301e2c99c3faaaf18a9d5bba56b361cbc7d4c9d3478320804596d471b9e237061beeda35011ff31a82ccc017c41b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Vvvjlhechoz\bbdkdsag.exe
MD5
dd125f5fde7bd7993adc96eb1eecf0b3

SHA1
5aad20985286641cd4d9a4fab2f94a23ee9254fa

SHA256
39bd8a9e78ba284ca93da76de92b8736db4b9a34762449905e5c457438dc3d1c

SHA512
5ab6c590be637aaafee14537d8e8717453cf301e2c99c3faaaf18a9d5bba56b361cbc7d4c9d3478320804596d471b9e237061beeda35011ff31a82ccc017c41b

Download Submit
memory/752-8-0x0000000000000000-mapping.dmp

Download
memory/752-10-0x0000000002620000-0x0000000002631000-memory.dmp

Filesize
68KB

Download
memory/840-0-0x0000000000000000-mapping.dmp

Download
memory/840-1-0x0000000002630000-0x0000000002641000-memory.dmp

Filesize
68KB

Download
memory/968-12-0x0000000000000000-mapping.dmp

Download
memory/1064-14-0x0000000000000000-mapping.dmp

Download
memory/1632-6-0x0000000000000000-mapping.dmp

Download
memory/1684-4-0x0000000000000000-mapping.dmp

Download
memory/1684-11-0x00000000003C0000-0x00000000003FA000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads