qakbot | cca64d8338ff65f48f120a3fc6ef4f87a54c30d8c94d796f65f2a15ab460f7ec

General

Target

0c0a21e2b00da88e04b3a7f4c083cd08_JaffaCakes118.dll
Size

1.2MB
MD5

0c0a21e2b00da88e04b3a7f4c083cd08
SHA1

d2517cd1d9745cd77c87b6ec86f2809f8a1fe528
SHA256

cca64d8338ff65f48f120a3fc6ef4f87a54c30d8c94d796f65f2a15ab460f7ec
SHA512

566a7ba969f896e400df1100e0ef5e96826091f05fe0b08586ea9a4e26af02fed518768f0faa28d175a9c090066f31ae204278715f45711d18ea074f08181caa
SSDEEP

24576:PzVwOlR/8qI8ixvTrH2AVpIP97+xgbZTeknX:PzVjR/zI8ixrHzS97+xgbZTfnX

Score

10^/10

qakbot biden53 1634717752 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden53

Campaign

1634717752

C2

103.142.10.177:443

24.152.219.253:995

181.118.183.94:443

129.208.147.188:995

24.119.214.7:443

38.70.253.226:2222

103.143.8.71:443

77.57.204.78:443

65.100.174.110:995

220.255.25.28:2222

91.178.126.51:995

37.210.155.239:995

81.241.252.59:2078

93.48.58.123:2222

65.100.174.110:443

76.25.142.196:443

24.231.209.2:2222

140.82.49.12:443

146.66.238.74:443

39.49.4.147:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Lgwquahmm = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Wencriwydy = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1596 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2616 schtasks.exe

pid	process
1596	regsvr32.exe

pid	process
2616	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rziahglvjta\a16b6de8 = fd2cec18cabb703b1687e3094b7e48fe1bb1a51666e85c4fdbeb7b44ca082c73788449e367f440c206c79560a01a09c9d16565b21fd7c52d80ddf9b3db5df16534e456a7053768cb104266060a1aa883	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rziahglvjta\96b59dda = 15f8c7f27096d38bede2bd33fa5accbeb7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rziahglvjta\ebbdd250 = f15fa70ef799aa82b7a1ebcb2aff20954badda975ca0342a0b54b1510a4dd41b46538a1428e25012f0f96affdce4131aaf83817c700873d2ce	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rziahglvjta\de22021e = d0923fe776832a080863f4a6991bcca016544f08aa97ce7f6b0e047cab6628c427a291908f0ee6abcb878fb489d6e746b40d867501f0e6ef41230cde5844de8f8ff36b19a615de58	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rziahglvjta\a16b6de8 = fd2cfb18cabb4554b26ea115cad6a82afe157d4e878d72f72abb5fbdd9969c92446b0b7566d67444834a43cd3d5074d769dfcf65f31683ce89a80493a4758d41087c0c9a51557844671a0a401df831e042cd9b97d7eab8d9efc23c4951e973480f224ebc9f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rziahglvjta	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rziahglvjta\94f4bda6 = 7096adec1e98450bd10054b22c326a53d9909dda55ed460e7e4e4f7c2226dc89c855558c3a61cb65b18153b2d70c2f51036b5c2a90ecc4a08050ced3d182733febdd93e861dd10d04a3c3fe3c0cb5613428492c2e2a59a8ccc1b7ce8fb2a76a3796bfc7c748db7e17f5600cee271a134447b4051fbc678c1beda54a69abd0e08f6f0577cb50d699eb20a059066fb18dde9fc5e6b505bad802c1206	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rziahglvjta\2e09fabf = 010bea97ebdb764f6c9db3ee49e8f4156235bb6512f20029f8dff7c2ec72041f8ed90bdfdccc11cb70adf5ead6fca36cd186080db6dd8740c4ec7033ce58ac0241ea6e9ad0d50a013ea5c59c9d0b67	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rziahglvjta\5301b535 = 5b12c5e85ded10672d10bbda3869ef9b555c918c81d8ba5beebbbf3d508c2db2a7ac9100c90b11dff1b6cdb27b18f79ba1cdabd971735c75f78bda43d6859064336d71bf4e765add06a98c0f36499ae932852a97fb735969093e820ec95d118be7e7fc7ae29baf366ff30b25a840192e1e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Rziahglvjta\2c48dac3 = e1d8d92aa0a19413deed19f9936c1ab316e98048ea041cc1	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1988 rundll32.exe
1596 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1988 rundll32.exe
1596 regsvr32.exe

pid	process
1988	rundll32.exe
1596	regsvr32.exe

pid	process
1988	rundll32.exe
1596	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1628 wrote to memory of 1988	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 1988	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 1988	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 1988	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 1988	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 1988	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 1988	1628	rundll32.exe	rundll32.exe
PID 1988 wrote to memory of 2068	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 2068	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 2068	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 2068	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 2068	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 2068	1988	rundll32.exe	explorer.exe
PID 2068 wrote to memory of 2616	2068	explorer.exe	schtasks.exe
PID 2068 wrote to memory of 2616	2068	explorer.exe	schtasks.exe
PID 2068 wrote to memory of 2616	2068	explorer.exe	schtasks.exe
PID 2068 wrote to memory of 2616	2068	explorer.exe	schtasks.exe
PID 2276 wrote to memory of 348	2276	taskeng.exe	regsvr32.exe
PID 2276 wrote to memory of 348	2276	taskeng.exe	regsvr32.exe
PID 2276 wrote to memory of 348	2276	taskeng.exe	regsvr32.exe
PID 2276 wrote to memory of 348	2276	taskeng.exe	regsvr32.exe
PID 2276 wrote to memory of 348	2276	taskeng.exe	regsvr32.exe
PID 348 wrote to memory of 1596	348	regsvr32.exe	regsvr32.exe
PID 348 wrote to memory of 1596	348	regsvr32.exe	regsvr32.exe
PID 348 wrote to memory of 1596	348	regsvr32.exe	regsvr32.exe
PID 348 wrote to memory of 1596	348	regsvr32.exe	regsvr32.exe
PID 348 wrote to memory of 1596	348	regsvr32.exe	regsvr32.exe
PID 348 wrote to memory of 1596	348	regsvr32.exe	regsvr32.exe
PID 348 wrote to memory of 1596	348	regsvr32.exe	regsvr32.exe
PID 1596 wrote to memory of 2040	1596	regsvr32.exe	explorer.exe
PID 1596 wrote to memory of 2040	1596	regsvr32.exe	explorer.exe
PID 1596 wrote to memory of 2040	1596	regsvr32.exe	explorer.exe
PID 1596 wrote to memory of 2040	1596	regsvr32.exe	explorer.exe
PID 1596 wrote to memory of 2040	1596	regsvr32.exe	explorer.exe
PID 1596 wrote to memory of 2040	1596	regsvr32.exe	explorer.exe
PID 2040 wrote to memory of 2004	2040	explorer.exe	reg.exe
PID 2040 wrote to memory of 2004	2040	explorer.exe	reg.exe
PID 2040 wrote to memory of 2004	2040	explorer.exe	reg.exe
PID 2040 wrote to memory of 2004	2040	explorer.exe	reg.exe
PID 2040 wrote to memory of 2860	2040	explorer.exe	reg.exe
PID 2040 wrote to memory of 2860	2040	explorer.exe	reg.exe
PID 2040 wrote to memory of 2860	2040	explorer.exe	reg.exe
PID 2040 wrote to memory of 2860	2040	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c0a21e2b00da88e04b3a7f4c083cd08_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c0a21e2b00da88e04b3a7f4c083cd08_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn iusdqjdmn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\0c0a21e2b00da88e04b3a7f4c083cd08_JaffaCakes118.dll\"" /SC ONCE /Z /ST 17:46 /ET 17:58
4⤵
- Creates scheduled task(s)
PID:2616

C:\Windows\system32\taskeng.exe
taskeng.exe {D64B15F9-E62A-4784-98D6-4AAF23907107} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\0c0a21e2b00da88e04b3a7f4c083cd08_JaffaCakes118.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:348

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\0c0a21e2b00da88e04b3a7f4c083cd08_JaffaCakes118.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Lgwquahmm" /d "0"
5⤵
- Windows security bypass
PID:2004

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Wencriwydy" /d "0"
5⤵
- Windows security bypass
PID:2860

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0c0a21e2b00da88e04b3a7f4c083cd08_JaffaCakes118.dll
Filesize
1.2MB

MD5
0c0a21e2b00da88e04b3a7f4c083cd08

SHA1
d2517cd1d9745cd77c87b6ec86f2809f8a1fe528

SHA256
cca64d8338ff65f48f120a3fc6ef4f87a54c30d8c94d796f65f2a15ab460f7ec

SHA512
566a7ba969f896e400df1100e0ef5e96826091f05fe0b08586ea9a4e26af02fed518768f0faa28d175a9c090066f31ae204278715f45711d18ea074f08181caa

Download Submit
memory/1596-25-0x0000000074110000-0x000000007424E000-memory.dmp

Filesize
1.2MB

Download
memory/1596-21-0x0000000074110000-0x000000007424E000-memory.dmp

Filesize
1.2MB

Download
memory/1596-20-0x0000000074110000-0x000000007424E000-memory.dmp

Filesize
1.2MB

Download
memory/1596-19-0x0000000074110000-0x000000007424E000-memory.dmp

Filesize
1.2MB

Download
memory/1988-1-0x0000000074B60000-0x0000000074C9E000-memory.dmp

Filesize
1.2MB

Download
memory/1988-6-0x0000000074B60000-0x0000000074C9E000-memory.dmp

Filesize
1.2MB

Download
memory/1988-0-0x0000000074B60000-0x0000000074C9E000-memory.dmp

Filesize
1.2MB

Download
memory/1988-3-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2040-24-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2040-31-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2040-29-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2040-28-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2040-27-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2068-4-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2068-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2068-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2068-10-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2068-7-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2068-14-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads