qakbot | cca64d8338ff65f48f120a3fc6ef4f87a54c30d8c94d796f65f2a15ab460f7ec

General

Target

0c0a21e2b00da88e04b3a7f4c083cd08_JaffaCakes118.dll
Size

1.2MB
MD5

0c0a21e2b00da88e04b3a7f4c083cd08
SHA1

d2517cd1d9745cd77c87b6ec86f2809f8a1fe528
SHA256

cca64d8338ff65f48f120a3fc6ef4f87a54c30d8c94d796f65f2a15ab460f7ec
SHA512

566a7ba969f896e400df1100e0ef5e96826091f05fe0b08586ea9a4e26af02fed518768f0faa28d175a9c090066f31ae204278715f45711d18ea074f08181caa
SSDEEP

24576:PzVwOlR/8qI8ixvTrH2AVpIP97+xgbZTeknX:PzVjR/zI8ixrHzS97+xgbZTfnX

Score

10^/10

qakbot biden53 1634717752 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden53

Campaign

1634717752

C2

103.142.10.177:443

24.152.219.253:995

181.118.183.94:443

129.208.147.188:995

24.119.214.7:443

38.70.253.226:2222

103.143.8.71:443

77.57.204.78:443

65.100.174.110:995

220.255.25.28:2222

91.178.126.51:995

37.210.155.239:995

81.241.252.59:2078

93.48.58.123:2222

65.100.174.110:443

76.25.142.196:443

24.231.209.2:2222

140.82.49.12:443

146.66.238.74:443

39.49.4.147:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Nopujepi = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Lkswq = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4532 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

548 schtasks.exe

pid	process
4532	regsvr32.exe

pid	process
548	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Biskipixbo\8d393170 = 4b9be5015b0b1b389c4539c9eefc7e226fb079e90402aa0225e7c981a391d1476ab7cb0b039ae241af228a950881bda81c3c66d0c4e434a041b3a9e51d97982ed1703fa0be69973b99da3245b9c34a5cf585eb27b150a6287b1a183cf2b9f31c931041882e5754a37cf94753575102	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Biskipixbo\35855615 = 4c796747d4e784f8987314d3ea98c8c1565679fd52e16f83cc39c08746af3ae4cf31ee05cd0db5e04e4aa5871408b14efe729915264e6eff6c0b54becd95cfbd0f015d2d9ce6e18cf6cf3b27f5093e290f41	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Biskipixbo\488d199f = 4b6c0f408fb206c1e50c3d3210d581313d362f15e8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Biskipixbo\c5aeaeb4 = 3a70fbdf83959303807e0701761b1db385e0916c5c44d015ef35f2848b5e94b7279dab14ba8c11c6c4e198b3a88d73c2eaf8d13c6c086cb9857d297fcd20ecdd2796fa761e9b663917274c983642a1922e0c	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Biskipixbo	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Biskipixbo\bae7c142 = 7c4ef10b1ac9dc4aa24451b60bfff9ab958abdf0aef3be2eee3b7ccf5113595daca6fcb13d9876a8b94868bb992e2721771b3f5f0c0726a388d547b51dbb5989f9823fcc2f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Biskipixbo\8f78110c = c03118cea0b2196eab6617efcc31d7a2b39e2fb3e3a4ec188ef71bd0c841a84d31f73028106cbe5bbd5994c33320b912da2599a4feb88527c7f9520e1899562d89e07d838609794e6f6c146cc4b04226f23a467551257fbf012ffe9aebae40d29b83392f6cd7287229b70dd8a3eaf67c4ff2c07ac7b80c09321efd26033e5408c83eb337c393312b6b7bbad7617fb7b6e34429b2f390b21640ec7db2f1838daa7e02c1045070bca2510794ed77ab	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Biskipixbo\f0317efa = e9e0bc83d5a9c672148e6d2014cc11b9ef02852f666a5a4dfde5c1e54889f8e10f5f98713fd42e5b613e601a9b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Biskipixbo\37c47669 = 91d054ff957696090ec182371d5812371fd6de1f6289db5a95f91d4b2f24f02303549bdfc12037dc909a9e3895064b3382a02694f8c414eb6f3c010ef274cec9c9dc457ee44e9b391042f1a8870d3ad6b380791bc12bf3531e31cd753b1ec3717f1a17e578fd0c8b14cf297ad1f8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Biskipixbo\bae7c142 = 7c4ee60b1ac9e9b175b616930eb901237e83b914d91210ce5028583c7fda48169a700951ff27dc498b0da1ca30cf086903d3c5f7c5ac1dc2a630349fa22ee4a128cfc89b58fb6220a585a26d56f10581b7db2cbab3c5f3195fcc	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3048 rundll32.exe
3048 rundll32.exe
4532 regsvr32.exe
4532 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3048 rundll32.exe
4532 regsvr32.exe

pid	process
3048	rundll32.exe
3048	rundll32.exe
4532	regsvr32.exe
4532	regsvr32.exe

pid	process
3048	rundll32.exe
4532	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 4060 wrote to memory of 3048	4060	rundll32.exe	rundll32.exe
PID 4060 wrote to memory of 3048	4060	rundll32.exe	rundll32.exe
PID 4060 wrote to memory of 3048	4060	rundll32.exe	rundll32.exe
PID 3048 wrote to memory of 1748	3048	rundll32.exe	explorer.exe
PID 3048 wrote to memory of 1748	3048	rundll32.exe	explorer.exe
PID 3048 wrote to memory of 1748	3048	rundll32.exe	explorer.exe
PID 3048 wrote to memory of 1748	3048	rundll32.exe	explorer.exe
PID 3048 wrote to memory of 1748	3048	rundll32.exe	explorer.exe
PID 1748 wrote to memory of 548	1748	explorer.exe	schtasks.exe
PID 1748 wrote to memory of 548	1748	explorer.exe	schtasks.exe
PID 1748 wrote to memory of 548	1748	explorer.exe	schtasks.exe
PID 4724 wrote to memory of 4532	4724	regsvr32.exe	regsvr32.exe
PID 4724 wrote to memory of 4532	4724	regsvr32.exe	regsvr32.exe
PID 4724 wrote to memory of 4532	4724	regsvr32.exe	regsvr32.exe
PID 4532 wrote to memory of 3088	4532	regsvr32.exe	explorer.exe
PID 4532 wrote to memory of 3088	4532	regsvr32.exe	explorer.exe
PID 4532 wrote to memory of 3088	4532	regsvr32.exe	explorer.exe
PID 4532 wrote to memory of 3088	4532	regsvr32.exe	explorer.exe
PID 4532 wrote to memory of 3088	4532	regsvr32.exe	explorer.exe
PID 3088 wrote to memory of 2832	3088	explorer.exe	reg.exe
PID 3088 wrote to memory of 2832	3088	explorer.exe	reg.exe
PID 3088 wrote to memory of 4364	3088	explorer.exe	reg.exe
PID 3088 wrote to memory of 4364	3088	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c0a21e2b00da88e04b3a7f4c083cd08_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c0a21e2b00da88e04b3a7f4c083cd08_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3048

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wlznxlpjgf /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\0c0a21e2b00da88e04b3a7f4c083cd08_JaffaCakes118.dll\"" /SC ONCE /Z /ST 17:46 /ET 17:58
4⤵
- Creates scheduled task(s)
PID:548

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\0c0a21e2b00da88e04b3a7f4c083cd08_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4724

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\0c0a21e2b00da88e04b3a7f4c083cd08_JaffaCakes118.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4532

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3088

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Nopujepi" /d "0"
4⤵
- Windows security bypass
PID:2832

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Lkswq" /d "0"
4⤵
- Windows security bypass
PID:4364

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0c0a21e2b00da88e04b3a7f4c083cd08_JaffaCakes118.dll
Filesize
1.2MB

MD5
0c0a21e2b00da88e04b3a7f4c083cd08

SHA1
d2517cd1d9745cd77c87b6ec86f2809f8a1fe528

SHA256
cca64d8338ff65f48f120a3fc6ef4f87a54c30d8c94d796f65f2a15ab460f7ec

SHA512
566a7ba969f896e400df1100e0ef5e96826091f05fe0b08586ea9a4e26af02fed518768f0faa28d175a9c090066f31ae204278715f45711d18ea074f08181caa

Download Submit
memory/1748-9-0x0000000000440000-0x0000000000461000-memory.dmp

Filesize
132KB

Download
memory/1748-13-0x0000000000440000-0x0000000000461000-memory.dmp

Filesize
132KB

Download
memory/1748-11-0x0000000000440000-0x0000000000461000-memory.dmp

Filesize
132KB

Download
memory/1748-5-0x0000000000440000-0x0000000000461000-memory.dmp

Filesize
132KB

Download
memory/1748-10-0x0000000000440000-0x0000000000461000-memory.dmp

Filesize
132KB

Download
memory/3048-6-0x0000000075310000-0x000000007544E000-memory.dmp

Filesize
1.2MB

Download
memory/3048-2-0x0000000075310000-0x000000007544E000-memory.dmp

Filesize
1.2MB

Download
memory/3048-3-0x0000000002C30000-0x0000000002C31000-memory.dmp

Filesize
4KB

Download
memory/3048-1-0x0000000075310000-0x000000007544E000-memory.dmp

Filesize
1.2MB

Download
memory/3048-0-0x0000000075310000-0x000000007544E000-memory.dmp

Filesize
1.2MB

Download
memory/3088-25-0x00000000004B0000-0x00000000004D1000-memory.dmp

Filesize
132KB

Download
memory/3088-29-0x00000000004B0000-0x00000000004D1000-memory.dmp

Filesize
132KB

Download
memory/3088-27-0x00000000004B0000-0x00000000004D1000-memory.dmp

Filesize
132KB

Download
memory/3088-26-0x00000000004B0000-0x00000000004D1000-memory.dmp

Filesize
132KB

Download
memory/3088-22-0x00000000004B0000-0x00000000004D1000-memory.dmp

Filesize
132KB

Download
memory/4532-20-0x0000000073BE0000-0x0000000073D1E000-memory.dmp

Filesize
1.2MB

Download
memory/4532-23-0x0000000073BE0000-0x0000000073D1E000-memory.dmp

Filesize
1.2MB

Download
memory/4532-21-0x0000000000F60000-0x0000000000F61000-memory.dmp

Filesize
4KB

Download
memory/4532-18-0x0000000073BE0000-0x0000000073D1E000-memory.dmp

Filesize
1.2MB

Download
memory/4532-17-0x0000000073BE0000-0x0000000073D1E000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads