qakbot | 3a908f08980e39a5c28c3a4054d52a3e665bda9a40e933455dfbfb1d381ab615

General

Target

0e18a845d89e72012291c7ab32c23690_JaffaCakes118.dll
Size

1.6MB
MD5

0e18a845d89e72012291c7ab32c23690
SHA1

bc213bced327f24d1aecde5c940e6682033a093f
SHA256

3a908f08980e39a5c28c3a4054d52a3e665bda9a40e933455dfbfb1d381ab615
SHA512

606311833f08ed014e212b477aac2595ca0ad7df723ae369ceebe75273b08f8a961adf619793af31d82cc2072a1ca1939a3c265ba876e9cb0eb3ec53abc98be0
SSDEEP

24576:V7MSNmaz4fQNCrejbrICAWcRSyFf2safCbAXN4x2oDLnOEUVmrr+frk:JM4k4OMICAWaSyFf8a0MvLnHUgH+Dk

Score

10^/10

qakbot obama118 1634629572 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama118

Campaign

1634629572

C2

81.241.252.59:2078

78.105.213.151:995

77.57.204.78:443

37.210.155.239:995

93.48.58.123:2222

24.231.209.2:2222

146.66.238.74:443

65.100.174.110:443

140.82.49.12:443

187.75.66.160:995

41.86.42.158:995

120.150.218.241:995

73.151.236.31:443

81.250.153.227:2222

24.231.209.2:6881

174.54.193.186:443

136.232.34.70:443

76.25.142.196:443

78.191.38.33:995

117.215.227.142:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Ifictazatkt = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Urwylerouxy = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

528 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2576 schtasks.exe

pid	process
528	regsvr32.exe

pid	process
2576	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gzhgwtkyfv	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzhgwtkyfv\8ce41693 = 76226c176cdf0854ea8bfe08b47e1fdc5639296f6d718165d0918ec82082a6b73e2906102e93d653b865b9d700b874c2adc643ebb71071640cbd660159de56dbcc32a75d846eb82af0d967c9fabdefa780cbec6f09e89aa1d3dc7d6a6feca7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzhgwtkyfv\38681c4 = 12067bc5c951aa4f7eddce8230537d9c492ed64f01c72faa6735266251f1aa3fa8b930e74aecb6e1f58815754ff581982e14cef59528a0980359e16ce8aff604fb57cb709d8bdc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzhgwtkyfv\b97bc6dd = 87ee66604e2b47ecad450dbd4f024ba0f938925799cc2f554cc8513936edd040d50d92201d90d67701be1dbc07d2dc563b99cd21438cf13835ccbbc39842ba49acd673a1c9c88a30fbcd473804e77e267f64ee722e8825b184d8a403b123d7032f0d8d837df8fb0f1efe9503852fc9f0357edd90eabf2b171cf72b7bad81f7e7bb22c63983ed03252ad046341f3e128aea2ce1a255efd879e390ff1e43187e02be5d78614f94f02725ff1188f530cfc408	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzhgwtkyfv\bb3ae6a1 = 9a3b69419a0e0673335ddd20fe1be04e3dc081f1396792534ae38c51039653943496f2c4f51eadaef8a341809f4d358deba245012bf1882dd952baede229a19495fd231c16fdde89b3c0f57c0e30f4189003e13b59741c4c7411b7c439b60d45709072bd6b6bda4e9c0814015b33dafdb40c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzhgwtkyfv\7e8ece4e = f76cee642d948db7c89d3f4d299ac86ff0ebee9ca1a676a674c27c7d03b31ffc4daf69fd03c3a78fbb1caf3505f7644503e27a5219eac946c2c78179a2e85807c776861e1dbf4d7b906dfed7967bb2b2c424719bea0246167c97320cedc717d87fa38f352e17fc08644b3b628dd6a816	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzhgwtkyfv\c632a92b = 6a7a88b588fb094924d54ee31db67da58087458b36c17cab5cb6f3cad43d6946f5d43bf757ea472cea97e976972f97b93ee624e6725caef3fbeddea4f9be3643717523570f37d11e78c59a6d1a181c76c96a10673900fe8e58c99f802087e54cf807089a14da3c15aeba97bc8e4855a0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzhgwtkyfv\1c7a1b8 = 44e1d7235536a5e620715f7dcd3331e0141787de986055b5a787dce71f8dcb7a798460a52d73	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzhgwtkyfv\f3ad7965 = 96a0557d4593f4172cb84b21a6ae8e533427404d405ec839881530efe06f148d560f1ecd1ff01aeed3fb38cb49d94b29282d0a167115b6483e6484f0c72f21c76bc8112ea66ab174c3f040cccb83bda310e7f7dfe3431bed15348c00fba4195d48585954bb7f93ee55d1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzhgwtkyfv\8ce41693 = 76227b176cdf3d80a36416d78ec9affb09ca71a513b95788456a6d7c1d4c8967d5ed0b5cb4782b1d2245c431b366ad9fad91fe21a3d44987c652efd6ee02fbf0fc46cab37d67ade0dbb01c6e1b394a04c24e791a2036249c76933d3246b457033afd3d54d1259ac974fd0b729da47a8022cbd744	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2124 rundll32.exe
528 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2124 rundll32.exe
528 regsvr32.exe

pid	process
2124	rundll32.exe
528	regsvr32.exe

pid	process
2124	rundll32.exe
528	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2908 wrote to memory of 2124	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2124	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2124	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2124	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2124	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2124	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2124	2908	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 2628	2124	rundll32.exe	explorer.exe
PID 2124 wrote to memory of 2628	2124	rundll32.exe	explorer.exe
PID 2124 wrote to memory of 2628	2124	rundll32.exe	explorer.exe
PID 2124 wrote to memory of 2628	2124	rundll32.exe	explorer.exe
PID 2124 wrote to memory of 2628	2124	rundll32.exe	explorer.exe
PID 2124 wrote to memory of 2628	2124	rundll32.exe	explorer.exe
PID 2628 wrote to memory of 2576	2628	explorer.exe	schtasks.exe
PID 2628 wrote to memory of 2576	2628	explorer.exe	schtasks.exe
PID 2628 wrote to memory of 2576	2628	explorer.exe	schtasks.exe
PID 2628 wrote to memory of 2576	2628	explorer.exe	schtasks.exe
PID 2776 wrote to memory of 2808	2776	taskeng.exe	regsvr32.exe
PID 2776 wrote to memory of 2808	2776	taskeng.exe	regsvr32.exe
PID 2776 wrote to memory of 2808	2776	taskeng.exe	regsvr32.exe
PID 2776 wrote to memory of 2808	2776	taskeng.exe	regsvr32.exe
PID 2776 wrote to memory of 2808	2776	taskeng.exe	regsvr32.exe
PID 2808 wrote to memory of 528	2808	regsvr32.exe	regsvr32.exe
PID 2808 wrote to memory of 528	2808	regsvr32.exe	regsvr32.exe
PID 2808 wrote to memory of 528	2808	regsvr32.exe	regsvr32.exe
PID 2808 wrote to memory of 528	2808	regsvr32.exe	regsvr32.exe
PID 2808 wrote to memory of 528	2808	regsvr32.exe	regsvr32.exe
PID 2808 wrote to memory of 528	2808	regsvr32.exe	regsvr32.exe
PID 2808 wrote to memory of 528	2808	regsvr32.exe	regsvr32.exe
PID 528 wrote to memory of 1824	528	regsvr32.exe	explorer.exe
PID 528 wrote to memory of 1824	528	regsvr32.exe	explorer.exe
PID 528 wrote to memory of 1824	528	regsvr32.exe	explorer.exe
PID 528 wrote to memory of 1824	528	regsvr32.exe	explorer.exe
PID 528 wrote to memory of 1824	528	regsvr32.exe	explorer.exe
PID 528 wrote to memory of 1824	528	regsvr32.exe	explorer.exe
PID 1824 wrote to memory of 1296	1824	explorer.exe	reg.exe
PID 1824 wrote to memory of 1296	1824	explorer.exe	reg.exe
PID 1824 wrote to memory of 1296	1824	explorer.exe	reg.exe
PID 1824 wrote to memory of 1296	1824	explorer.exe	reg.exe
PID 1824 wrote to memory of 1776	1824	explorer.exe	reg.exe
PID 1824 wrote to memory of 1776	1824	explorer.exe	reg.exe
PID 1824 wrote to memory of 1776	1824	explorer.exe	reg.exe
PID 1824 wrote to memory of 1776	1824	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e18a845d89e72012291c7ab32c23690_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2908

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e18a845d89e72012291c7ab32c23690_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2628

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn febrdiear /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\0e18a845d89e72012291c7ab32c23690_JaffaCakes118.dll\"" /SC ONCE /Z /ST 19:31 /ET 19:43
4⤵
- Creates scheduled task(s)
PID:2576

C:\Windows\system32\taskeng.exe
taskeng.exe {97D1EBFC-7636-42DA-AC03-9A82B2970BB8} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2776

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\0e18a845d89e72012291c7ab32c23690_JaffaCakes118.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:2808

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\0e18a845d89e72012291c7ab32c23690_JaffaCakes118.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Urwylerouxy" /d "0"
5⤵
- Windows security bypass
PID:1296

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ifictazatkt" /d "0"
5⤵
- Windows security bypass
PID:1776

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0e18a845d89e72012291c7ab32c23690_JaffaCakes118.dll
Filesize
1.6MB

MD5
0e18a845d89e72012291c7ab32c23690

SHA1
bc213bced327f24d1aecde5c940e6682033a093f

SHA256
3a908f08980e39a5c28c3a4054d52a3e665bda9a40e933455dfbfb1d381ab615

SHA512
606311833f08ed014e212b477aac2595ca0ad7df723ae369ceebe75273b08f8a961adf619793af31d82cc2072a1ca1939a3c265ba876e9cb0eb3ec53abc98be0

Download Submit
memory/528-20-0x00000000744B0000-0x0000000074666000-memory.dmp

Filesize
1.7MB

Download
memory/528-21-0x00000000744B0000-0x0000000074666000-memory.dmp

Filesize
1.7MB

Download
memory/528-25-0x00000000744B0000-0x0000000074666000-memory.dmp

Filesize
1.7MB

Download
memory/1824-27-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/1824-24-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/1824-29-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/1824-28-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2124-3-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2124-8-0x0000000074D60000-0x0000000074F16000-memory.dmp

Filesize
1.7MB

Download
memory/2124-0-0x0000000074D60000-0x0000000074F16000-memory.dmp

Filesize
1.7MB

Download
memory/2124-2-0x0000000074D60000-0x0000000074F16000-memory.dmp

Filesize
1.7MB

Download
memory/2124-1-0x0000000074D60000-0x0000000074F16000-memory.dmp

Filesize
1.7MB

Download
memory/2628-5-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2628-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2628-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2628-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2628-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2628-7-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads