qakbot | 3a908f08980e39a5c28c3a4054d52a3e665bda9a40e933455dfbfb1d381ab615

General

Target

0e18a845d89e72012291c7ab32c23690_JaffaCakes118.dll
Size

1.6MB
MD5

0e18a845d89e72012291c7ab32c23690
SHA1

bc213bced327f24d1aecde5c940e6682033a093f
SHA256

3a908f08980e39a5c28c3a4054d52a3e665bda9a40e933455dfbfb1d381ab615
SHA512

606311833f08ed014e212b477aac2595ca0ad7df723ae369ceebe75273b08f8a961adf619793af31d82cc2072a1ca1939a3c265ba876e9cb0eb3ec53abc98be0
SSDEEP

24576:V7MSNmaz4fQNCrejbrICAWcRSyFf2safCbAXN4x2oDLnOEUVmrr+frk:JM4k4OMICAWaSyFf8a0MvLnHUgH+Dk

Score

10^/10

qakbot obama118 1634629572 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama118

Campaign

1634629572

C2

81.241.252.59:2078

78.105.213.151:995

77.57.204.78:443

37.210.155.239:995

93.48.58.123:2222

24.231.209.2:2222

146.66.238.74:443

65.100.174.110:443

140.82.49.12:443

187.75.66.160:995

41.86.42.158:995

120.150.218.241:995

73.151.236.31:443

81.250.153.227:2222

24.231.209.2:6881

174.54.193.186:443

136.232.34.70:443

76.25.142.196:443

78.191.38.33:995

117.215.227.142:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Vagczqehexec = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Nxqozp = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3112 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2140 schtasks.exe

pid	process
3112	regsvr32.exe

pid	process
2140	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gejhnmxoqpfmn\a32f642 = f4e771d15c138f940bf4f109e5874e069c71edd50a2f140aa80c7952d26e82650bb79d22a4e42b9e0aebadf2aa0582f2e9e2fbac	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gejhnmxoqpfmn\3fad260c = 6d2a5fd9919643978fc0dbffcb5211bfbeaa28b3f02083a99eab0830b7d762846fe3492a57cf7411e3fa7efdc1f09f13fc2fdb0ab5e38fffe9726fd6cdb22c770bf0be0a57542b9c5fa24c2c4ebe66394d35d80b7eeaba69596ff89bb717e2b0755647244d5cc1ba78247660e24f8e7d1e3007ad666c4353d29a6868f83c8c770412730c76a5ed4be9c0512e99b5b0c1d8b704e31b579ad9645743cb0073c0ac32d2a52496b1056092bd7361fa3babcbc0dd5f891ae512c88d04baa0eb51c34e642b015e3d70dd53c58f978d6715	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gejhnmxoqpfmn\85506115 = 28d1ec10b4c392711ce0db5ba45fef02ff9f6c2f2571bb3994f7b5141045e962d6e7d4443878d0cb2aa034342d639cc47cebdfb1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gejhnmxoqpfmn\f8582e9f = 0595b82adab9e4dbe5f1ee3f316942408563d7afb6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gejhnmxoqpfmn\757b99b4 = d7e8df6b5832fe619ae6cc540cd304d50f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gejhnmxoqpfmn\87114169 = f83c9a197694350bead5d3a2d97c0cd2e290d225af4443b46a6608a745d346b6c40a845f85b1dccd1c62cf1e7c31683058354368a2bbc00d5e5e1628d8e0994b53df88d1	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gejhnmxoqpfmn	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gejhnmxoqpfmn\a32f642 = f4e766d15c13ba0513fa6155f79e382c3584362e6f3c1c14f8d7eead28ed00	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gejhnmxoqpfmn\3dec0670 = abc9fa14bae1261bd4f0e34b9aee28c81d72c3b12d494fdca89d9d81d8508234aeaa4591c5daa8a475a24c443d62574a465fea5e439a36b9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gejhnmxoqpfmn\40e449fa = 6458eb5063c3c5507d15e4c98503d4fe401659422f34f0cc7a90022f94fea6cc52f99bb7612fc74b3e96	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1176 rundll32.exe
1176 rundll32.exe
3112 regsvr32.exe
3112 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1176 rundll32.exe
3112 regsvr32.exe

pid	process
1176	rundll32.exe
1176	rundll32.exe
3112	regsvr32.exe
3112	regsvr32.exe

pid	process
1176	rundll32.exe
3112	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 5108 wrote to memory of 1176	5108	rundll32.exe	rundll32.exe
PID 5108 wrote to memory of 1176	5108	rundll32.exe	rundll32.exe
PID 5108 wrote to memory of 1176	5108	rundll32.exe	rundll32.exe
PID 1176 wrote to memory of 4416	1176	rundll32.exe	explorer.exe
PID 1176 wrote to memory of 4416	1176	rundll32.exe	explorer.exe
PID 1176 wrote to memory of 4416	1176	rundll32.exe	explorer.exe
PID 1176 wrote to memory of 4416	1176	rundll32.exe	explorer.exe
PID 1176 wrote to memory of 4416	1176	rundll32.exe	explorer.exe
PID 4416 wrote to memory of 2140	4416	explorer.exe	schtasks.exe
PID 4416 wrote to memory of 2140	4416	explorer.exe	schtasks.exe
PID 4416 wrote to memory of 2140	4416	explorer.exe	schtasks.exe
PID 3708 wrote to memory of 3112	3708	regsvr32.exe	regsvr32.exe
PID 3708 wrote to memory of 3112	3708	regsvr32.exe	regsvr32.exe
PID 3708 wrote to memory of 3112	3708	regsvr32.exe	regsvr32.exe
PID 3112 wrote to memory of 472	3112	regsvr32.exe	explorer.exe
PID 3112 wrote to memory of 472	3112	regsvr32.exe	explorer.exe
PID 3112 wrote to memory of 472	3112	regsvr32.exe	explorer.exe
PID 3112 wrote to memory of 472	3112	regsvr32.exe	explorer.exe
PID 3112 wrote to memory of 472	3112	regsvr32.exe	explorer.exe
PID 472 wrote to memory of 1260	472	explorer.exe	reg.exe
PID 472 wrote to memory of 1260	472	explorer.exe	reg.exe
PID 472 wrote to memory of 4240	472	explorer.exe	reg.exe
PID 472 wrote to memory of 4240	472	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e18a845d89e72012291c7ab32c23690_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e18a845d89e72012291c7ab32c23690_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn oazhtlz /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\0e18a845d89e72012291c7ab32c23690_JaffaCakes118.dll\"" /SC ONCE /Z /ST 19:31 /ET 19:43
      4⤵
      Creates scheduled task(s)
      PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4736 --field-trial-handle=2496,i,15897292497548307209,13920214570023230813,262144 --variations-seed-version /prefetch:8
1⤵
PID:5104

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\0e18a845d89e72012291c7ab32c23690_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\0e18a845d89e72012291c7ab32c23690_JaffaCakes118.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:472
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Vagczqehexec" /d "0"
      4⤵
      Windows security bypass
      PID:1260
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Nxqozp" /d "0"
      4⤵
      Windows security bypass
      PID:4240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0e18a845d89e72012291c7ab32c23690_JaffaCakes118.dll

Filesize
1.6MB

MD5
0e18a845d89e72012291c7ab32c23690

SHA1
bc213bced327f24d1aecde5c940e6682033a093f

SHA256
3a908f08980e39a5c28c3a4054d52a3e665bda9a40e933455dfbfb1d381ab615

SHA512
606311833f08ed014e212b477aac2595ca0ad7df723ae369ceebe75273b08f8a961adf619793af31d82cc2072a1ca1939a3c265ba876e9cb0eb3ec53abc98be0

Download Submit
memory/472-26-0x00000000004A0000-0x00000000004C1000-memory.dmp

Filesize
132KB

Download
memory/472-24-0x00000000004A0000-0x00000000004C1000-memory.dmp

Filesize
132KB

Download
memory/472-21-0x00000000004A0000-0x00000000004C1000-memory.dmp

Filesize
132KB

Download
memory/472-25-0x00000000004A0000-0x00000000004C1000-memory.dmp

Filesize
132KB

Download
memory/1176-3-0x00000000756E0000-0x0000000075896000-memory.dmp

Filesize
1.7MB

Download
memory/1176-6-0x00000000756E0000-0x0000000075896000-memory.dmp

Filesize
1.7MB

Download
memory/1176-0-0x00000000756E0000-0x0000000075896000-memory.dmp

Filesize
1.7MB

Download
memory/1176-2-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/1176-1-0x00000000756E0000-0x0000000075896000-memory.dmp

Filesize
1.7MB

Download
memory/3112-22-0x0000000073F30000-0x00000000740E6000-memory.dmp

Filesize
1.7MB

Download
memory/3112-17-0x0000000073F30000-0x00000000740E6000-memory.dmp

Filesize
1.7MB

Download
memory/3112-18-0x0000000073F30000-0x00000000740E6000-memory.dmp

Filesize
1.7MB

Download
memory/3112-20-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/4416-5-0x0000000000800000-0x0000000000821000-memory.dmp

Filesize
132KB

Download
memory/4416-13-0x0000000000800000-0x0000000000821000-memory.dmp

Filesize
132KB

Download
memory/4416-11-0x0000000000800000-0x0000000000821000-memory.dmp

Filesize
132KB

Download
memory/4416-10-0x0000000000800000-0x0000000000821000-memory.dmp

Filesize
132KB

Download
memory/4416-9-0x0000000000800000-0x0000000000821000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads