qakbot | e60cc81f630400a2fda362feb1d54fbbb9974f73232139b0c7af38b70408b9e7

General

Target

1b3aaa8206bb7fe453d79379d5b6ae72_JaffaCakes118.dll
Size

689KB
MD5

1b3aaa8206bb7fe453d79379d5b6ae72
SHA1

96caed40aac51f3cb119a5edeb7a8b10c8b75a15
SHA256

e60cc81f630400a2fda362feb1d54fbbb9974f73232139b0c7af38b70408b9e7
SHA512

92b642b9b7d5de9eb608ef7fd3c6b0a0df360f0edef9f3f29eff60acc89973bc499cc6b1ef6802c8086bbe5b6496e12fa60b035ea36820c1c188cf4421c25f56
SSDEEP

12288:1rI0bPKn8p/S0jXgfFWVkMXl2xAgwFX2dpG83tNzZ0XssC82H6/vLy2MAc:VI0bP1XWMXsAZX6tcTLFM3

Score

10^/10

qakbot obama117 1634545803 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama117

Campaign

1634545803

C2

176.45.53.222:443

220.255.25.28:2222

91.178.126.51:995

2.222.167.138:443

65.100.174.110:995

105.198.236.99:995

115.96.64.9:995

196.207.140.40:995

24.231.209.2:2222

146.66.238.74:443

103.82.211.39:995

65.100.174.110:443

103.142.10.177:443

140.82.49.12:443

78.105.213.151:995

41.86.42.158:995

89.101.97.139:443

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Shchua = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Uoyvhenoayik = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1824 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2680 schtasks.exe

pid	process
1824	regsvr32.exe

pid	process
2680	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hnirmudqo	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hnirmudqo\5fd4e06f = b236169fff5542ffd3e30694d5bf032deceba161f30672d16f0a26dd3e6417fc4d1411161301c91f16f2b7d280951576d8cb7a8592811eb534ac9d9e671e107515c63a437bfffac5c86255f33e5134a4ede3bfd36a2cfa5219f1843ca0b6933a7667b1e257dbab6c4c486b1a5d1d0e41c4f8a06671f615445041267a3bc867095b479987c1eb7b4a2aba18236d3cadc25d626f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hnirmudqo\5d95c013 = 7ac9f2b5830e3b0391a79a8a5643633cd6fbb299c989e5c34656ea8a32f3f915f5a315f07083d2bcdb15660b4369e33e71b6b089b70ff4b52476cc76f9022b86786bdec1864f54738f7573bb35c2413c482e393dacd7a688d46083432e5e8a1a6494625ae78a6c4db2905caf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hnirmudqo\e529a776 = d6a8c624c63a359063d8a73f757c42ffddcb3e99abbfce65a36553b12f8b31cd80de6bfbaf37e9dbc06c8865c43c0c50ef6609a991446d407eaf0f1ca9bdfda9855d7a80809d16cc1345d0d773ea1d1178580ffe430a1d2b35cce2e10841	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hnirmudqo\9821e8fc = 5739d561fbc55017451b57dafd9b3f628a66a963184ab7d75d91841d97b6ac2fbff3380e3ea05a683913b6355d8d8144f9d1c31d1b0f05773203390cdea456f38560716c8befbed25502d91d821bb2467cdbcc46f93ecf839d53d4f88317fbc16abf92e940ed14	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hnirmudqo\6a4b3021 = bdce30cf380195a491b50a2d64370d2d3f58973845d86ee0d3d37b1499294f95524723ac7f90de69cf0479b6d86bae4d888be90fe7561e474773dde838ade96a9406e7c447a0f4f3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hnirmudqo\209d8f99 = 1776a2c358730c123ab1cc3a1d57301ba1636ba5dfdb1390559033f34eba5f19117019cf2a6fef841399962e8c1288a16c605096fe32b2e3c42d4f961ed1a0d81f22b8db6fc5fbacd22b678c624c1ea62b0241486de985f9b45745141e00eff347	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hnirmudqo\e768870a = 7f13dc1106400e73673ea8ef9cef8a0f7e129f238567b0018e5835fc41baedfa5586c96fae59bcf769d3247651ca063004319916e3a62387aa94eda66c534344774f39569bdc211ae15c0fd8a914975128f27d7af6560e3eb0a83c46676a1fec1aa7b8f00a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hnirmudqo\15025fd7 = 891e77a129c50f7c3caa393720107489e81deb9f8f2a209012ae01b7836c22c843dd078481e3fb19c8b02c4987322f39d2b13dc1ee1b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hnirmudqo\6a4b3021 = bdce27cf3801a029a6e1aa267a3c8ea322489b518a0224272bfd25c0db3af8827b436859fb4cd5d129799bb5b724fc62b806c8aabf87d21b1f1b8ef1474772885916ecb03dcb162db04c7d410ab39e5e925c176b367278ddd7882059ac	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1468 rundll32.exe
1824 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1468 rundll32.exe
1824 regsvr32.exe

pid	process
1468	rundll32.exe
1824	regsvr32.exe

pid	process
1468	rundll32.exe
1824	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2832 wrote to memory of 1468	2832	rundll32.exe	rundll32.exe
PID 2832 wrote to memory of 1468	2832	rundll32.exe	rundll32.exe
PID 2832 wrote to memory of 1468	2832	rundll32.exe	rundll32.exe
PID 2832 wrote to memory of 1468	2832	rundll32.exe	rundll32.exe
PID 2832 wrote to memory of 1468	2832	rundll32.exe	rundll32.exe
PID 2832 wrote to memory of 1468	2832	rundll32.exe	rundll32.exe
PID 2832 wrote to memory of 1468	2832	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 2700	1468	rundll32.exe	explorer.exe
PID 1468 wrote to memory of 2700	1468	rundll32.exe	explorer.exe
PID 1468 wrote to memory of 2700	1468	rundll32.exe	explorer.exe
PID 1468 wrote to memory of 2700	1468	rundll32.exe	explorer.exe
PID 1468 wrote to memory of 2700	1468	rundll32.exe	explorer.exe
PID 1468 wrote to memory of 2700	1468	rundll32.exe	explorer.exe
PID 2700 wrote to memory of 2680	2700	explorer.exe	schtasks.exe
PID 2700 wrote to memory of 2680	2700	explorer.exe	schtasks.exe
PID 2700 wrote to memory of 2680	2700	explorer.exe	schtasks.exe
PID 2700 wrote to memory of 2680	2700	explorer.exe	schtasks.exe
PID 2372 wrote to memory of 1808	2372	taskeng.exe	regsvr32.exe
PID 2372 wrote to memory of 1808	2372	taskeng.exe	regsvr32.exe
PID 2372 wrote to memory of 1808	2372	taskeng.exe	regsvr32.exe
PID 2372 wrote to memory of 1808	2372	taskeng.exe	regsvr32.exe
PID 2372 wrote to memory of 1808	2372	taskeng.exe	regsvr32.exe
PID 1808 wrote to memory of 1824	1808	regsvr32.exe	regsvr32.exe
PID 1808 wrote to memory of 1824	1808	regsvr32.exe	regsvr32.exe
PID 1808 wrote to memory of 1824	1808	regsvr32.exe	regsvr32.exe
PID 1808 wrote to memory of 1824	1808	regsvr32.exe	regsvr32.exe
PID 1808 wrote to memory of 1824	1808	regsvr32.exe	regsvr32.exe
PID 1808 wrote to memory of 1824	1808	regsvr32.exe	regsvr32.exe
PID 1808 wrote to memory of 1824	1808	regsvr32.exe	regsvr32.exe
PID 1824 wrote to memory of 2328	1824	regsvr32.exe	explorer.exe
PID 1824 wrote to memory of 2328	1824	regsvr32.exe	explorer.exe
PID 1824 wrote to memory of 2328	1824	regsvr32.exe	explorer.exe
PID 1824 wrote to memory of 2328	1824	regsvr32.exe	explorer.exe
PID 1824 wrote to memory of 2328	1824	regsvr32.exe	explorer.exe
PID 1824 wrote to memory of 2328	1824	regsvr32.exe	explorer.exe
PID 2328 wrote to memory of 1720	2328	explorer.exe	reg.exe
PID 2328 wrote to memory of 1720	2328	explorer.exe	reg.exe
PID 2328 wrote to memory of 1720	2328	explorer.exe	reg.exe
PID 2328 wrote to memory of 1720	2328	explorer.exe	reg.exe
PID 2328 wrote to memory of 292	2328	explorer.exe	reg.exe
PID 2328 wrote to memory of 292	2328	explorer.exe	reg.exe
PID 2328 wrote to memory of 292	2328	explorer.exe	reg.exe
PID 2328 wrote to memory of 292	2328	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b3aaa8206bb7fe453d79379d5b6ae72_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2832

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b3aaa8206bb7fe453d79379d5b6ae72_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dpiaafvx /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\1b3aaa8206bb7fe453d79379d5b6ae72_JaffaCakes118.dll\"" /SC ONCE /Z /ST 06:43 /ET 06:55
4⤵
- Creates scheduled task(s)
PID:2680

C:\Windows\system32\taskeng.exe
taskeng.exe {7E8BF30F-4BAE-4B2A-AAC5-C22E0B1265EE} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\1b3aaa8206bb7fe453d79379d5b6ae72_JaffaCakes118.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\1b3aaa8206bb7fe453d79379d5b6ae72_JaffaCakes118.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2328

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Shchua" /d "0"
5⤵
- Windows security bypass
PID:1720

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Uoyvhenoayik" /d "0"
5⤵
- Windows security bypass
PID:292

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1b3aaa8206bb7fe453d79379d5b6ae72_JaffaCakes118.dll
Filesize
689KB

MD5
1b3aaa8206bb7fe453d79379d5b6ae72

SHA1
96caed40aac51f3cb119a5edeb7a8b10c8b75a15

SHA256
e60cc81f630400a2fda362feb1d54fbbb9974f73232139b0c7af38b70408b9e7

SHA512
92b642b9b7d5de9eb608ef7fd3c6b0a0df360f0edef9f3f29eff60acc89973bc499cc6b1ef6802c8086bbe5b6496e12fa60b035ea36820c1c188cf4421c25f56

Download Submit
memory/1468-1-0x0000000074850000-0x000000007490D000-memory.dmp

Filesize
756KB

Download
memory/1468-4-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1468-0-0x0000000074850000-0x000000007490D000-memory.dmp

Filesize
756KB

Download
memory/1468-8-0x0000000074850000-0x000000007490D000-memory.dmp

Filesize
756KB

Download
memory/1824-21-0x0000000074850000-0x000000007490D000-memory.dmp

Filesize
756KB

Download
memory/1824-20-0x0000000074850000-0x000000007490D000-memory.dmp

Filesize
756KB

Download
memory/1824-27-0x0000000074850000-0x000000007490D000-memory.dmp

Filesize
756KB

Download
memory/2328-26-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2328-33-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2328-31-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2328-30-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2328-29-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2700-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2700-5-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2700-7-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2700-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2700-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2700-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads