qakbot | e60cc81f630400a2fda362feb1d54fbbb9974f73232139b0c7af38b70408b9e7

General

Target

1b3aaa8206bb7fe453d79379d5b6ae72_JaffaCakes118.dll
Size

689KB
MD5

1b3aaa8206bb7fe453d79379d5b6ae72
SHA1

96caed40aac51f3cb119a5edeb7a8b10c8b75a15
SHA256

e60cc81f630400a2fda362feb1d54fbbb9974f73232139b0c7af38b70408b9e7
SHA512

92b642b9b7d5de9eb608ef7fd3c6b0a0df360f0edef9f3f29eff60acc89973bc499cc6b1ef6802c8086bbe5b6496e12fa60b035ea36820c1c188cf4421c25f56
SSDEEP

12288:1rI0bPKn8p/S0jXgfFWVkMXl2xAgwFX2dpG83tNzZ0XssC82H6/vLy2MAc:VI0bP1XWMXsAZX6tcTLFM3

Score

10^/10

qakbot obama117 1634545803 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama117

Campaign

1634545803

C2

176.45.53.222:443

220.255.25.28:2222

91.178.126.51:995

2.222.167.138:443

65.100.174.110:995

105.198.236.99:995

115.96.64.9:995

196.207.140.40:995

24.231.209.2:2222

146.66.238.74:443

103.82.211.39:995

65.100.174.110:443

103.142.10.177:443

140.82.49.12:443

78.105.213.151:995

41.86.42.158:995

89.101.97.139:443

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Heriyk = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Ueygmxcw = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2372 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1092 schtasks.exe

pid	process
2372	regsvr32.exe

pid	process
1092	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Icruesukdicq\e09dff85 = fdd3755f037a8c6e37c7acc0058266	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Icruesukdicq\6dbe48ae = f7656331c4ab2c64379a1b67612af456e611066b80271f3dccf92a9abf5da8f0c5424609c4e62fa11fd555c1cf472676e895e6f5b0051548da62dd4d94d23fbb61848ccc47cf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Icruesukdicq\12f72758 = 4e42b2510f016ce23cbeffb6fbe10af082cc1bc7bae8ae529b08b64d8372b713faa964ee10ca4233ddd6ee5640f6c7dc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Icruesukdicq\2529d76a = 76af9da7cc30b31fd017e64582b2f89e014a26e649135055cf3437778a15176ffe7cad	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Icruesukdicq\9d95b00f = dd464c510cb3fd22daa9eacf61c761822edf315e634dca782217131251108c8899b29c99e317f2f98514cebae18dd0665a6707a224e4fdb3bda6a9b3740aae360ce86166fee1038bcc869de710515f43533d40cd3522b37a0176b57c06f9cb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Icruesukdicq\9fd49073 = 7d57b49bdc2b0e80c423c3a4e200a320b94bb2f93f9b1d3682e1391b610c6b78c76eefc73581063170da518d59b562b1ad52c4022a3c541165af9f0e17b2cb894d76cc2a911c57647afcba5c09fa45092410595146ed904a91dda6104386c6137b2c67d9b82f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Icruesukdicq\12f72758 = 4e42a5510f015911c78839fcf69339c0c7b49b4393a0dff1e3532e1ce3770323009c44df7382fef50fbe6f31e0f128a8b155b1cec600c1435ef72d86dc13e8c8bf562c2559	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Icruesukdicq	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Icruesukdicq\2768f716 = bcf6c075cf3da2b45b2f328956f41e2a7e6a7c32d351b95c36d249b95467bd9c927cdbc7b385117f17a8307626d23ff5cb34049e98456093e4e3791ca75b3c4e54a204791b174a927f77ea799f808069c00e8a2d24a5a9249241fb65d0d35be410c60016c305a62ca43260185baec1e638af6fe1b2048d21d652e3f82b412158b87e448da54f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Icruesukdicq\582198e0 = 0fad11101ae1ab1b9522f56e48ec860ea69b2702a41e3b4b74107a24adae505b3cd7	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1388 rundll32.exe
1388 rundll32.exe
2372 regsvr32.exe
2372 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1388 rundll32.exe
2372 regsvr32.exe

pid	process
1388	rundll32.exe
1388	rundll32.exe
2372	regsvr32.exe
2372	regsvr32.exe

pid	process
1388	rundll32.exe
2372	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 4540 wrote to memory of 1388	4540	rundll32.exe	rundll32.exe
PID 4540 wrote to memory of 1388	4540	rundll32.exe	rundll32.exe
PID 4540 wrote to memory of 1388	4540	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 3412	1388	rundll32.exe	explorer.exe
PID 1388 wrote to memory of 3412	1388	rundll32.exe	explorer.exe
PID 1388 wrote to memory of 3412	1388	rundll32.exe	explorer.exe
PID 1388 wrote to memory of 3412	1388	rundll32.exe	explorer.exe
PID 1388 wrote to memory of 3412	1388	rundll32.exe	explorer.exe
PID 3412 wrote to memory of 1092	3412	explorer.exe	schtasks.exe
PID 3412 wrote to memory of 1092	3412	explorer.exe	schtasks.exe
PID 3412 wrote to memory of 1092	3412	explorer.exe	schtasks.exe
PID 116 wrote to memory of 2372	116	regsvr32.exe	regsvr32.exe
PID 116 wrote to memory of 2372	116	regsvr32.exe	regsvr32.exe
PID 116 wrote to memory of 2372	116	regsvr32.exe	regsvr32.exe
PID 2372 wrote to memory of 3628	2372	regsvr32.exe	explorer.exe
PID 2372 wrote to memory of 3628	2372	regsvr32.exe	explorer.exe
PID 2372 wrote to memory of 3628	2372	regsvr32.exe	explorer.exe
PID 2372 wrote to memory of 3628	2372	regsvr32.exe	explorer.exe
PID 2372 wrote to memory of 3628	2372	regsvr32.exe	explorer.exe
PID 3628 wrote to memory of 2132	3628	explorer.exe	reg.exe
PID 3628 wrote to memory of 2132	3628	explorer.exe	reg.exe
PID 3628 wrote to memory of 1096	3628	explorer.exe	reg.exe
PID 3628 wrote to memory of 1096	3628	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b3aaa8206bb7fe453d79379d5b6ae72_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b3aaa8206bb7fe453d79379d5b6ae72_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3412

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hxrhggvrdj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\1b3aaa8206bb7fe453d79379d5b6ae72_JaffaCakes118.dll\"" /SC ONCE /Z /ST 06:43 /ET 06:55
4⤵
- Creates scheduled task(s)
PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:2868

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\1b3aaa8206bb7fe453d79379d5b6ae72_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:116

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\1b3aaa8206bb7fe453d79379d5b6ae72_JaffaCakes118.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3628

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Heriyk" /d "0"
4⤵
- Windows security bypass
PID:2132

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ueygmxcw" /d "0"
4⤵
- Windows security bypass
PID:1096

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1b3aaa8206bb7fe453d79379d5b6ae72_JaffaCakes118.dll
Filesize
689KB

MD5
1b3aaa8206bb7fe453d79379d5b6ae72

SHA1
96caed40aac51f3cb119a5edeb7a8b10c8b75a15

SHA256
e60cc81f630400a2fda362feb1d54fbbb9974f73232139b0c7af38b70408b9e7

SHA512
92b642b9b7d5de9eb608ef7fd3c6b0a0df360f0edef9f3f29eff60acc89973bc499cc6b1ef6802c8086bbe5b6496e12fa60b035ea36820c1c188cf4421c25f56

Download Submit
memory/1388-6-0x00000000755E0000-0x000000007569D000-memory.dmp

Filesize
756KB

Download
memory/1388-3-0x00000000755E0000-0x000000007569D000-memory.dmp

Filesize
756KB

Download
memory/1388-1-0x00000000755E0000-0x000000007569D000-memory.dmp

Filesize
756KB

Download
memory/1388-2-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/1388-0-0x00000000755E0000-0x000000007569D000-memory.dmp

Filesize
756KB

Download
memory/2372-18-0x0000000073F20000-0x0000000073FDD000-memory.dmp

Filesize
756KB

Download
memory/2372-22-0x0000000073F20000-0x0000000073FDD000-memory.dmp

Filesize
756KB

Download
memory/2372-17-0x0000000073F20000-0x0000000073FDD000-memory.dmp

Filesize
756KB

Download
memory/2372-19-0x0000000001010000-0x0000000001011000-memory.dmp

Filesize
4KB

Download
memory/3412-10-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3412-11-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3412-9-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3412-5-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3412-13-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download
memory/3628-28-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Filesize
132KB

Download
memory/3628-24-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Filesize
132KB

Download
memory/3628-26-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Filesize
132KB

Download
memory/3628-25-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Filesize
132KB

Download
memory/3628-21-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads