qakbot | 584e7e146326216593c1de412761d87771d6294777e13691356b3d5cefabb440

General

Target

35ca0a9da38f017273a111fdb218bfd7_JaffaCakes118.dll
Size

1.0MB
MD5

35ca0a9da38f017273a111fdb218bfd7
SHA1

e6295e881aab4d47168ce4c1630dc1ef65162f2f
SHA256

584e7e146326216593c1de412761d87771d6294777e13691356b3d5cefabb440
SHA512

41807d174af9cf4ab32210cfb22f58d0738537519e9445e9505b0b13ced8d53fc7a995333cff6704013a58f2a1948250190aee6d96f9acad219108a88e92b6bf
SSDEEP

24576:AtLNXJb227NHokpLJVtVvEMkOgPSFrHEjX7hWHQ/uYT/jISlzfmXbC1DCU:OLNXhlFBpLnvEMCPQDWX7hWHQ/ue/jIW

Score

10^/10

qakbot tr 1633334141 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633334141

C2

75.75.179.226:443

185.250.148.74:443

122.11.220.212:2222

120.150.218.241:995

103.148.120.144:443

140.82.49.12:443

40.131.140.155:995

206.47.134.234:2222

73.230.205.91:443

190.198.206.189:2222

103.157.122.198:995

81.250.153.227:2222

167.248.100.227:443

96.57.188.174:2078

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

136.232.34.70:443

68.186.192.69:443

167.248.111.245:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Aupuhweatly = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Lerugeithiy = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2036 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2276 schtasks.exe

pid	process
2036	regsvr32.exe

pid	process
2276	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cvkvewuwe\fd454cce = 4389ff497ebfa5207612d85768982e40fa5f666d0f53b494a55c5c560350812d07acebec	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cvkvewuwe\7227db99 = 9bcef5cab3ac1a0db2ed7efe3c307ee4bb55ae55396d71c7ccc44a03bea4b5339b53d56127466e6f5ccc6f8f002780538a1a225bb7421e291094582bdb10b1484de183494b237e9ac8697d62081dd3b4c270c00a89	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cvkvewuwe\b793f376 = cebbd2e0b4dd498115b5bf277c20034ca1631e15eaa246e8df32c0a30ac3f1c9ed121b9508d14f225df9ecd31b3d11ed056216392fd0ee2dc04fff57dd9101069d9408664bf0f555134fb58a3997b4aa19f7da9a326576cd26cf9d5e3071	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cvkvewuwe\fd454cce = 4389e8497ebf900c3537cc3e811dfacf4b5ad55e0e74445c5fc5c88b3a90edf005d934b0dd93b9fb6bfdc87d678c23d0fc05a45501d1313d98	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Cvkvewuwe	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cvkvewuwe\ca9bbcfc = 661d2329c357de5bc0d6110f62ff045d8033b8b0d5e0846470097c3af50d7120c3af0c07d41bebe5c338ac57dc8160c53733808eb2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cvkvewuwe\f2f9413 = fadedf0553c01d011271476af509bbaf776d5561df381250	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cvkvewuwe\7066fbe5 = 2e237000b20b59454ada82264cc40249e04b341908547b2265008e65ef6dcfb91161e5b168415f1d23303a43529e78fda24aa34a1ebc7f623015e437a4fffd3ab8e7087a61df663f09281bfb076a4cfd9e2d7f8b47887b36857ccf592d4b42ea90dbd6106d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cvkvewuwe\820c2338 = 248d478eeb1f838e3760778d59c053582b0ff9d390ed6aaa975722a4ca115dfb3fed84de07f3ca	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cvkvewuwe\c8da9c80 = 7a994d92145c936f852ba3071a1d13ce89ac9b348c4387d269dbdc1b134fc1fce842c16d0f93ffc4efb2b6613aabeb27f54981a1d5c3913a239bae9732c1bade26251e3911049832ab78bd8815b97a34b462f6adeb3c734fa505b2090a81468aaa8578cb1b86afa79527da709bda8e228b7c94	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1680 rundll32.exe
2036 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1680 rundll32.exe
2036 regsvr32.exe

pid	process
1680	rundll32.exe
2036	regsvr32.exe

pid	process
1680	rundll32.exe
2036	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1228 wrote to memory of 1680	1228	rundll32.exe	rundll32.exe
PID 1228 wrote to memory of 1680	1228	rundll32.exe	rundll32.exe
PID 1228 wrote to memory of 1680	1228	rundll32.exe	rundll32.exe
PID 1228 wrote to memory of 1680	1228	rundll32.exe	rundll32.exe
PID 1228 wrote to memory of 1680	1228	rundll32.exe	rundll32.exe
PID 1228 wrote to memory of 1680	1228	rundll32.exe	rundll32.exe
PID 1228 wrote to memory of 1680	1228	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1272	1680	rundll32.exe	explorer.exe
PID 1680 wrote to memory of 1272	1680	rundll32.exe	explorer.exe
PID 1680 wrote to memory of 1272	1680	rundll32.exe	explorer.exe
PID 1680 wrote to memory of 1272	1680	rundll32.exe	explorer.exe
PID 1680 wrote to memory of 1272	1680	rundll32.exe	explorer.exe
PID 1680 wrote to memory of 1272	1680	rundll32.exe	explorer.exe
PID 1272 wrote to memory of 2276	1272	explorer.exe	schtasks.exe
PID 1272 wrote to memory of 2276	1272	explorer.exe	schtasks.exe
PID 1272 wrote to memory of 2276	1272	explorer.exe	schtasks.exe
PID 1272 wrote to memory of 2276	1272	explorer.exe	schtasks.exe
PID 1336 wrote to memory of 1292	1336	taskeng.exe	regsvr32.exe
PID 1336 wrote to memory of 1292	1336	taskeng.exe	regsvr32.exe
PID 1336 wrote to memory of 1292	1336	taskeng.exe	regsvr32.exe
PID 1336 wrote to memory of 1292	1336	taskeng.exe	regsvr32.exe
PID 1336 wrote to memory of 1292	1336	taskeng.exe	regsvr32.exe
PID 1292 wrote to memory of 2036	1292	regsvr32.exe	regsvr32.exe
PID 1292 wrote to memory of 2036	1292	regsvr32.exe	regsvr32.exe
PID 1292 wrote to memory of 2036	1292	regsvr32.exe	regsvr32.exe
PID 1292 wrote to memory of 2036	1292	regsvr32.exe	regsvr32.exe
PID 1292 wrote to memory of 2036	1292	regsvr32.exe	regsvr32.exe
PID 1292 wrote to memory of 2036	1292	regsvr32.exe	regsvr32.exe
PID 1292 wrote to memory of 2036	1292	regsvr32.exe	regsvr32.exe
PID 2036 wrote to memory of 1864	2036	regsvr32.exe	explorer.exe
PID 2036 wrote to memory of 1864	2036	regsvr32.exe	explorer.exe
PID 2036 wrote to memory of 1864	2036	regsvr32.exe	explorer.exe
PID 2036 wrote to memory of 1864	2036	regsvr32.exe	explorer.exe
PID 2036 wrote to memory of 1864	2036	regsvr32.exe	explorer.exe
PID 2036 wrote to memory of 1864	2036	regsvr32.exe	explorer.exe
PID 1864 wrote to memory of 1016	1864	explorer.exe	reg.exe
PID 1864 wrote to memory of 1016	1864	explorer.exe	reg.exe
PID 1864 wrote to memory of 1016	1864	explorer.exe	reg.exe
PID 1864 wrote to memory of 1016	1864	explorer.exe	reg.exe
PID 1864 wrote to memory of 312	1864	explorer.exe	reg.exe
PID 1864 wrote to memory of 312	1864	explorer.exe	reg.exe
PID 1864 wrote to memory of 312	1864	explorer.exe	reg.exe
PID 1864 wrote to memory of 312	1864	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35ca0a9da38f017273a111fdb218bfd7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35ca0a9da38f017273a111fdb218bfd7_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ivyvuzgcug /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\35ca0a9da38f017273a111fdb218bfd7_JaffaCakes118.dll\"" /SC ONCE /Z /ST 06:26 /ET 06:38
4⤵
- Creates scheduled task(s)
PID:2276

C:\Windows\system32\taskeng.exe
taskeng.exe {0FD21FEA-8152-4078-B018-7AF19338AF5F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\35ca0a9da38f017273a111fdb218bfd7_JaffaCakes118.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\35ca0a9da38f017273a111fdb218bfd7_JaffaCakes118.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Lerugeithiy" /d "0"
5⤵
- Windows security bypass
PID:1016

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Aupuhweatly" /d "0"
5⤵
- Windows security bypass
PID:312

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\35ca0a9da38f017273a111fdb218bfd7_JaffaCakes118.dll
Filesize
1.0MB

MD5
35ca0a9da38f017273a111fdb218bfd7

SHA1
e6295e881aab4d47168ce4c1630dc1ef65162f2f

SHA256
584e7e146326216593c1de412761d87771d6294777e13691356b3d5cefabb440

SHA512
41807d174af9cf4ab32210cfb22f58d0738537519e9445e9505b0b13ced8d53fc7a995333cff6704013a58f2a1948250190aee6d96f9acad219108a88e92b6bf

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1272-4-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/1272-7-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1272-10-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1272-11-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1272-14-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1272-12-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1680-0-0x0000000074B40000-0x0000000074CE4000-memory.dmp

Filesize
1.6MB

Download
memory/1680-6-0x0000000074B40000-0x0000000074CE4000-memory.dmp

Filesize
1.6MB

Download
memory/1680-1-0x0000000074B40000-0x0000000074CE4000-memory.dmp

Filesize
1.6MB

Download
memory/1680-3-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1864-30-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/1864-25-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/1864-29-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/1864-33-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/1864-31-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2036-20-0x0000000073F50000-0x00000000740F4000-memory.dmp

Filesize
1.6MB

Download
memory/2036-21-0x0000000073F50000-0x00000000740F4000-memory.dmp

Filesize
1.6MB

Download
memory/2036-27-0x0000000073F50000-0x00000000740F4000-memory.dmp

Filesize
1.6MB

Download
memory/2036-19-0x0000000073F50000-0x00000000740F4000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads