qakbot | 584e7e146326216593c1de412761d87771d6294777e13691356b3d5cefabb440

General

Target

35ca0a9da38f017273a111fdb218bfd7_JaffaCakes118.dll
Size

1.0MB
MD5

35ca0a9da38f017273a111fdb218bfd7
SHA1

e6295e881aab4d47168ce4c1630dc1ef65162f2f
SHA256

584e7e146326216593c1de412761d87771d6294777e13691356b3d5cefabb440
SHA512

41807d174af9cf4ab32210cfb22f58d0738537519e9445e9505b0b13ced8d53fc7a995333cff6704013a58f2a1948250190aee6d96f9acad219108a88e92b6bf
SSDEEP

24576:AtLNXJb227NHokpLJVtVvEMkOgPSFrHEjX7hWHQ/uYT/jISlzfmXbC1DCU:OLNXhlFBpLnvEMCPQDWX7hWHQ/ue/jIW

Score

10^/10

qakbot tr 1633334141 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633334141

C2

75.75.179.226:443

185.250.148.74:443

122.11.220.212:2222

120.150.218.241:995

103.148.120.144:443

140.82.49.12:443

40.131.140.155:995

206.47.134.234:2222

73.230.205.91:443

190.198.206.189:2222

103.157.122.198:995

81.250.153.227:2222

167.248.100.227:443

96.57.188.174:2078

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

136.232.34.70:443

68.186.192.69:443

167.248.111.245:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Laoujop = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Miquaydi = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4580 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2500 schtasks.exe

pid	process
4580	regsvr32.exe

pid	process
2500	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Woguqymfrn\2a163c80 = ba7ac99cfda94a9d742a90b2508b9806528641bc932d37864a8d4dc9303769a10c681ca6d743a8e6f83a660baf75670ed09c13b7ab135148600da9e3bef20f86a04db1cef35a0c58469b2c6f9d67e335a1540898bad34f95c46fe92d03f3e6b85f08413b3aa4ce755377f705ea0baab1048967a8ac498dd102caff62cfa6c77033a12d01cf37dfac25edd45c24c6d39d1ed6371e937ea29e22262513d490	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Woguqymfrn\28571cfc = 2bdc6f59c4435df8561c748ee011dd3aa3a3581b77c8ba0ac1041639c3ee5a5b89c8eff47cb9f4465d85fe3ffe06785144b8f38f608616dace8950b0030a917342a2631818230a77d8347c5787e59d868ce7b7ec64259401	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Woguqymfrn\90eb7b99 = 47aef71ccf87c0d3f66e7bae275be79c42caaa1d2d8a443f2a6f8657c3a8ebde5ceef062922d0d656689478d6426dc359f0624401ca37710597e32	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Woguqymfrn\555f5376 = b5959453d1ea214a8105f667cbb5ca405f93ef0a387deab71f0d70f3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Woguqymfrn\92aa5be5 = d14188ed04587df1ffc62f71cadffd96e7bae18113cac487	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Woguqymfrn\1f89ecce = cdae1d16c05a3067d897f1d79bfd71905abcc453d6632465e6995aa262fa7d1d703c897d81a42f9faa56d340bab25ac8417929492a9976b3181e7f488100bb80be8ad6feb9a859afe8eacfb484273a1386a256505333102640b9c9fea22da8606fc1df3f31ff49337b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Woguqymfrn	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Woguqymfrn\1f89ecce = cdae0a16c05a054927d7a81f910503190d369081ed82188df969f8c145189cce0820aa7d1d26c533ee97b36cb0227fa4f027c1d73df1938ceacb45108eb87aa734ede35e0e9d3e09be2f39f240fad6684daeeb2a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Woguqymfrn\ede33413 = 9254ca0b2828b706630d4f29771438b6818407d549510b9374f11bebc99136d0d0bf369efa0045ab87da18456d5a684d6104c685986768bf35de996b702944dfc637	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Woguqymfrn\60c08338 = 2cbc3b8692b1850eaf3a1fee673f26ffb481b15ce09acd8b00b7f49219d8a611a17ea397	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3260 rundll32.exe
3260 rundll32.exe
4580 regsvr32.exe
4580 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3260 rundll32.exe
4580 regsvr32.exe

pid	process
3260	rundll32.exe
3260	rundll32.exe
4580	regsvr32.exe
4580	regsvr32.exe

pid	process
3260	rundll32.exe
4580	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3220 wrote to memory of 3260	3220	rundll32.exe	rundll32.exe
PID 3220 wrote to memory of 3260	3220	rundll32.exe	rundll32.exe
PID 3220 wrote to memory of 3260	3220	rundll32.exe	rundll32.exe
PID 3260 wrote to memory of 4144	3260	rundll32.exe	explorer.exe
PID 3260 wrote to memory of 4144	3260	rundll32.exe	explorer.exe
PID 3260 wrote to memory of 4144	3260	rundll32.exe	explorer.exe
PID 3260 wrote to memory of 4144	3260	rundll32.exe	explorer.exe
PID 3260 wrote to memory of 4144	3260	rundll32.exe	explorer.exe
PID 4144 wrote to memory of 2500	4144	explorer.exe	schtasks.exe
PID 4144 wrote to memory of 2500	4144	explorer.exe	schtasks.exe
PID 4144 wrote to memory of 2500	4144	explorer.exe	schtasks.exe
PID 2620 wrote to memory of 4580	2620	regsvr32.exe	regsvr32.exe
PID 2620 wrote to memory of 4580	2620	regsvr32.exe	regsvr32.exe
PID 2620 wrote to memory of 4580	2620	regsvr32.exe	regsvr32.exe
PID 4580 wrote to memory of 316	4580	regsvr32.exe	explorer.exe
PID 4580 wrote to memory of 316	4580	regsvr32.exe	explorer.exe
PID 4580 wrote to memory of 316	4580	regsvr32.exe	explorer.exe
PID 4580 wrote to memory of 316	4580	regsvr32.exe	explorer.exe
PID 4580 wrote to memory of 316	4580	regsvr32.exe	explorer.exe
PID 316 wrote to memory of 3272	316	explorer.exe	reg.exe
PID 316 wrote to memory of 3272	316	explorer.exe	reg.exe
PID 316 wrote to memory of 4652	316	explorer.exe	reg.exe
PID 316 wrote to memory of 4652	316	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35ca0a9da38f017273a111fdb218bfd7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3220

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35ca0a9da38f017273a111fdb218bfd7_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3260

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4144

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn tycnplr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\35ca0a9da38f017273a111fdb218bfd7_JaffaCakes118.dll\"" /SC ONCE /Z /ST 06:26 /ET 06:38
4⤵
- Creates scheduled task(s)
PID:2500

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\35ca0a9da38f017273a111fdb218bfd7_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2620

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\35ca0a9da38f017273a111fdb218bfd7_JaffaCakes118.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4580

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Laoujop" /d "0"
4⤵
- Windows security bypass
PID:3272

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Miquaydi" /d "0"
4⤵
- Windows security bypass
PID:4652

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\35ca0a9da38f017273a111fdb218bfd7_JaffaCakes118.dll
Filesize
1.0MB

MD5
35ca0a9da38f017273a111fdb218bfd7

SHA1
e6295e881aab4d47168ce4c1630dc1ef65162f2f

SHA256
584e7e146326216593c1de412761d87771d6294777e13691356b3d5cefabb440

SHA512
41807d174af9cf4ab32210cfb22f58d0738537519e9445e9505b0b13ced8d53fc7a995333cff6704013a58f2a1948250190aee6d96f9acad219108a88e92b6bf

Download Submit
memory/316-28-0x0000000000500000-0x0000000000521000-memory.dmp

Filesize
132KB

Download
memory/316-26-0x0000000000500000-0x0000000000521000-memory.dmp

Filesize
132KB

Download
memory/316-25-0x0000000000500000-0x0000000000521000-memory.dmp

Filesize
132KB

Download
memory/316-24-0x0000000000500000-0x0000000000521000-memory.dmp

Filesize
132KB

Download
memory/316-22-0x0000000000500000-0x0000000000521000-memory.dmp

Filesize
132KB

Download
memory/3260-6-0x0000000075200000-0x00000000753A4000-memory.dmp

Filesize
1.6MB

Download
memory/3260-0-0x0000000075200000-0x00000000753A4000-memory.dmp

Filesize
1.6MB

Download
memory/3260-1-0x0000000075200000-0x00000000753A4000-memory.dmp

Filesize
1.6MB

Download
memory/3260-3-0x0000000075200000-0x00000000753A4000-memory.dmp

Filesize
1.6MB

Download
memory/3260-2-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/4144-5-0x0000000000560000-0x0000000000581000-memory.dmp

Filesize
132KB

Download
memory/4144-10-0x0000000000560000-0x0000000000581000-memory.dmp

Filesize
132KB

Download
memory/4144-9-0x0000000000560000-0x0000000000581000-memory.dmp

Filesize
132KB

Download
memory/4144-13-0x0000000000560000-0x0000000000581000-memory.dmp

Filesize
132KB

Download
memory/4144-11-0x0000000000560000-0x0000000000581000-memory.dmp

Filesize
132KB

Download
memory/4580-18-0x0000000075170000-0x0000000075314000-memory.dmp

Filesize
1.6MB

Download
memory/4580-20-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/4580-17-0x0000000075170000-0x0000000075314000-memory.dmp

Filesize
1.6MB

Download
memory/4580-21-0x0000000075170000-0x0000000075314000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads