qakbot | b6d65b22a0051227b29f30dd4833753925332ff3727e392ed6d2223b36f1cc1d

General

Target

398b4b11bd10b155bead7267c48fc869_JaffaCakes118.dll
Size

820KB
MD5

398b4b11bd10b155bead7267c48fc869
SHA1

8c9338c72a4cbe4fe6929a2f16d506e171663a62
SHA256

b6d65b22a0051227b29f30dd4833753925332ff3727e392ed6d2223b36f1cc1d
SHA512

47fa82af74952ebc0424d087bfe7d3ba31713568f83b261e0d8ff75adee42458b471c79ac1172b25aa484f8b507f3ea90b55d51987df93540470e04a06c4a92f
SSDEEP

24576:TC/lh7rH/i9rz+hwKzyUj/JGzwMgtx1EWsrbw4iaZ4gRrbI:TC9h7e9rz+t/JGz5g3uWsrbw4iaqgRrM

Score

10^/10

qakbot tr 1633597626 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633597626

C2

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Rziluxo = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Thfsuoo = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2580 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

5032 schtasks.exe

pid	process
2580	regsvr32.exe

pid	process
5032	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qcoipeziyilka\b8c48ffd = 5b7da753aad2d7f6e10eaa72fcbccf938de3e59b13b672b1ebe4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qcoipeziyilka\c78de00b = de3f9e90723618d4d738543dcc82abc165aff6e6095ec3e8d7cd05fbc4af320859f6b3203303e33b7ff0	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qcoipeziyilka	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qcoipeziyilka\7f31876e = 8a69725564e9da967c54e10e66e56eccdefa075284ea41bfd195fd28002e23ab84b6e449b30d61b815a5ea4c7d47b4997bab5acdbba2dd5d49618f2db240b6eb21fb3b82d02eda45de8d0c2b4778cf1f958af3e063b36ae249e7a78300035925fe5d055071afce48bfe11a4b8072d3a6798ccd2cdb6da8ae35b430d498207e22f78f39a46661a2210fadd65a6b3a9716b35c7be7ed83a25a3fc1be073d50181788	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qcoipeziyilka\7d70a712 = 029a03d33c941a73c0576bb5555cff0b3a2d5a8ef54141f0797ad0de0908d8dc5ea3d6a9b98130345a8d3bd4e289106fd59b4d7b67291072cf54b34b5e0ee606b742	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qcoipeziyilka\35e738d6 = 9ce4124e44e4c68c94ce32ea69dca6cc2196835e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qcoipeziyilka\4aae5720 = 1804570df4cd2d4cc436ff20b08965a08638c07bdfa6fb8765a619647cde43c801d2e5273fd73919688d9f5f68868a6d67707a1e8999e8de384a07068835b77100b4e36495d314095607c5f5593aa16e16d924df1dafa548a34f50c9891c3eb56e5f954798595fc0d0587a7e1ddf271637d80cd82ed3a2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qcoipeziyilka\4aae5720 = 1804400df4cd18744c76f00405d6c817ff3bdbe018a3762789b44443bc4b2d254c10f64ab42506ac981688d5a237db5a2712b524d9351489041d70a14d3c7a04f4a5081c6b0e0d234f166ff4b94630edd29bc7cdc9247c995a2b5a08550a4d8ba6df	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qcoipeziyilka\c5ccc077 = 988944272ca3e1e7137d71a9d95ca43dcebe2df11069bd33bd36	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qcoipeziyilka\78e898 = efae2ff63e69b12afc90626a40a44d9ed13a37a1560ff8	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

4656 rundll32.exe
4656 rundll32.exe
2580 regsvr32.exe
2580 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

4656 rundll32.exe
2580 regsvr32.exe

pid	process
4656	rundll32.exe
4656	rundll32.exe
2580	regsvr32.exe
2580	regsvr32.exe

pid	process
4656	rundll32.exe
2580	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2652 wrote to memory of 4656	2652	rundll32.exe	rundll32.exe
PID 2652 wrote to memory of 4656	2652	rundll32.exe	rundll32.exe
PID 2652 wrote to memory of 4656	2652	rundll32.exe	rundll32.exe
PID 4656 wrote to memory of 4236	4656	rundll32.exe	explorer.exe
PID 4656 wrote to memory of 4236	4656	rundll32.exe	explorer.exe
PID 4656 wrote to memory of 4236	4656	rundll32.exe	explorer.exe
PID 4656 wrote to memory of 4236	4656	rundll32.exe	explorer.exe
PID 4656 wrote to memory of 4236	4656	rundll32.exe	explorer.exe
PID 4236 wrote to memory of 5032	4236	explorer.exe	schtasks.exe
PID 4236 wrote to memory of 5032	4236	explorer.exe	schtasks.exe
PID 4236 wrote to memory of 5032	4236	explorer.exe	schtasks.exe
PID 5040 wrote to memory of 2580	5040	regsvr32.exe	regsvr32.exe
PID 5040 wrote to memory of 2580	5040	regsvr32.exe	regsvr32.exe
PID 5040 wrote to memory of 2580	5040	regsvr32.exe	regsvr32.exe
PID 2580 wrote to memory of 4644	2580	regsvr32.exe	explorer.exe
PID 2580 wrote to memory of 4644	2580	regsvr32.exe	explorer.exe
PID 2580 wrote to memory of 4644	2580	regsvr32.exe	explorer.exe
PID 2580 wrote to memory of 4644	2580	regsvr32.exe	explorer.exe
PID 2580 wrote to memory of 4644	2580	regsvr32.exe	explorer.exe
PID 4644 wrote to memory of 2912	4644	explorer.exe	reg.exe
PID 4644 wrote to memory of 2912	4644	explorer.exe	reg.exe
PID 4644 wrote to memory of 4388	4644	explorer.exe	reg.exe
PID 4644 wrote to memory of 4388	4644	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\398b4b11bd10b155bead7267c48fc869_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\398b4b11bd10b155bead7267c48fc869_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4656

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4236

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn veppivef /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\398b4b11bd10b155bead7267c48fc869_JaffaCakes118.dll\"" /SC ONCE /Z /ST 09:51 /ET 10:03
4⤵
- Creates scheduled task(s)
PID:5032

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\398b4b11bd10b155bead7267c48fc869_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:5040

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\398b4b11bd10b155bead7267c48fc869_JaffaCakes118.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2580

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4644

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Rziluxo" /d "0"
4⤵
- Windows security bypass
PID:2912

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Thfsuoo" /d "0"
4⤵
- Windows security bypass
PID:4388

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\398b4b11bd10b155bead7267c48fc869_JaffaCakes118.dll
Filesize
820KB

MD5
398b4b11bd10b155bead7267c48fc869

SHA1
8c9338c72a4cbe4fe6929a2f16d506e171663a62

SHA256
b6d65b22a0051227b29f30dd4833753925332ff3727e392ed6d2223b36f1cc1d

SHA512
47fa82af74952ebc0424d087bfe7d3ba31713568f83b261e0d8ff75adee42458b471c79ac1172b25aa484f8b507f3ea90b55d51987df93540470e04a06c4a92f

Download Submit
memory/2580-22-0x0000000073160000-0x00000000732D1000-memory.dmp

Filesize
1.4MB

Download
memory/2580-18-0x0000000073160000-0x00000000732D1000-memory.dmp

Filesize
1.4MB

Download
memory/2580-20-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/2580-17-0x0000000073160000-0x00000000732D1000-memory.dmp

Filesize
1.4MB

Download
memory/4236-13-0x00000000006D0000-0x00000000006F1000-memory.dmp

Filesize
132KB

Download
memory/4236-5-0x00000000006D0000-0x00000000006F1000-memory.dmp

Filesize
132KB

Download
memory/4236-9-0x00000000006D0000-0x00000000006F1000-memory.dmp

Filesize
132KB

Download
memory/4236-10-0x00000000006D0000-0x00000000006F1000-memory.dmp

Filesize
132KB

Download
memory/4236-11-0x00000000006D0000-0x00000000006F1000-memory.dmp

Filesize
132KB

Download
memory/4644-28-0x0000000000790000-0x00000000007B1000-memory.dmp

Filesize
132KB

Download
memory/4644-21-0x0000000000790000-0x00000000007B1000-memory.dmp

Filesize
132KB

Download
memory/4644-24-0x0000000000790000-0x00000000007B1000-memory.dmp

Filesize
132KB

Download
memory/4644-25-0x0000000000790000-0x00000000007B1000-memory.dmp

Filesize
132KB

Download
memory/4644-26-0x0000000000790000-0x00000000007B1000-memory.dmp

Filesize
132KB

Download
memory/4656-1-0x0000000074940000-0x0000000074AB1000-memory.dmp

Filesize
1.4MB

Download
memory/4656-4-0x0000000001520000-0x0000000001521000-memory.dmp

Filesize
4KB

Download
memory/4656-6-0x0000000074940000-0x0000000074AB1000-memory.dmp

Filesize
1.4MB

Download
memory/4656-0-0x0000000074940000-0x0000000074AB1000-memory.dmp

Filesize
1.4MB

Download
memory/4656-2-0x0000000074940000-0x0000000074AB1000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads