qakbot | ecd8bef42e95c6569eba5e866f74a7e97ae2d64445042d26f731158722b05070

General

Target

3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118.dll
Size

833KB
MD5

3ddb39b2274cac8767d7b30330b5e392
SHA1

e7c29e9b9109056647293df1b0bb040937352726
SHA256

ecd8bef42e95c6569eba5e866f74a7e97ae2d64445042d26f731158722b05070
SHA512

102ebb5fd26743dae06d7e74d5ab1d216147004361e9fe654bf4333b4fa5551205a3429453684ba04d7a79385d23c5290999e3a77afbf8b6d053df83641923c7
SSDEEP

24576:nU/lh7rH/i9rz+hwKzyUj/JGzwMgtx1EWsrbw4iaZ4gRrb0:nU9h7e9rz+t/JGz5g3uWsrbw4iaqgRro

Score

10^/10

qakbot tr 1633597626 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633597626

C2

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Maigmslgfjhw = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Ldmyodotcqa = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

540 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2608 schtasks.exe

pid	process
540	regsvr32.exe

pid	process
2608	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xabsmzla\9d2094ea = 2d4896dc31a00bf0d93dc866a674c50e632dc80dd0b346f62f80e0616f957caa18d78f63c7caff05704dbc0c2a1170f3390c6a7e34f3bcf0844b42d495de590b66725044fb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xabsmzla\a8bf44a4 = 749f470b9db4cb7d9a8ef9220353641145485eb2414ae0471c6a0fab8a8a4355347d0193c4ce8e88c5204755a47bab1a324ae34f7148cee2758fb2cd0b2c8dbfdcfd991e2ffa4d0dff0511dae2f6c73be3b29f2bc9067875a558ec7bdc54c9c4e14a4a3398a596e17f481f258ebd759499083760be3112443b0042d74efb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xabsmzla\aafe64d8 = 5c0f0b94a2a586e09ae8d650aeb81cb3aa7d61aba448b568a0d34dbba01b5a0c40a68f5eb73b724d560fa1843aead3ddf2e26cb536a2d3e85b117dc3a8a2f24c344c2c8a0b48	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xabsmzla\124203bd = 0379eb99952f8b019fdcbb51756263d6f098e707a64b5d2e54f79b6845229495b23c1edd039790b04fc2bae3b795c592	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xabsmzla\6f4a4c37 = a00d1bdbca3f341d27c228bcac94e5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xabsmzla\d7f62b52 = 49f7584dd4b5a011cb392d7c20ae6acbd6ee2851122ed596ac42e951f63ad8ada4a2e190ebb21d8a4b0d53745f10ae100e32	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xabsmzla\100323c1 = 0c90be360d8a3dc61a15998a217f802abb01fb0310863e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xabsmzla	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xabsmzla\9d2094ea = 2d4881dc31a03e2d981e2f21208d6f6d3da5c01e550d97ad995841a26b7b268226844e7d205c6b0b13a7a4814677b1a6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xabsmzla\e269fb1c = 2d1835bf40330cc85b52717065e324f8554fc75885c35357f0d61ca6d98f763763e3dd22e2fb2942727a1e5a3f38dcc427439f1ae3a9f2dc936b231cedeb571ac40c65cef99eda1b9ab14a6f088ee202186ef5	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2836 rundll32.exe
540 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2836 rundll32.exe
540 regsvr32.exe

pid	process
2836	rundll32.exe
540	regsvr32.exe

pid	process
2836	rundll32.exe
540	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2684 wrote to memory of 2836	2684	rundll32.exe	rundll32.exe
PID 2684 wrote to memory of 2836	2684	rundll32.exe	rundll32.exe
PID 2684 wrote to memory of 2836	2684	rundll32.exe	rundll32.exe
PID 2684 wrote to memory of 2836	2684	rundll32.exe	rundll32.exe
PID 2684 wrote to memory of 2836	2684	rundll32.exe	rundll32.exe
PID 2684 wrote to memory of 2836	2684	rundll32.exe	rundll32.exe
PID 2684 wrote to memory of 2836	2684	rundll32.exe	rundll32.exe
PID 2836 wrote to memory of 2504	2836	rundll32.exe	explorer.exe
PID 2836 wrote to memory of 2504	2836	rundll32.exe	explorer.exe
PID 2836 wrote to memory of 2504	2836	rundll32.exe	explorer.exe
PID 2836 wrote to memory of 2504	2836	rundll32.exe	explorer.exe
PID 2836 wrote to memory of 2504	2836	rundll32.exe	explorer.exe
PID 2836 wrote to memory of 2504	2836	rundll32.exe	explorer.exe
PID 2504 wrote to memory of 2608	2504	explorer.exe	schtasks.exe
PID 2504 wrote to memory of 2608	2504	explorer.exe	schtasks.exe
PID 2504 wrote to memory of 2608	2504	explorer.exe	schtasks.exe
PID 2504 wrote to memory of 2608	2504	explorer.exe	schtasks.exe
PID 1712 wrote to memory of 804	1712	taskeng.exe	regsvr32.exe
PID 1712 wrote to memory of 804	1712	taskeng.exe	regsvr32.exe
PID 1712 wrote to memory of 804	1712	taskeng.exe	regsvr32.exe
PID 1712 wrote to memory of 804	1712	taskeng.exe	regsvr32.exe
PID 1712 wrote to memory of 804	1712	taskeng.exe	regsvr32.exe
PID 804 wrote to memory of 540	804	regsvr32.exe	regsvr32.exe
PID 804 wrote to memory of 540	804	regsvr32.exe	regsvr32.exe
PID 804 wrote to memory of 540	804	regsvr32.exe	regsvr32.exe
PID 804 wrote to memory of 540	804	regsvr32.exe	regsvr32.exe
PID 804 wrote to memory of 540	804	regsvr32.exe	regsvr32.exe
PID 804 wrote to memory of 540	804	regsvr32.exe	regsvr32.exe
PID 804 wrote to memory of 540	804	regsvr32.exe	regsvr32.exe
PID 540 wrote to memory of 1856	540	regsvr32.exe	explorer.exe
PID 540 wrote to memory of 1856	540	regsvr32.exe	explorer.exe
PID 540 wrote to memory of 1856	540	regsvr32.exe	explorer.exe
PID 540 wrote to memory of 1856	540	regsvr32.exe	explorer.exe
PID 540 wrote to memory of 1856	540	regsvr32.exe	explorer.exe
PID 540 wrote to memory of 1856	540	regsvr32.exe	explorer.exe
PID 1856 wrote to memory of 1664	1856	explorer.exe	reg.exe
PID 1856 wrote to memory of 1664	1856	explorer.exe	reg.exe
PID 1856 wrote to memory of 1664	1856	explorer.exe	reg.exe
PID 1856 wrote to memory of 1664	1856	explorer.exe	reg.exe
PID 1856 wrote to memory of 892	1856	explorer.exe	reg.exe
PID 1856 wrote to memory of 892	1856	explorer.exe	reg.exe
PID 1856 wrote to memory of 892	1856	explorer.exe	reg.exe
PID 1856 wrote to memory of 892	1856	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2836

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jdqikmvtt /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118.dll\"" /SC ONCE /Z /ST 14:26 /ET 14:38
4⤵
- Creates scheduled task(s)
PID:2608

C:\Windows\system32\taskeng.exe
taskeng.exe {E69A8A89-487A-4D7C-B9FE-412A0309C139} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:804

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1856

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Maigmslgfjhw" /d "0"
5⤵
- Windows security bypass
PID:1664

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ldmyodotcqa" /d "0"
5⤵
- Windows security bypass
PID:892

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118.dll
Filesize
833KB

MD5
3ddb39b2274cac8767d7b30330b5e392

SHA1
e7c29e9b9109056647293df1b0bb040937352726

SHA256
ecd8bef42e95c6569eba5e866f74a7e97ae2d64445042d26f731158722b05070

SHA512
102ebb5fd26743dae06d7e74d5ab1d216147004361e9fe654bf4333b4fa5551205a3429453684ba04d7a79385d23c5290999e3a77afbf8b6d053df83641923c7

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/540-28-0x0000000074260000-0x00000000743D1000-memory.dmp

Filesize
1.4MB

Download
memory/540-23-0x0000000074260000-0x00000000743D1000-memory.dmp

Filesize
1.4MB

Download
memory/540-21-0x0000000074260000-0x00000000743D1000-memory.dmp

Filesize
1.4MB

Download
memory/540-20-0x0000000074260000-0x00000000743D1000-memory.dmp

Filesize
1.4MB

Download
memory/1856-32-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1856-31-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1856-30-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1856-26-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2504-7-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2504-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2504-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2504-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2504-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2504-5-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2836-8-0x0000000074CC0000-0x0000000074E31000-memory.dmp

Filesize
1.4MB

Download
memory/2836-0-0x0000000074CC0000-0x0000000074E31000-memory.dmp

Filesize
1.4MB

Download
memory/2836-1-0x0000000074CC0000-0x0000000074E31000-memory.dmp

Filesize
1.4MB

Download
memory/2836-4-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2836-2-0x0000000074CC0000-0x0000000074E31000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads