qakbot | ecd8bef42e95c6569eba5e866f74a7e97ae2d64445042d26f731158722b05070

General

Target

3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118.dll
Size

833KB
MD5

3ddb39b2274cac8767d7b30330b5e392
SHA1

e7c29e9b9109056647293df1b0bb040937352726
SHA256

ecd8bef42e95c6569eba5e866f74a7e97ae2d64445042d26f731158722b05070
SHA512

102ebb5fd26743dae06d7e74d5ab1d216147004361e9fe654bf4333b4fa5551205a3429453684ba04d7a79385d23c5290999e3a77afbf8b6d053df83641923c7
SSDEEP

24576:nU/lh7rH/i9rz+hwKzyUj/JGzwMgtx1EWsrbw4iaZ4gRrb0:nU9h7e9rz+t/JGz5g3uWsrbw4iaqgRro

Score

10^/10

qakbot tr 1633597626 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633597626

C2

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Cxetzba = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Yafogbxzduez = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2432 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3020 schtasks.exe

pid	process
2432	regsvr32.exe

pid	process
3020	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Resiymypmfuao	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Resiymypmfuao\2726e6a9 = 408af09040f7bcf8fc73925d657007bcacdf3ac2b9f6b6ea3129d164a7b31ac015619b5d41d55a14835f8ee07bee9d610bc4340c5d6c12bb2f0e5a6179aee9e1a6fe428b09a54caa86616adcba341a8b5586	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Resiymypmfuao\5a2ea923 = e15e112ed34a4f95548abdd3ab0825501db8b100cc214cfde98205ba0ba4f22130798ec80810f16420e58f5c24f4723c15be532e02c6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Resiymypmfuao\9ddba1b0 = 64ce7b0a6bc4892f304e7350ff1bb5d0755c897dad4642600339305e9273cb906044c2cfa5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Resiymypmfuao\6fb1796d = 4d7b78f26066b0558ee8c36af5094afc8aa7c996ead7e87442d3da5d46009ed4eda2be5e3c353f918f10ea32b5c320819462fa3871078c44a91e4e19238ccd2339daa2ba91ced413d55cb7a2dc0c1ee79f230cc85f2d049f525c01d46e0cda26b1ba6c71c13b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Resiymypmfuao\10f8169b = 52646e0d1f4fee59f3df0e7df89727a63cb2d087c759cb62c0d82144d5e9508465543a33	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Resiymypmfuao\10f8169b = 5264790d1f4fdbc85d307870143a84	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Resiymypmfuao\2567c6d5 = bab5952138eb0d2d18be81b2dde39cfc6a7752125241b313d7c0f9fa2efd0654808b4e5e1eddd11cfb4143ef7b7722530fda847beb025623b1e76f13a29a7d5459a2a12c990bc510e7c6cdb612469dfd5cb5afb4ce7b2a668a96f120e3fa68fab0d051a7b133abfbeddfd553229a79ac33f85169348cdabce667da1767dbc72f44b45d9f7a93134b4cdcc873fd5d57983aa88c37d8eb04bd34380e01843a4f3c509c5692f7012fe31db44167581b3bdf587731a8c162	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Resiymypmfuao\9f9a81cc = ea915d010ccea95e4aaa74ddd080592c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Resiymypmfuao\e292ce46 = f897329e713962c73f03df43f46d56cf10c2ad94be7052e58da7c9c3a2	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3384 rundll32.exe
3384 rundll32.exe
2432 regsvr32.exe
2432 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3384 rundll32.exe
2432 regsvr32.exe

pid	process
3384	rundll32.exe
3384	rundll32.exe
2432	regsvr32.exe
2432	regsvr32.exe

pid	process
3384	rundll32.exe
2432	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1580 wrote to memory of 3384	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 3384	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 3384	1580	rundll32.exe	rundll32.exe
PID 3384 wrote to memory of 836	3384	rundll32.exe	explorer.exe
PID 3384 wrote to memory of 836	3384	rundll32.exe	explorer.exe
PID 3384 wrote to memory of 836	3384	rundll32.exe	explorer.exe
PID 3384 wrote to memory of 836	3384	rundll32.exe	explorer.exe
PID 3384 wrote to memory of 836	3384	rundll32.exe	explorer.exe
PID 836 wrote to memory of 3020	836	explorer.exe	schtasks.exe
PID 836 wrote to memory of 3020	836	explorer.exe	schtasks.exe
PID 836 wrote to memory of 3020	836	explorer.exe	schtasks.exe
PID 4184 wrote to memory of 2432	4184	regsvr32.exe	regsvr32.exe
PID 4184 wrote to memory of 2432	4184	regsvr32.exe	regsvr32.exe
PID 4184 wrote to memory of 2432	4184	regsvr32.exe	regsvr32.exe
PID 2432 wrote to memory of 3848	2432	regsvr32.exe	explorer.exe
PID 2432 wrote to memory of 3848	2432	regsvr32.exe	explorer.exe
PID 2432 wrote to memory of 3848	2432	regsvr32.exe	explorer.exe
PID 2432 wrote to memory of 3848	2432	regsvr32.exe	explorer.exe
PID 2432 wrote to memory of 3848	2432	regsvr32.exe	explorer.exe
PID 3848 wrote to memory of 1560	3848	explorer.exe	reg.exe
PID 3848 wrote to memory of 1560	3848	explorer.exe	reg.exe
PID 3848 wrote to memory of 3204	3848	explorer.exe	reg.exe
PID 3848 wrote to memory of 3204	3848	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3384

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn znkzdpdo /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118.dll\"" /SC ONCE /Z /ST 14:26 /ET 14:38
4⤵
- Creates scheduled task(s)
PID:3020

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4184

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2432

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3848

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Yafogbxzduez" /d "0"
4⤵
- Windows security bypass
PID:1560

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Cxetzba" /d "0"
4⤵
- Windows security bypass
PID:3204

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3ddb39b2274cac8767d7b30330b5e392_JaffaCakes118.dll
Filesize
833KB

MD5
3ddb39b2274cac8767d7b30330b5e392

SHA1
e7c29e9b9109056647293df1b0bb040937352726

SHA256
ecd8bef42e95c6569eba5e866f74a7e97ae2d64445042d26f731158722b05070

SHA512
102ebb5fd26743dae06d7e74d5ab1d216147004361e9fe654bf4333b4fa5551205a3429453684ba04d7a79385d23c5290999e3a77afbf8b6d053df83641923c7

Download Submit
memory/836-5-0x00000000010C0000-0x00000000010E1000-memory.dmp

Filesize
132KB

Download
memory/836-9-0x00000000010C0000-0x00000000010E1000-memory.dmp

Filesize
132KB

Download
memory/836-10-0x00000000010C0000-0x00000000010E1000-memory.dmp

Filesize
132KB

Download
memory/836-11-0x00000000010C0000-0x00000000010E1000-memory.dmp

Filesize
132KB

Download
memory/836-13-0x00000000010C0000-0x00000000010E1000-memory.dmp

Filesize
132KB

Download
memory/2432-17-0x00000000737D0000-0x0000000073941000-memory.dmp

Filesize
1.4MB

Download
memory/2432-23-0x00000000737D0000-0x0000000073941000-memory.dmp

Filesize
1.4MB

Download
memory/2432-21-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/2432-18-0x00000000737D0000-0x0000000073941000-memory.dmp

Filesize
1.4MB

Download
memory/2432-19-0x00000000737D0000-0x0000000073941000-memory.dmp

Filesize
1.4MB

Download
memory/3384-6-0x0000000074FB0000-0x0000000075121000-memory.dmp

Filesize
1.4MB

Download
memory/3384-0-0x0000000074FB0000-0x0000000075121000-memory.dmp

Filesize
1.4MB

Download
memory/3384-1-0x0000000074FB0000-0x0000000075121000-memory.dmp

Filesize
1.4MB

Download
memory/3384-4-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/3384-2-0x0000000074FB0000-0x0000000075121000-memory.dmp

Filesize
1.4MB

Download
memory/3848-22-0x00000000008D0000-0x00000000008F1000-memory.dmp

Filesize
132KB

Download
memory/3848-25-0x00000000008D0000-0x00000000008F1000-memory.dmp

Filesize
132KB

Download
memory/3848-26-0x00000000008D0000-0x00000000008F1000-memory.dmp

Filesize
132KB

Download
memory/3848-27-0x00000000008D0000-0x00000000008F1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads