qakbot | 4eebacf9b5e2267f88df9011b3f6027116a2b765a4eb34bade925892705a9dab

General

Target

591c417ad8fe1811a1716c513ce86500_JaffaCakes118.dll
Size

572KB
MD5

591c417ad8fe1811a1716c513ce86500
SHA1

d2ce8d500ba3b56a2dd020c7d48e2a253c0993bc
SHA256

4eebacf9b5e2267f88df9011b3f6027116a2b765a4eb34bade925892705a9dab
SHA512

56c252c7d8e8d4e49b4d7731e6219fbebe91626294f59d4e1c1101145cafc8e152dcdd275add832e7e298688bde79698b0981cccce946708f7ca2a20b8a93016
SSDEEP

6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eHu:VvAfLfaEkAz5J

Score

10^/10

qakbot obama114 1634112211 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

C2

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Geapjuudm = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Domjyseqo = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
2292	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5012	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urofcwtlg\a47750d2 = 9bea388a3073eb975683c3d857c4c4b706914e2dae4b37e9bedb52f16ccdd2a5b3317aa9b545562bf6011fcbc98855f829858cccfc93037aee3d6c4eecbcb83c1b1f0ef6164f9994a1a0463fa4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urofcwtlg\d97f1f58 = bf95061f6302810f55fc8d6679e9ae5d7bcf5c28dc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urofcwtlg\a63670ae = 9d6ce857a39eafe05553d00c472e110955420481e660b1b8ebbd8e4726bf3d00162ba1ed23978755c635fad4face96e7ff0e065ca5841229ecc8bc88c3cf6ff8c8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urofcwtlg\545ca873 = 777694807e5006ac8424196c71bdce44ac5750ec1cd2fb3a7a6506d0b45797b1355fec5a039b64bff25e33b79b4d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urofcwtlg\2b15c785 = f47b8edbf5f93b04aa655409637290d2f9ed6b70391a8f8919e802d309dbb496ca78efbd206c729fce049e93c9ab702377fe342cab9c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urofcwtlg\2b15c785 = f47b99dbf5f90e1b2af962cb798fbff02c7e36dcc322cf17c7fa3496a084554ea6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urofcwtlg\1e8a17cb = c0b53ab7fd2c34a4cd4c073fa21ffde84743c9ae82f308c17f8fdb172f2a43ee38e98c8e204f20a88f1dc25482788ef462f1b41d823867b8468da48d3801ed6408b51812150e6cc7e6264f25e5f2bf57372e4d3922724d41c3c2cd45b7c26b199462c832fd14ec5c9b12a049851295348219ff162db49dcb1aa2fbe9f7fc9d9255cf96fe85811c60727a58365af54222f79fac7f3da6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urofcwtlg\61c3783d = 6411dfdc4c494d595dde2289b708480df403417c71e7bc13e053f75ead8c1c18511889585ae65d2af298a7672a569f186c7ba5cf8ef2d55b2ebcfb9b03266cf5b8f7eec81bb668eb2a199fe82ac98d44ef619d7b2a73174efc087422aee7cf297c	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urofcwtlg	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Urofcwtlg\1ccb37b7 = 93d773eed4c9fec36f5f379e6a8423d2e26d9b53b21453ac1161255ebf955c46f522	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2628	rundll32.exe
2628	rundll32.exe
2292	regsvr32.exe
2292	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2628	rundll32.exe
2292	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 2628	4304	rundll32.exe	86
PID 4304 wrote to memory of 2628	4304	rundll32.exe	86
PID 4304 wrote to memory of 2628	4304	rundll32.exe	86
PID 2628 wrote to memory of 4404	2628	rundll32.exe	90
PID 2628 wrote to memory of 4404	2628	rundll32.exe	90
PID 2628 wrote to memory of 4404	2628	rundll32.exe	90
PID 2628 wrote to memory of 4404	2628	rundll32.exe	90
PID 2628 wrote to memory of 4404	2628	rundll32.exe	90
PID 4404 wrote to memory of 5012	4404	explorer.exe	93
PID 4404 wrote to memory of 5012	4404	explorer.exe	93
PID 4404 wrote to memory of 5012	4404	explorer.exe	93
PID 4616 wrote to memory of 2292	4616	regsvr32.exe	102
PID 4616 wrote to memory of 2292	4616	regsvr32.exe	102
PID 4616 wrote to memory of 2292	4616	regsvr32.exe	102
PID 2292 wrote to memory of 1860	2292	regsvr32.exe	103
PID 2292 wrote to memory of 1860	2292	regsvr32.exe	103
PID 2292 wrote to memory of 1860	2292	regsvr32.exe	103
PID 2292 wrote to memory of 1860	2292	regsvr32.exe	103
PID 2292 wrote to memory of 1860	2292	regsvr32.exe	103
PID 1860 wrote to memory of 1036	1860	explorer.exe	104
PID 1860 wrote to memory of 1036	1860	explorer.exe	104
PID 1860 wrote to memory of 4888	1860	explorer.exe	106
PID 1860 wrote to memory of 4888	1860	explorer.exe	106

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\591c417ad8fe1811a1716c513ce86500_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\591c417ad8fe1811a1716c513ce86500_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lgyvdsnnx /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\591c417ad8fe1811a1716c513ce86500_JaffaCakes118.dll\"" /SC ONCE /Z /ST 17:11 /ET 17:23
      4⤵
      Creates scheduled task(s)
      PID:5012

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\591c417ad8fe1811a1716c513ce86500_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\591c417ad8fe1811a1716c513ce86500_JaffaCakes118.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Geapjuudm" /d "0"
      4⤵
      Windows security bypass
      PID:1036
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Domjyseqo" /d "0"
      4⤵
      Windows security bypass
      PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\591c417ad8fe1811a1716c513ce86500_JaffaCakes118.dll

Filesize
572KB

MD5
591c417ad8fe1811a1716c513ce86500

SHA1
d2ce8d500ba3b56a2dd020c7d48e2a253c0993bc

SHA256
4eebacf9b5e2267f88df9011b3f6027116a2b765a4eb34bade925892705a9dab

SHA512
56c252c7d8e8d4e49b4d7731e6219fbebe91626294f59d4e1c1101145cafc8e152dcdd275add832e7e298688bde79698b0981cccce946708f7ca2a20b8a93016

Download Submit
memory/1860-20-0x0000000000C00000-0x0000000000C21000-memory.dmp

Filesize
132KB

Download
memory/1860-27-0x0000000000C00000-0x0000000000C21000-memory.dmp

Filesize
132KB

Download
memory/1860-25-0x0000000000C00000-0x0000000000C21000-memory.dmp

Filesize
132KB

Download
memory/1860-24-0x0000000000C00000-0x0000000000C21000-memory.dmp

Filesize
132KB

Download
memory/1860-23-0x0000000000C00000-0x0000000000C21000-memory.dmp

Filesize
132KB

Download
memory/2292-16-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2292-21-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2292-18-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2292-17-0x0000000001C80000-0x0000000001CB5000-memory.dmp

Filesize
212KB

Download
memory/2628-0-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2628-2-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2628-1-0x0000000002E00000-0x0000000002E35000-memory.dmp

Filesize
212KB

Download
memory/2628-5-0x0000000002E00000-0x0000000002E35000-memory.dmp

Filesize
212KB

Download
memory/2628-4-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/4404-12-0x00000000010D0000-0x00000000010F1000-memory.dmp

Filesize
132KB

Download
memory/4404-3-0x00000000010D0000-0x00000000010F1000-memory.dmp

Filesize
132KB

Download
memory/4404-10-0x00000000010D0000-0x00000000010F1000-memory.dmp

Filesize
132KB

Download
memory/4404-9-0x00000000010D0000-0x00000000010F1000-memory.dmp

Filesize
132KB

Download
memory/4404-8-0x00000000010D0000-0x00000000010F1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads