qakbot | 06108c841a33fa691b3b249ca8af7d933de467ee22323c8b008a6ec151824be9

General

Target

5aa6982194b786a9fffc753b71634e5c_JaffaCakes118.dll
Size

574KB
MD5

5aa6982194b786a9fffc753b71634e5c
SHA1

62eba371ab9174dfee99283afdcc3542870edd2b
SHA256

06108c841a33fa691b3b249ca8af7d933de467ee22323c8b008a6ec151824be9
SHA512

ac1962df06ab74628ada9fa555a45321f6cb9a716b46d7806ca57aacf20307e0aa09f40be8a2e12b161a9d1d0d8d8a1a6908d0e68cfba3de13e91545b4cb28da
SSDEEP

3072:uqeP24iABEabz1fz+Bnp1WC3poldfzaSXO3etYkf35qSyYNYuFwXBBWYn0WW6xEe:FUJicLfz+hqs4BtYm35qjY7wXr8nkRv

Score

10^/10

qakbot tr 1634541613 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Pciaipqtaryn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Xkwkvwqyoo = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1840 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2824 schtasks.exe

pid	process
1840	regsvr32.exe

pid	process
2824	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uvaahjax	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uvaahjax\e15780d = f42d7d8a80283537b30efd559160fcd8eb48e8bb2d44483e77e7ccd20592eb9524f55d5b02c5b1ca6783e4637fb29195d1320c00c340d86e8ebd2cca0bad864011581e5098dd09f0c2ee60	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uvaahjax\fc7fa0d0 = c998fd3b8040d59e3d4c8fbbd84b938938842102333d7e5490f3b2819761bb9097eb62f7cff1a8bd311d0e5c88b45207f115e9c87ca35518ba5b8b1f877724a0b69e407819383dbd48d503a6109a76ab8ee43a067244272ca76c6e8b613080eb155c4e9dca404dcc7c32d38c01	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uvaahjax\8336cf26 = dfeb0e033969b1d2157442c2dd8127e0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uvaahjax\715c17fb = 4eda018d334902db134a96c90b898b6afc53cc3e702fa8be7287a29a2fdc8a105247463076ef681963dabefa03768c7de9a0e4b8065a114eaf9ea3d124502f4dc31b6cdb76ecb9e3932a1d7fcf19	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uvaahjax\3b8aa843 = 773b6fdf890650fb2cbf076a24658d948f231ce8417d5d8f2e7fc1ad9d0bfe26ad230523199128cbfefc392f4ead891ed489f8c27f9fbb898c5b1093b0f43ed6379c1cba09b78ccf234410dd677abd8eb45d9c62451ae3fc20bac6c7e0ed6d2ae3d2c022394d436106a851627f47ab344aab20b5be551fad21dbf628d37ef252b56e525ea5df	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uvaahjax\39cb883f = ae8b47929ec562a246479e330ba62cbac06fc690b3aeb6954119aeac1a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uvaahjax\8177ef5a = e9fff7645dfe8718606dbdf3f20f8b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uvaahjax\44c3c7b5 = e2cddacb408ed661907d979b7cd26d2e362c5dd6c456d22d44e813f380ce39f34118992cddfbfec6e481	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uvaahjax\e15780d = f42d6a8a802800cc31192d6e576c08a48c803d2e7e14a7b100ea46788e3c79a4cb6eb0b3893a4db2baa19c90f2afabad72ccfecb9bfece7ef240e8734817430e72c5711951abfc0fd9a23a111b424adfeffbf636b390bdb1d37641f314fe7c11	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1988 rundll32.exe
1840 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1988 rundll32.exe
1840 regsvr32.exe

pid	process
1988	rundll32.exe
1840	regsvr32.exe

pid	process
1988	rundll32.exe
1840	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2176 wrote to memory of 1988	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 1988	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 1988	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 1988	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 1988	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 1988	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 1988	2176	rundll32.exe	rundll32.exe
PID 1988 wrote to memory of 3036	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 3036	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 3036	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 3036	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 3036	1988	rundll32.exe	explorer.exe
PID 1988 wrote to memory of 3036	1988	rundll32.exe	explorer.exe
PID 3036 wrote to memory of 2824	3036	explorer.exe	schtasks.exe
PID 3036 wrote to memory of 2824	3036	explorer.exe	schtasks.exe
PID 3036 wrote to memory of 2824	3036	explorer.exe	schtasks.exe
PID 3036 wrote to memory of 2824	3036	explorer.exe	schtasks.exe
PID 1072 wrote to memory of 2380	1072	taskeng.exe	regsvr32.exe
PID 1072 wrote to memory of 2380	1072	taskeng.exe	regsvr32.exe
PID 1072 wrote to memory of 2380	1072	taskeng.exe	regsvr32.exe
PID 1072 wrote to memory of 2380	1072	taskeng.exe	regsvr32.exe
PID 1072 wrote to memory of 2380	1072	taskeng.exe	regsvr32.exe
PID 2380 wrote to memory of 1840	2380	regsvr32.exe	regsvr32.exe
PID 2380 wrote to memory of 1840	2380	regsvr32.exe	regsvr32.exe
PID 2380 wrote to memory of 1840	2380	regsvr32.exe	regsvr32.exe
PID 2380 wrote to memory of 1840	2380	regsvr32.exe	regsvr32.exe
PID 2380 wrote to memory of 1840	2380	regsvr32.exe	regsvr32.exe
PID 2380 wrote to memory of 1840	2380	regsvr32.exe	regsvr32.exe
PID 2380 wrote to memory of 1840	2380	regsvr32.exe	regsvr32.exe
PID 1840 wrote to memory of 1708	1840	regsvr32.exe	explorer.exe
PID 1840 wrote to memory of 1708	1840	regsvr32.exe	explorer.exe
PID 1840 wrote to memory of 1708	1840	regsvr32.exe	explorer.exe
PID 1840 wrote to memory of 1708	1840	regsvr32.exe	explorer.exe
PID 1840 wrote to memory of 1708	1840	regsvr32.exe	explorer.exe
PID 1840 wrote to memory of 1708	1840	regsvr32.exe	explorer.exe
PID 1708 wrote to memory of 1308	1708	explorer.exe	reg.exe
PID 1708 wrote to memory of 1308	1708	explorer.exe	reg.exe
PID 1708 wrote to memory of 1308	1708	explorer.exe	reg.exe
PID 1708 wrote to memory of 1308	1708	explorer.exe	reg.exe
PID 1708 wrote to memory of 1124	1708	explorer.exe	reg.exe
PID 1708 wrote to memory of 1124	1708	explorer.exe	reg.exe
PID 1708 wrote to memory of 1124	1708	explorer.exe	reg.exe
PID 1708 wrote to memory of 1124	1708	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa6982194b786a9fffc753b71634e5c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa6982194b786a9fffc753b71634e5c_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bcwparesi /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\5aa6982194b786a9fffc753b71634e5c_JaffaCakes118.dll\"" /SC ONCE /Z /ST 18:25 /ET 18:37
      4⤵
      Creates scheduled task(s)
      PID:2824

C:\Windows\system32\taskeng.exe
taskeng.exe {BFEE88D7-529A-4111-A0CC-D917BDA88B5C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\5aa6982194b786a9fffc753b71634e5c_JaffaCakes118.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\5aa6982194b786a9fffc753b71634e5c_JaffaCakes118.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1708
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Xkwkvwqyoo" /d "0"
        5⤵
        Windows security bypass
        
        PID:1308
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Pciaipqtaryn" /d "0"
        5⤵
        Windows security bypass
        
        PID:1124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5aa6982194b786a9fffc753b71634e5c_JaffaCakes118.dll

Filesize
574KB

MD5
5aa6982194b786a9fffc753b71634e5c

SHA1
62eba371ab9174dfee99283afdcc3542870edd2b

SHA256
06108c841a33fa691b3b249ca8af7d933de467ee22323c8b008a6ec151824be9

SHA512
ac1962df06ab74628ada9fa555a45321f6cb9a716b46d7806ca57aacf20307e0aa09f40be8a2e12b161a9d1d0d8d8a1a6908d0e68cfba3de13e91545b4cb28da

Download Submit
memory/1708-28-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1708-26-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1708-25-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1708-24-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1708-21-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1840-22-0x0000000010000000-0x000000001008F000-memory.dmp

Filesize
572KB

Download
memory/1840-18-0x0000000010000000-0x000000001008F000-memory.dmp

Filesize
572KB

Download
memory/1840-17-0x0000000000180000-0x00000000001B4000-memory.dmp

Filesize
208KB

Download
memory/1988-5-0x0000000010000000-0x000000001008F000-memory.dmp

Filesize
572KB

Download
memory/1988-0-0x0000000000130000-0x0000000000164000-memory.dmp

Filesize
208KB

Download
memory/1988-1-0x0000000010000000-0x000000001008F000-memory.dmp

Filesize
572KB

Download
memory/3036-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3036-10-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3036-9-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3036-8-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3036-4-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3036-2-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads