qakbot | 06108c841a33fa691b3b249ca8af7d933de467ee22323c8b008a6ec151824be9

General

Target

5aa6982194b786a9fffc753b71634e5c_JaffaCakes118.dll
Size

574KB
MD5

5aa6982194b786a9fffc753b71634e5c
SHA1

62eba371ab9174dfee99283afdcc3542870edd2b
SHA256

06108c841a33fa691b3b249ca8af7d933de467ee22323c8b008a6ec151824be9
SHA512

ac1962df06ab74628ada9fa555a45321f6cb9a716b46d7806ca57aacf20307e0aa09f40be8a2e12b161a9d1d0d8d8a1a6908d0e68cfba3de13e91545b4cb28da
SSDEEP

3072:uqeP24iABEabz1fz+Bnp1WC3poldfzaSXO3etYkf35qSyYNYuFwXBBWYn0WW6xEe:FUJicLfz+hqs4BtYm35qjY7wXr8nkRv

Score

10^/10

qakbot tr 1634541613 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Tmucypu = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Ekdxuaepx = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3988 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4980 schtasks.exe

pid	process
3988	regsvr32.exe

pid	process
4980	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kumpxrexoi\1e3b8f63 = 892f86e8e7e27c681beaaac738566076f2bc7c83e9f363e28aa97b0ca81736cd0be5cb316b8d387a576be188d7faf59bb1348e1c2683d7c2c66d51186196567c8e2751ca5fe030b88450aa23b5202cd313ec7667d610b7e75b58a06a5f73a8008ef847f5bc765cfd8fda9722c2a319c23bd7a0113bdb02d11ba3e1069a401dfb250b8a820824e3f9d069840169e099bd766baf822f48516c0f6e2fd01e656b0a155558f92251465a888f42e2e1eb1bfa9201301fa5caceebd62ecccf61e66d86f15b7aff33	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kumpxrexoi\1c7aaf1f = b22067e7dc7217aa6241d183f22086510c70c982509ede955f7186219cc88f31a745c152f4ed9b1f566065e18b960d2dc245220b8d3750c718d5a51ec5d79591ab7346	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kumpxrexoi\a4c6c87a = 8d3c56a8c2fb3ad4e6b21ea7015df1ad6784483360c19e0410e4086d820fd3bb5d37662afa8eb99e184f26bedd7c9aabb3601aa1cde18081df2add5c1aa665e87f0cce	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kumpxrexoi\6172e095 = 9d19cce4c4e5156781ab2ba6e89a065b4fdff830bed639b498eebe5a919d5a108b737821b9401a3058b9d6850449f738e0937bae42181ce405ac464ae5af105506fc56fd6ccff72965e6e6a70f9e7c510173cfe9d282acbaee8875bae4ff102d9352547a8fe9f2a1252eb0162d1fc591	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kumpxrexoi\a687e806 = 956a3de5a379692c5120c637c50f91d77ab557e0e23407dad298ae1096dd8b3981eae5eb44e62e7113bb9f4b4365b7897a893d69751b2a673d95f22d8beead96ffa2e53e18ca579f19add34fc834376804a82ed9cf269b5f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kumpxrexoi\54ed30db = 02e4ca49a69c257739a762747a4eb891866f2542dda06ca44bd31eb8723c606755450772dbab6db3	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kumpxrexoi	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kumpxrexoi\2ba45f2d = 6076583909750b384711f52e1c0e74112df09df6ecdf052340d24493bd6465fb5f7664b9a5f83be32ac17ab032798503d350776e2b168073e80367f694990579af993e2f55e5d920fc5eaf81	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kumpxrexoi\d9ce87f0 = 8a717f6489506ab6f70b013692502ae46bb596213edc2f47c66fad30697f603a0473849609087ff35ab9d71b1d42d3f40a99	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kumpxrexoi\2ba45f2d = 60764f3909753ebdc7ee11010401099d05d65fa07c70e27e9f99e6b7fc2a83539de70153daf2e3373881ac2b6223d1e7e7d03df99595c7b20bc7e2a573d87c3c28e9d17154e647151441f5b19c3612086f45391b05835a7d08fee56a635d1abcdb	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

624 rundll32.exe
624 rundll32.exe
3988 regsvr32.exe
3988 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

624 rundll32.exe
3988 regsvr32.exe

pid	process
624	rundll32.exe
624	rundll32.exe
3988	regsvr32.exe
3988	regsvr32.exe

pid	process
624	rundll32.exe
3988	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 832 wrote to memory of 624	832	rundll32.exe	rundll32.exe
PID 832 wrote to memory of 624	832	rundll32.exe	rundll32.exe
PID 832 wrote to memory of 624	832	rundll32.exe	rundll32.exe
PID 624 wrote to memory of 4460	624	rundll32.exe	explorer.exe
PID 624 wrote to memory of 4460	624	rundll32.exe	explorer.exe
PID 624 wrote to memory of 4460	624	rundll32.exe	explorer.exe
PID 624 wrote to memory of 4460	624	rundll32.exe	explorer.exe
PID 624 wrote to memory of 4460	624	rundll32.exe	explorer.exe
PID 4460 wrote to memory of 4980	4460	explorer.exe	schtasks.exe
PID 4460 wrote to memory of 4980	4460	explorer.exe	schtasks.exe
PID 4460 wrote to memory of 4980	4460	explorer.exe	schtasks.exe
PID 2432 wrote to memory of 3988	2432	regsvr32.exe	regsvr32.exe
PID 2432 wrote to memory of 3988	2432	regsvr32.exe	regsvr32.exe
PID 2432 wrote to memory of 3988	2432	regsvr32.exe	regsvr32.exe
PID 3988 wrote to memory of 2344	3988	regsvr32.exe	explorer.exe
PID 3988 wrote to memory of 2344	3988	regsvr32.exe	explorer.exe
PID 3988 wrote to memory of 2344	3988	regsvr32.exe	explorer.exe
PID 3988 wrote to memory of 2344	3988	regsvr32.exe	explorer.exe
PID 3988 wrote to memory of 2344	3988	regsvr32.exe	explorer.exe
PID 2344 wrote to memory of 3140	2344	explorer.exe	reg.exe
PID 2344 wrote to memory of 3140	2344	explorer.exe	reg.exe
PID 2344 wrote to memory of 2064	2344	explorer.exe	reg.exe
PID 2344 wrote to memory of 2064	2344	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa6982194b786a9fffc753b71634e5c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa6982194b786a9fffc753b71634e5c_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4460

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn syrcxlqe /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\5aa6982194b786a9fffc753b71634e5c_JaffaCakes118.dll\"" /SC ONCE /Z /ST 18:25 /ET 18:37
4⤵
- Creates scheduled task(s)
PID:4980

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\5aa6982194b786a9fffc753b71634e5c_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\5aa6982194b786a9fffc753b71634e5c_JaffaCakes118.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3988

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ekdxuaepx" /d "0"
4⤵
- Windows security bypass
PID:3140

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Tmucypu" /d "0"
4⤵
- Windows security bypass
PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5aa6982194b786a9fffc753b71634e5c_JaffaCakes118.dll
Filesize
574KB

MD5
5aa6982194b786a9fffc753b71634e5c

SHA1
62eba371ab9174dfee99283afdcc3542870edd2b

SHA256
06108c841a33fa691b3b249ca8af7d933de467ee22323c8b008a6ec151824be9

SHA512
ac1962df06ab74628ada9fa555a45321f6cb9a716b46d7806ca57aacf20307e0aa09f40be8a2e12b161a9d1d0d8d8a1a6908d0e68cfba3de13e91545b4cb28da

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/624-1-0x0000000010000000-0x000000001008F000-memory.dmp

Filesize
572KB

Download
memory/624-3-0x0000000010000000-0x000000001008F000-memory.dmp

Filesize
572KB

Download
memory/624-0-0x0000000002090000-0x00000000020C4000-memory.dmp

Filesize
208KB

Download
memory/2344-25-0x0000000000A80000-0x0000000000AA1000-memory.dmp

Filesize
132KB

Download
memory/2344-23-0x0000000000A80000-0x0000000000AA1000-memory.dmp

Filesize
132KB

Download
memory/2344-22-0x0000000000A80000-0x0000000000AA1000-memory.dmp

Filesize
132KB

Download
memory/2344-21-0x0000000000A80000-0x0000000000AA1000-memory.dmp

Filesize
132KB

Download
memory/2344-18-0x0000000000A80000-0x0000000000AA1000-memory.dmp

Filesize
132KB

Download
memory/3988-17-0x0000000010000000-0x000000001008F000-memory.dmp

Filesize
572KB

Download
memory/3988-16-0x0000000010000000-0x000000001008F000-memory.dmp

Filesize
572KB

Download
memory/3988-14-0x00000000018E0000-0x0000000001914000-memory.dmp

Filesize
208KB

Download
memory/3988-19-0x00000000018E0000-0x0000000001914000-memory.dmp

Filesize
208KB

Download
memory/4460-10-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/4460-7-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/4460-8-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/4460-6-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/4460-2-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads