qakbot | de078c0c7496c940fae5d2e88b5c46f9ba9f90c7295c89f42e779d8c5678acd9

General

Target

6909b126c0a911b049a7bf7efc8b0917_JaffaCakes118.dll
Size

572KB
MD5

6909b126c0a911b049a7bf7efc8b0917
SHA1

fa30c9d60500be6a7dc72179fd216189545fee45
SHA256

de078c0c7496c940fae5d2e88b5c46f9ba9f90c7295c89f42e779d8c5678acd9
SHA512

b79493d8fa492ae9d24d653ae0c26be9346a0195a6d95d206aa13df7f30de0327058cd9d8a5f0b1b2224e4603866221c0fbe441d7e4f59e1061aecd7d13af78e
SSDEEP

6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eH2:VvAfLfaEkAz5x

Score

10^/10

qakbot obama114 1634112211 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

C2

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Oeyzp = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Demyvauew = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid	Process
1664	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exe

pid	Process
4664	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rivdmspgdedim\bd6067c6 = 308e7225d717e3dc834e0f490edf8267e6f8a21573e9aa3c779ee8ab4d0447bdc8b94cf4fae4984dd38346716803b709aa911747fdb0ba803d641a184641dfb7c63d60dd3bab28da84f348d080ad40613301288db0bea90700	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rivdmspgdedim	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rivdmspgdedim\c2290830 = b85cedf5b4267ef7060b83f024012f33027a36e7896f1b6ab0a8b56579da	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rivdmspgdedim\f5f7f802 = dd8601da454da31fcc511e4370e897b60b109bea3097d2f56c094e0837f4f2d4495fda7a8393dfb35e65969720137645b8c74489244be5590a24e12d671dcbcb9cc34cb5d06dfe593b0430da246c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rivdmspgdedim\3043d0ed = d5c1eb12690dbf085e3e686f71e6b6f6f12d8f25677bda37c1da48c7345199aed0c42c5e71c3452b2156046eb15c240047a7918e238330e00f5ecb154f868d5e96022c5c3949e5c68428877836e1e25aa73b40d7a0d1a00d4102447cb5acb74f23b8e3bc3b8635068871	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rivdmspgdedim\c2290830 = b85cfaf5b4264b1f151cd944ac450a0120c50b58d9f7973c0c5a935c0aa0920981408a2c3edb98c44698b2b0d2b8d65c8befb6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rivdmspgdedim\f7b6d87e = df1689a6d2b7d820eab3b56e49edc25483c7bd0e753ca5f0e392faea6fc07225da4e105a49657fb0059e73bbf3beb3902b71f25900e4494c48307e0b78f72603d8e3e0dc4ad9d27d54050fe610058e826b1692428cd9d1f360437d56b2be3bfb6af65af04c104e573a4fd2ea2fb40026b52412911b5d558c06f419e780788b909ea13f03c6c242382726be81248a4f6cfc4c888e6aea2f4967ebac21f899fa7ee0a0263a83f00dc887502c0375d7cb1950160bf5ff8cf6a0f640b5c2f3ed1d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rivdmspgdedim\4d4b9f67 = d1e54382d3bc5a339c1ba96651e4bf74d7ef90bc6bfe040c5413c680bf011d27939db6e33e536e60c7d21aeea5287f1888c9798b754c52179ffc3137d2411b4a49c61d4cbf86aa5fb5f6247f0a9fe5ce2881431026d13c292b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rivdmspgdedim\88ffb788 = 8ed731dd98ca8b4996ea4a091380646c8a70cb5985020ddbb43302f686cd1d188aa5494d60a459eba6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Rivdmspgdedim\4f0abf1b = 261ddee0ba42ec3e77204c26ad9c933c2444b0bbaddf9af50ee264bf98cc251b1bccc371a4ba68d0839bda2f7e8783ab1f6aa759777db852225c3d5f6db3564106da511d9cfbe1	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid	Process
4356	rundll32.exe
4356	rundll32.exe
1664	regsvr32.exe
1664	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid	Process
4356	rundll32.exe
1664	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	Process	procid_target
PID 4700 wrote to memory of 4356	4700	rundll32.exe	94
PID 4700 wrote to memory of 4356	4700	rundll32.exe	94
PID 4700 wrote to memory of 4356	4700	rundll32.exe	94
PID 4356 wrote to memory of 2672	4356	rundll32.exe	97
PID 4356 wrote to memory of 2672	4356	rundll32.exe	97
PID 4356 wrote to memory of 2672	4356	rundll32.exe	97
PID 4356 wrote to memory of 2672	4356	rundll32.exe	97
PID 4356 wrote to memory of 2672	4356	rundll32.exe	97
PID 2672 wrote to memory of 4664	2672	explorer.exe	98
PID 2672 wrote to memory of 4664	2672	explorer.exe	98
PID 2672 wrote to memory of 4664	2672	explorer.exe	98
PID 2796 wrote to memory of 1664	2796	regsvr32.exe	110
PID 2796 wrote to memory of 1664	2796	regsvr32.exe	110
PID 2796 wrote to memory of 1664	2796	regsvr32.exe	110
PID 1664 wrote to memory of 2804	1664	regsvr32.exe	111
PID 1664 wrote to memory of 2804	1664	regsvr32.exe	111
PID 1664 wrote to memory of 2804	1664	regsvr32.exe	111
PID 1664 wrote to memory of 2804	1664	regsvr32.exe	111
PID 1664 wrote to memory of 2804	1664	regsvr32.exe	111
PID 2804 wrote to memory of 732	2804	explorer.exe	112
PID 2804 wrote to memory of 732	2804	explorer.exe	112
PID 2804 wrote to memory of 4644	2804	explorer.exe	114
PID 2804 wrote to memory of 4644	2804	explorer.exe	114

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6909b126c0a911b049a7bf7efc8b0917_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6909b126c0a911b049a7bf7efc8b0917_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vliixvy /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\6909b126c0a911b049a7bf7efc8b0917_JaffaCakes118.dll\"" /SC ONCE /Z /ST 05:32 /ET 05:44
      4⤵
      Creates scheduled task(s)
      PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4420

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\6909b126c0a911b049a7bf7efc8b0917_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\6909b126c0a911b049a7bf7efc8b0917_JaffaCakes118.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Oeyzp" /d "0"
      4⤵
      Windows security bypass
      PID:732
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Demyvauew" /d "0"
      4⤵
      Windows security bypass
      PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6909b126c0a911b049a7bf7efc8b0917_JaffaCakes118.dll

Filesize
572KB

MD5
6909b126c0a911b049a7bf7efc8b0917

SHA1
fa30c9d60500be6a7dc72179fd216189545fee45

SHA256
de078c0c7496c940fae5d2e88b5c46f9ba9f90c7295c89f42e779d8c5678acd9

SHA512
b79493d8fa492ae9d24d653ae0c26be9346a0195a6d95d206aa13df7f30de0327058cd9d8a5f0b1b2224e4603866221c0fbe441d7e4f59e1061aecd7d13af78e

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1664-20-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1664-18-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1664-16-0x0000000001510000-0x0000000001545000-memory.dmp

Filesize
212KB

Download
memory/2672-4-0x00000000009B0000-0x00000000009D1000-memory.dmp

Filesize
132KB

Download
memory/2672-9-0x00000000009B0000-0x00000000009D1000-memory.dmp

Filesize
132KB

Download
memory/2672-10-0x00000000009B0000-0x00000000009D1000-memory.dmp

Filesize
132KB

Download
memory/2672-12-0x00000000009B0000-0x00000000009D1000-memory.dmp

Filesize
132KB

Download
memory/2672-8-0x00000000009B0000-0x00000000009D1000-memory.dmp

Filesize
132KB

Download
memory/2804-19-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Filesize
132KB

Download
memory/2804-24-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Filesize
132KB

Download
memory/2804-23-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Filesize
132KB

Download
memory/2804-22-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Filesize
132KB

Download
memory/4356-3-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/4356-1-0x00000000024C0000-0x00000000024F5000-memory.dmp

Filesize
212KB

Download
memory/4356-2-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/4356-0-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/4356-5-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads