qakbot | d6b1d2ca4ea331f84bfeab5b0590c418a5f337e84a06344789530afeca1392c8

General

Target

6f96cdd054b91e7baf9d05427c334f69_JaffaCakes118.dll
Size

1.5MB
MD5

6f96cdd054b91e7baf9d05427c334f69
SHA1

cec98fb02ea073ff78931bf5e9bc46a6e5c44fee
SHA256

d6b1d2ca4ea331f84bfeab5b0590c418a5f337e84a06344789530afeca1392c8
SHA512

15b56798ad37df3bf50655236768f7c28f08a491e0ed1b53ffa7e859f4e363ffa532dfbf8506819ef1b852291b1aad4785fc15a9dd46e7bced6f1274d06acc36
SSDEEP

24576:3GmJKD/08hih1usiHtEy2YbFRf5J8urbjtWkqXYayS2/3T:3f0L08+hiH2yPjXtWEa2

Score

10^/10

qakbot tr 1634541613 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Bnzvyao = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Mfesyes = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3004 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2180 schtasks.exe

pid	process
3004	regsvr32.exe

pid	process
2180	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wxbuweujbyu\7ca7ecfd = 545ac8de64846770521170c34c87e6bb56fbfc895b2079485338aab593353752b1df6de9b2d4330acc8aaac1c87a8e6b0737a3a4c6380d98	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wxbuweujbyu	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wxbuweujbyu\f1845bd6 = d017306ef6640701e5773e46e72a0349c60bfd661d04c91d4655691413b4defcdd446640ac819064b07e463084e5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wxbuweujbyu\3ee830b = b73723bcdbc3bbb7a838cab2c767d6219b455af2a474928f2342e6b731ec03b090b5b3e44d6bbc3510f146d171feb67b6978e5e479ad0b3bb43e51b52d46c191160f675f083efbcef2daec810fd99617b8bd7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wxbuweujbyu\bb52e46e = d1372206d5de77979367cd360f98daef18572f0db2a312a025f8bed395bf2e5435f241baf3e0fed7b5016657777159f0afb748f4c175e285903d7d6577460ae5143ec0d2cd9bf007816e0b15dca6a84f97256ba73d7bb7c31e4a22aaf998cce10539cfa064791e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wxbuweujbyu\f1845bd6 = d017276ef664321f041c0b53daba320b65b13d12422561ddc00465aaf9f498bae88c41f9d710956db53a04b61b64817144b62678dea7782462dcce645aea20da399758	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wxbuweujbyu\c41b8b98 = bf5f50514a5ac7797fa21a653da6c122cd2de29016b7c32120a46a37a358c4d497fae4d67dfa68d0468411cfeecb509f008622a91ffc3b2392cef4693a1fcd60136847e1ce13826347eb158b22b73346243cb0906fa2b799947226dbc26d209178b573ab0dba62fcebddc5f250cc9f908a64404b284455f3ca5ac6f005a507ac0f4c57b43f12d4abb0b9c61d09cfa4de3da36d32ba076e92735ced46e7168b26c6f63a28f27700bc9b322cc5f93952	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wxbuweujbyu\c65aabe4 = e618dc073ca24a1b5887a3f8abd733ed5087b5948d00dac67c4f8218e390c7c0c0140d22dd7e0531bbed1f19ca58073d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wxbuweujbyu\7ee6cc81 = 8830ca938e8de4397b4a8f9dcc14a23699d578ad9667c7929d55698b52bf683ed25f86aa0a3d0ab07e7630f28e826954f487c2f716c5972970c2a99ee6e1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wxbuweujbyu\8ecd3420 = 42d0a65761d12e399b814c26670fd1a4956107d1da3c29f0c809d1f9836ac81cbe83e670366702ffc2eacf65faaf363897472116	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2324 rundll32.exe
3004 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2324 rundll32.exe
3004 regsvr32.exe

pid	process
2324	rundll32.exe
3004	regsvr32.exe

pid	process
2324	rundll32.exe
3004	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2912 wrote to memory of 2324	2912	rundll32.exe	rundll32.exe
PID 2912 wrote to memory of 2324	2912	rundll32.exe	rundll32.exe
PID 2912 wrote to memory of 2324	2912	rundll32.exe	rundll32.exe
PID 2912 wrote to memory of 2324	2912	rundll32.exe	rundll32.exe
PID 2912 wrote to memory of 2324	2912	rundll32.exe	rundll32.exe
PID 2912 wrote to memory of 2324	2912	rundll32.exe	rundll32.exe
PID 2912 wrote to memory of 2324	2912	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 1796	2324	rundll32.exe	explorer.exe
PID 2324 wrote to memory of 1796	2324	rundll32.exe	explorer.exe
PID 2324 wrote to memory of 1796	2324	rundll32.exe	explorer.exe
PID 2324 wrote to memory of 1796	2324	rundll32.exe	explorer.exe
PID 2324 wrote to memory of 1796	2324	rundll32.exe	explorer.exe
PID 2324 wrote to memory of 1796	2324	rundll32.exe	explorer.exe
PID 1796 wrote to memory of 2180	1796	explorer.exe	schtasks.exe
PID 1796 wrote to memory of 2180	1796	explorer.exe	schtasks.exe
PID 1796 wrote to memory of 2180	1796	explorer.exe	schtasks.exe
PID 1796 wrote to memory of 2180	1796	explorer.exe	schtasks.exe
PID 2872 wrote to memory of 804	2872	taskeng.exe	regsvr32.exe
PID 2872 wrote to memory of 804	2872	taskeng.exe	regsvr32.exe
PID 2872 wrote to memory of 804	2872	taskeng.exe	regsvr32.exe
PID 2872 wrote to memory of 804	2872	taskeng.exe	regsvr32.exe
PID 2872 wrote to memory of 804	2872	taskeng.exe	regsvr32.exe
PID 804 wrote to memory of 3004	804	regsvr32.exe	regsvr32.exe
PID 804 wrote to memory of 3004	804	regsvr32.exe	regsvr32.exe
PID 804 wrote to memory of 3004	804	regsvr32.exe	regsvr32.exe
PID 804 wrote to memory of 3004	804	regsvr32.exe	regsvr32.exe
PID 804 wrote to memory of 3004	804	regsvr32.exe	regsvr32.exe
PID 804 wrote to memory of 3004	804	regsvr32.exe	regsvr32.exe
PID 804 wrote to memory of 3004	804	regsvr32.exe	regsvr32.exe
PID 3004 wrote to memory of 808	3004	regsvr32.exe	explorer.exe
PID 3004 wrote to memory of 808	3004	regsvr32.exe	explorer.exe
PID 3004 wrote to memory of 808	3004	regsvr32.exe	explorer.exe
PID 3004 wrote to memory of 808	3004	regsvr32.exe	explorer.exe
PID 3004 wrote to memory of 808	3004	regsvr32.exe	explorer.exe
PID 3004 wrote to memory of 808	3004	regsvr32.exe	explorer.exe
PID 808 wrote to memory of 852	808	explorer.exe	reg.exe
PID 808 wrote to memory of 852	808	explorer.exe	reg.exe
PID 808 wrote to memory of 852	808	explorer.exe	reg.exe
PID 808 wrote to memory of 852	808	explorer.exe	reg.exe
PID 808 wrote to memory of 1980	808	explorer.exe	reg.exe
PID 808 wrote to memory of 1980	808	explorer.exe	reg.exe
PID 808 wrote to memory of 1980	808	explorer.exe	reg.exe
PID 808 wrote to memory of 1980	808	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f96cdd054b91e7baf9d05427c334f69_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f96cdd054b91e7baf9d05427c334f69_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2324

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn unrwyxkfk /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\6f96cdd054b91e7baf9d05427c334f69_JaffaCakes118.dll\"" /SC ONCE /Z /ST 10:32 /ET 10:44
4⤵
- Creates scheduled task(s)
PID:2180

C:\Windows\system32\taskeng.exe
taskeng.exe {63B9771D-6044-4D4A-8293-9AD2050B0F4C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\6f96cdd054b91e7baf9d05427c334f69_JaffaCakes118.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:804

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\6f96cdd054b91e7baf9d05427c334f69_JaffaCakes118.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3004

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Bnzvyao" /d "0"
5⤵
- Windows security bypass
PID:852

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Mfesyes" /d "0"
5⤵
- Windows security bypass
PID:1980

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6f96cdd054b91e7baf9d05427c334f69_JaffaCakes118.dll
Filesize
1.5MB

MD5
6f96cdd054b91e7baf9d05427c334f69

SHA1
cec98fb02ea073ff78931bf5e9bc46a6e5c44fee

SHA256
d6b1d2ca4ea331f84bfeab5b0590c418a5f337e84a06344789530afeca1392c8

SHA512
15b56798ad37df3bf50655236768f7c28f08a491e0ed1b53ffa7e859f4e363ffa532dfbf8506819ef1b852291b1aad4785fc15a9dd46e7bced6f1274d06acc36

Download Submit
memory/808-34-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/808-32-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/808-31-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/808-30-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/808-28-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1796-16-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1796-6-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/1796-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1796-14-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1796-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1796-8-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2324-0-0x0000000074EE0000-0x0000000075073000-memory.dmp

Filesize
1.6MB

Download
memory/2324-9-0x0000000074EE0000-0x0000000075073000-memory.dmp

Filesize
1.6MB

Download
memory/2324-5-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/2324-1-0x0000000074EE0000-0x0000000075073000-memory.dmp

Filesize
1.6MB

Download
memory/2324-2-0x0000000074EE0000-0x0000000075073000-memory.dmp

Filesize
1.6MB

Download
memory/3004-22-0x0000000074490000-0x0000000074623000-memory.dmp

Filesize
1.6MB

Download
memory/3004-27-0x0000000074490000-0x0000000074623000-memory.dmp

Filesize
1.6MB

Download
memory/3004-21-0x0000000074490000-0x0000000074623000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads