qakbot | 4d64a8a26d49dacaa200c81427d46cb8e55e99360355e122404285f14b5693c9

General

Target

71dff5ac0f51c28698b5f5081082f983_JaffaCakes118.dll
Size

500KB
MD5

71dff5ac0f51c28698b5f5081082f983
SHA1

ca7752474fe66dcf2e0b17c83e9862f09462d450
SHA256

4d64a8a26d49dacaa200c81427d46cb8e55e99360355e122404285f14b5693c9
SHA512

77fa82379e562d79f195f3853213062a5086c979c1c8524ef8489791e5d31d720157fb4f4c2cf819b7463aa8c01f4b0dda0db86847185c1d56cf80d151aecc1b
SSDEEP

6144:V2N8aCbpt5e3JVAfqX+2Rr+nxQDBO03fHEe:w87z5mvAfLfaE

Score

10^/10

qakbot obama115 1634197867 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama115

Campaign

1634197867

C2

91.178.126.51:995

220.255.25.28:2222

208.78.220.143:443

77.31.162.93:443

73.230.205.91:443

216.201.162.158:443

94.200.181.154:443

24.231.209.2:2222

89.137.52.44:443

140.82.49.12:443

65.100.174.110:32103

41.86.42.158:995

27.223.92.142:995

200.232.214.222:995

81.250.153.227:2222

217.17.56.163:465

122.60.71.201:995

120.150.218.241:995

41.228.22.180:443

69.30.186.190:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Wmnggcb = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Aonjsp = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1376 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2564 schtasks.exe

pid	process
1376	regsvr32.exe

pid	process
2564	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lecazozh\389b5af9 = 07873edbe83926a5f0064f1dc78eebc50e8b426b1b806071dac001c9533b4b8e4373e34a7aa02284cb8b086d400b1684c87d1ecdd2a9085f9bf1e5f27fc2ee522c1de9ba782fd2fc2a4d683f5cbafdeae1bd85	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lecazozh\724de541 = 8e5c881d19873876ba8b7ac0f0e2bf088b8be723d552e7d274f76afd08057e8de6e5b9aac7eebcacb5a2364a790fa31707ab746828acbd5ad0f8a75c8e48fd	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lecazozh	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lecazozh\724de541 = 8e5c9f1d19870d9e187c04733ad4bcf8cb6f31175af1d8908099f55f6ce9200f28892b5f75590bae6abd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lecazozh\47d2350f = a4901c33cb6f155f4dade80ae8a392042354fd347171414733c076905d219920ba35b3f014e99b613fb14c97ccaf12f61d25b599b39d02647c70c5c31c73626fa88ab903f5a38e6e832b710b13587c8f0728c20960350ef7b20990ff220f5b60b5d097d4973c29da56de1bbe9e0581122ea91b2161ce1c9e1004c194ed5763dbc70dc30f12848bfb962fafea6d731152b21e401774d9649d241ae047ad095b8449dc5503bcc0ff3f1174faa0dad2c16be3c338a4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lecazozh\45931573 = 3c1411c72e72ff42910d2c36bde89279ade0d0ea62b3754df2d9edd427ad064b1fa95cd0114fed68c51f991facffe54c267fabd5a807cd6a0e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lecazozh\fd2f7216 = 7ef63140ae6a51e67487bef932bb0d6d52e9d7c6059f68392720d5560a47f9edb38d85349e50a9846a424022d8d916bcac69bcb0b7de4bf8d4126d18ced63417debd60ccc60c3cca9f9e23dca834c62ab321985481bb0607dc1799507d4f656c26210b5aee17dfe7c8f6fd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lecazozh\80273d9c = eac6bd2a60851556eaeb946e2be6f4c963f09d0c548139dfac6464222bdcf18aff38bcfa760826366f83909dad082647e7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lecazozh\ff6e526a = 9a73e756a7dd8f5c89f9513ef1092f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lecazozh\d048ab7 = 93f85b760baf0c0b38f42b21eb08c0ba887f0cae61877e055c685705682073f4eb27ca1444ac85a0854594c874b358128bd0af93c41fee858ca021e9590fc8910e5749ccde1e2c313f7df3635629ff9101683ce9b272647fd514e45cedd1c8da	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2848 rundll32.exe
1376 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2848 rundll32.exe
1376 regsvr32.exe

pid	process
2848	rundll32.exe
1376	regsvr32.exe

pid	process
2848	rundll32.exe
1376	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1524 wrote to memory of 2848	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2848	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2848	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2848	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2848	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2848	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2848	1524	rundll32.exe	rundll32.exe
PID 2848 wrote to memory of 2996	2848	rundll32.exe	explorer.exe
PID 2848 wrote to memory of 2996	2848	rundll32.exe	explorer.exe
PID 2848 wrote to memory of 2996	2848	rundll32.exe	explorer.exe
PID 2848 wrote to memory of 2996	2848	rundll32.exe	explorer.exe
PID 2848 wrote to memory of 2996	2848	rundll32.exe	explorer.exe
PID 2848 wrote to memory of 2996	2848	rundll32.exe	explorer.exe
PID 2996 wrote to memory of 2564	2996	explorer.exe	schtasks.exe
PID 2996 wrote to memory of 2564	2996	explorer.exe	schtasks.exe
PID 2996 wrote to memory of 2564	2996	explorer.exe	schtasks.exe
PID 2996 wrote to memory of 2564	2996	explorer.exe	schtasks.exe
PID 1412 wrote to memory of 1628	1412	taskeng.exe	regsvr32.exe
PID 1412 wrote to memory of 1628	1412	taskeng.exe	regsvr32.exe
PID 1412 wrote to memory of 1628	1412	taskeng.exe	regsvr32.exe
PID 1412 wrote to memory of 1628	1412	taskeng.exe	regsvr32.exe
PID 1412 wrote to memory of 1628	1412	taskeng.exe	regsvr32.exe
PID 1628 wrote to memory of 1376	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1376	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1376	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1376	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1376	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1376	1628	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 1376	1628	regsvr32.exe	regsvr32.exe
PID 1376 wrote to memory of 1404	1376	regsvr32.exe	explorer.exe
PID 1376 wrote to memory of 1404	1376	regsvr32.exe	explorer.exe
PID 1376 wrote to memory of 1404	1376	regsvr32.exe	explorer.exe
PID 1376 wrote to memory of 1404	1376	regsvr32.exe	explorer.exe
PID 1376 wrote to memory of 1404	1376	regsvr32.exe	explorer.exe
PID 1376 wrote to memory of 1404	1376	regsvr32.exe	explorer.exe
PID 1404 wrote to memory of 1968	1404	explorer.exe	reg.exe
PID 1404 wrote to memory of 1968	1404	explorer.exe	reg.exe
PID 1404 wrote to memory of 1968	1404	explorer.exe	reg.exe
PID 1404 wrote to memory of 1968	1404	explorer.exe	reg.exe
PID 1404 wrote to memory of 1868	1404	explorer.exe	reg.exe
PID 1404 wrote to memory of 1868	1404	explorer.exe	reg.exe
PID 1404 wrote to memory of 1868	1404	explorer.exe	reg.exe
PID 1404 wrote to memory of 1868	1404	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\71dff5ac0f51c28698b5f5081082f983_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\71dff5ac0f51c28698b5f5081082f983_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2848

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fjzjaeps /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\71dff5ac0f51c28698b5f5081082f983_JaffaCakes118.dll\"" /SC ONCE /Z /ST 12:24 /ET 12:36
4⤵
- Creates scheduled task(s)
PID:2564

C:\Windows\system32\taskeng.exe
taskeng.exe {703D78E9-00BE-4755-B056-61662D16A5DA} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1412

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\71dff5ac0f51c28698b5f5081082f983_JaffaCakes118.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\71dff5ac0f51c28698b5f5081082f983_JaffaCakes118.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Wmnggcb" /d "0"
5⤵
- Windows security bypass
PID:1968

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Aonjsp" /d "0"
5⤵
- Windows security bypass
PID:1868

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\71dff5ac0f51c28698b5f5081082f983_JaffaCakes118.dll
Filesize
500KB

MD5
71dff5ac0f51c28698b5f5081082f983

SHA1
ca7752474fe66dcf2e0b17c83e9862f09462d450

SHA256
4d64a8a26d49dacaa200c81427d46cb8e55e99360355e122404285f14b5693c9

SHA512
77fa82379e562d79f195f3853213062a5086c979c1c8524ef8489791e5d31d720157fb4f4c2cf819b7463aa8c01f4b0dda0db86847185c1d56cf80d151aecc1b

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1376-16-0x0000000000870000-0x00000000008A3000-memory.dmp

Filesize
204KB

Download
memory/1376-22-0x0000000010000000-0x000000001007F000-memory.dmp

Filesize
508KB

Download
memory/1376-17-0x0000000010000000-0x000000001007F000-memory.dmp

Filesize
508KB

Download
memory/1404-28-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1404-25-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1404-26-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1404-24-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1404-21-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2848-4-0x0000000010000000-0x000000001007F000-memory.dmp

Filesize
508KB

Download
memory/2848-0-0x00000000000F0000-0x0000000000123000-memory.dmp

Filesize
204KB

Download
memory/2848-1-0x0000000010000000-0x000000001007F000-memory.dmp

Filesize
508KB

Download
memory/2996-11-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2996-9-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2996-8-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2996-7-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2996-3-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2996-2-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads