qakbot | 9ed8eed3972af2b36d24b8ef141e70bd06683aab7bdf269e5def578ddb252a22

General

Target

7a8526de6fc42c853ff5d39df16995b2_JaffaCakes118.dll
Size

500KB
MD5

7a8526de6fc42c853ff5d39df16995b2
SHA1

685d67e41810b70de350cf4c8bc913b656607fc5
SHA256

9ed8eed3972af2b36d24b8ef141e70bd06683aab7bdf269e5def578ddb252a22
SHA512

11ab2041d1196b2a058553726445a1f8e5af0e8c033d55cbfa9522eb1d83fbf87c292de7b6d0e5843864db2b98828bcf6d93db7d8bb5650c63b54a3da47bde27
SSDEEP

6144:V2N8aCbpt5e3JVAfqX+2Rr+nxQDBO03fHEe:w87z5mvAfLfaE

Score

10^/10

qakbot obama115 1634197867 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama115

Campaign

1634197867

C2

91.178.126.51:995

220.255.25.28:2222

208.78.220.143:443

77.31.162.93:443

73.230.205.91:443

216.201.162.158:443

94.200.181.154:443

24.231.209.2:2222

89.137.52.44:443

140.82.49.12:443

65.100.174.110:32103

41.86.42.158:995

27.223.92.142:995

200.232.214.222:995

81.250.153.227:2222

217.17.56.163:465

122.60.71.201:995

120.150.218.241:995

41.228.22.180:443

69.30.186.190:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Whnogoa = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Ibhuuqvx = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1968 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2588 schtasks.exe

pid	process
1968	regsvr32.exe

pid	process
2588	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Agingnepcetux\7f7f0d95 = dd9455501fd4c4bfeba00ff3e68c5243a40668bdbe27036fa9474902ba2b183ea5b9481d31a429e381a70b07dc243d11f0858e9fdcaeae6948352f56078e8f48eaa0b3c77396273270e7d7c4a1d83e10eeb6d70a0849ce1e50ba2a85e8e0ae2285172d600684b4bad01ec5c4e284a921c7c1ea77218b64da2ba799681a8db25feb8d4c9aca696fa9b8cdebf8ace536ce23347578e5bf0c593600bfcb99887d7d35dba85a6e95e9a212c0f8ec7aab87d282dd91c9af0b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Agingnepcetux\c5824a8c = ef07002434059008db585c34e543a96fe27d01acc9df239577a4c82fcd4c69347dadd8128c55f24534f44d0a09dcd6d77ad03d976b8ab455	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Agingnepcetux\b88a0506 = dec330c06ead0ec10fd3d673a5ad1c20841a18358122fd8392f476e4740e92098605f0bc204df26c8a71e375b9f19372d6f95a3d80ddf86eeb2d56570b7cccb91a91f59110a732a3bc4927269b51fb8e66fe7cd4cf7a06131ec3ac12b0d750454431	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Agingnepcetux\4ae0dddb = 42472e69a4ebe719329ada09717d70860d1323ae495e6b6e144c0d20b458716e3bbdae96500f73dca6101831f290273fb2a14e349712a9e384f586547d6347e84616ce2a4e6b627793c1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Agingnepcetux\7d3e2de9 = 298afbe2f83fd14923b6dac324baff5b2f2390f6451236cf64c9a833e77577598c22ac926c189e74675e1ce478475ada29e9532d1228a916e069165e6412f6796a27e1f51c27d2096b0b8736	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Agingnepcetux\366263 = 6e8b73c2209eeb863ff424b4e8e658b5c7f0c0256d40018e4d1c738048fe57a83cf46b5a3ebb190686e00f3a2ecfaa026c801d58e971cf36d8805d057f0c8c18cf69aaaecec5ec2be5a1cfefe260	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Agingnepcetux\c7c36af0 = 4d89f5eebeafd48d17882f603e7b3fb90f5d17f319f30003fa418eb5420a12fbfe2251191f80902692c65c63c68c9bb6227466431e5235e5a97fe4d253f004342b0f6b76bc50c240ee7d71363b101f132d5c39ad44b877b4c21b274eff9f7bc0677c1c341f4687e243bfffc7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Agingnepcetux\35a9b22d = ed07300ff8d4c101071d39fac036d9112c468e3dbafe60befbc791fec1f0a46916c947ac0ada0cde57d61a480e229cf1c5a65846a0dbc14426284c08076c4ba4c050fcf28e1e499196bb3cc53d7a7c5887597ae6a20b7c580c3f26b9087738	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Agingnepcetux\4ae0dddb = 42473969a4ebd2605a265ad9693fa372552acf426e4b5bc3edf45fe1b16afeff74dc8b290fda483f29fb970ed857ba07f836dd29ceb0f51e811b8cfc61deb396d98d26a643ea34e0dee46cb498ccd40da5d38e794318db0d8f602e3b809b1c	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Agingnepcetux	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

868 rundll32.exe
1968 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

868 rundll32.exe
1968 regsvr32.exe

pid	process
868	rundll32.exe
1968	regsvr32.exe

pid	process
868	rundll32.exe
1968	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3000 wrote to memory of 868	3000	rundll32.exe	rundll32.exe
PID 3000 wrote to memory of 868	3000	rundll32.exe	rundll32.exe
PID 3000 wrote to memory of 868	3000	rundll32.exe	rundll32.exe
PID 3000 wrote to memory of 868	3000	rundll32.exe	rundll32.exe
PID 3000 wrote to memory of 868	3000	rundll32.exe	rundll32.exe
PID 3000 wrote to memory of 868	3000	rundll32.exe	rundll32.exe
PID 3000 wrote to memory of 868	3000	rundll32.exe	rundll32.exe
PID 868 wrote to memory of 2956	868	rundll32.exe	explorer.exe
PID 868 wrote to memory of 2956	868	rundll32.exe	explorer.exe
PID 868 wrote to memory of 2956	868	rundll32.exe	explorer.exe
PID 868 wrote to memory of 2956	868	rundll32.exe	explorer.exe
PID 868 wrote to memory of 2956	868	rundll32.exe	explorer.exe
PID 868 wrote to memory of 2956	868	rundll32.exe	explorer.exe
PID 2956 wrote to memory of 2588	2956	explorer.exe	schtasks.exe
PID 2956 wrote to memory of 2588	2956	explorer.exe	schtasks.exe
PID 2956 wrote to memory of 2588	2956	explorer.exe	schtasks.exe
PID 2956 wrote to memory of 2588	2956	explorer.exe	schtasks.exe
PID 2716 wrote to memory of 1236	2716	taskeng.exe	regsvr32.exe
PID 2716 wrote to memory of 1236	2716	taskeng.exe	regsvr32.exe
PID 2716 wrote to memory of 1236	2716	taskeng.exe	regsvr32.exe
PID 2716 wrote to memory of 1236	2716	taskeng.exe	regsvr32.exe
PID 2716 wrote to memory of 1236	2716	taskeng.exe	regsvr32.exe
PID 1236 wrote to memory of 1968	1236	regsvr32.exe	regsvr32.exe
PID 1236 wrote to memory of 1968	1236	regsvr32.exe	regsvr32.exe
PID 1236 wrote to memory of 1968	1236	regsvr32.exe	regsvr32.exe
PID 1236 wrote to memory of 1968	1236	regsvr32.exe	regsvr32.exe
PID 1236 wrote to memory of 1968	1236	regsvr32.exe	regsvr32.exe
PID 1236 wrote to memory of 1968	1236	regsvr32.exe	regsvr32.exe
PID 1236 wrote to memory of 1968	1236	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 1496	1968	regsvr32.exe	explorer.exe
PID 1968 wrote to memory of 1496	1968	regsvr32.exe	explorer.exe
PID 1968 wrote to memory of 1496	1968	regsvr32.exe	explorer.exe
PID 1968 wrote to memory of 1496	1968	regsvr32.exe	explorer.exe
PID 1968 wrote to memory of 1496	1968	regsvr32.exe	explorer.exe
PID 1968 wrote to memory of 1496	1968	regsvr32.exe	explorer.exe
PID 1496 wrote to memory of 2188	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 2188	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 2188	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 2188	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 2000	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 2000	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 2000	1496	explorer.exe	reg.exe
PID 1496 wrote to memory of 2000	1496	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a8526de6fc42c853ff5d39df16995b2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a8526de6fc42c853ff5d39df16995b2_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2956

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fxuysdn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\7a8526de6fc42c853ff5d39df16995b2_JaffaCakes118.dll\"" /SC ONCE /Z /ST 21:10 /ET 21:22
4⤵
- Creates scheduled task(s)
PID:2588

C:\Windows\system32\taskeng.exe
taskeng.exe {C51AF912-5BB5-4FD0-AB57-F9FC3ADB748B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2716

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\7a8526de6fc42c853ff5d39df16995b2_JaffaCakes118.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\7a8526de6fc42c853ff5d39df16995b2_JaffaCakes118.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Whnogoa" /d "0"
5⤵
- Windows security bypass
PID:2188

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ibhuuqvx" /d "0"
5⤵
- Windows security bypass
PID:2000

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7a8526de6fc42c853ff5d39df16995b2_JaffaCakes118.dll
Filesize
500KB

MD5
7a8526de6fc42c853ff5d39df16995b2

SHA1
685d67e41810b70de350cf4c8bc913b656607fc5

SHA256
9ed8eed3972af2b36d24b8ef141e70bd06683aab7bdf269e5def578ddb252a22

SHA512
11ab2041d1196b2a058553726445a1f8e5af0e8c033d55cbfa9522eb1d83fbf87c292de7b6d0e5843864db2b98828bcf6d93db7d8bb5650c63b54a3da47bde27

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/868-1-0x0000000010000000-0x000000001007F000-memory.dmp

Filesize
508KB

Download
memory/868-4-0x0000000010000000-0x000000001007F000-memory.dmp

Filesize
508KB

Download
memory/868-6-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/868-0-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/1496-29-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1496-27-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1496-26-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1496-25-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1496-22-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1968-23-0x0000000010000000-0x000000001007F000-memory.dmp

Filesize
508KB

Download
memory/1968-18-0x00000000001D0000-0x0000000000203000-memory.dmp

Filesize
204KB

Download
memory/1968-20-0x0000000010000000-0x000000001007F000-memory.dmp

Filesize
508KB

Download
memory/2956-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2956-10-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2956-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2956-9-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2956-5-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2956-2-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads