qakbot | 1f2173e7d1a8d7127d0e99a4364b443c3c40060fe034e7d7a053d2176fe07372

General

Target

816a0387056d5d1277904378b78e7ee0_JaffaCakes118.dll
Size

572KB
MD5

816a0387056d5d1277904378b78e7ee0
SHA1

70f47403a91cf57617859f4564d2785af49ce696
SHA256

1f2173e7d1a8d7127d0e99a4364b443c3c40060fe034e7d7a053d2176fe07372
SHA512

4506e34f1b03bccaf01ae945487c1961fe2a3aae0eb93155a93cf94319abcef1381a3c4416bd46482c811c8eab7a1fbde4963211617a7001c910e7efeb228eae
SSDEEP

6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eHS:VvAfLfaEkAz5Z

Score

10^/10

qakbot obama114 1634112211 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

C2

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Voubodn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Xwpinqom = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
2444	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
776	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyqkepeaq\3c82d64d = 8a9bb7eea4a3fcc0d2f6ea163cac6159bb33c906734941979a0acb25155943c6c8f9e8ce85a08e3b7f85c1ffc3f068ad749c2089f7efa6916cedfd654ba83bd8050af287a6a3ea9f596548c2b6b1af4d2fbb7c90e4ad101778baddf31b1b8c073a36d5f2a63e5dd35375c2500966ffcd92b7bc62e8dc9e35c9ec03349a303d1a69f79a97f332eccae16f1b0cc6ddac258c90f9c541b34119be07b1c01f11e7e6c2186f38b51f63f35a982399a850f5537fe64c3857ba	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyqkepeaq\3ec3f631 = d5d625388ca74343a6eca738173519dc1553	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyqkepeaq\867f9154 = cc4a57fd3d09673106ae53eb4555ff0a3dbb879473388ac80c95003e5195a74e1918794b2c2f474e56a90654d3c81257b26c7a11eade483621702e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyqkepeaq\fb77dede = 3a4c717c3788cb3470ef4432ae2924305dd3bf306903527bde93bee6046d7d28af39fdf42d60205d73e9b669660dee16a79f0e2c639fba5e07f1961531d8f669714cee8ba28ef729c984f1d0a46220adb71242fd236e2a968cd690df466ecf847ba89135660d75932a881d599a02927d6b29	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyqkepeaq\43cbb9bb = 7abcf80993749c05aa689c1d7f903f723454036cee4bd1ae6938e5eb65785ceaba32b0c9ec1c76ed140b40019b92bf19d748c59ff4c87895d8bad3d855d30e4dd2afb28e56763aef73753a0eaf87c245301e5115c2fd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyqkepeaq\843eb128 = 5641cdb476b1a03326341e2369eeb34b6fabde90131596a215ea79e1fce848b94ebbbd67a39c5233b529d5abd40241cc06af0ab5f9b5615cc3d34e6c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyqkepeaq\91d0603 = e43e71f95d08d19b0c50f5822f58d9a317fcee8e3074827a89033592a181a83f60fa6cba2dd9057343668806c63e429adffbc3c77a824cdbc17403e4f07fa41c04a1eabec0f93a93b81c0182aa62cbc479b2f900e962442e6bce1f69177f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyqkepeaq	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyqkepeaq\91d0603 = e43e66f95d08e4f8adcc3e6616bfb50a0fe4d160b0c9a5d701e41f7b0db43ad513a567b7d8a0513245ad2f1c5db30095700e67ad3087b6ee0c38dc7157f6ce47744831011f6ab693df	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lyqkepeaq\765469f5 = fb682679296f0be68d66c8cb613f16e25d82fce253e85357aba69b1a2ee6794968d1788bf249d2676b38099b0a9ca0635499632cb80e469d5f51a16111e4705db1c095a23b08f74cc06ea8eb664348d28c331066361c9e644a40ffa2cde5b498cdbf2e8e01201787fec4e6096340	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3576	rundll32.exe
3576	rundll32.exe
2444	regsvr32.exe
2444	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3576	rundll32.exe
2444	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 3576	4928	rundll32.exe	84
PID 4928 wrote to memory of 3576	4928	rundll32.exe	84
PID 4928 wrote to memory of 3576	4928	rundll32.exe	84
PID 3576 wrote to memory of 680	3576	rundll32.exe	91
PID 3576 wrote to memory of 680	3576	rundll32.exe	91
PID 3576 wrote to memory of 680	3576	rundll32.exe	91
PID 3576 wrote to memory of 680	3576	rundll32.exe	91
PID 3576 wrote to memory of 680	3576	rundll32.exe	91
PID 680 wrote to memory of 776	680	explorer.exe	93
PID 680 wrote to memory of 776	680	explorer.exe	93
PID 680 wrote to memory of 776	680	explorer.exe	93
PID 4288 wrote to memory of 2444	4288	regsvr32.exe	100
PID 4288 wrote to memory of 2444	4288	regsvr32.exe	100
PID 4288 wrote to memory of 2444	4288	regsvr32.exe	100
PID 2444 wrote to memory of 1428	2444	regsvr32.exe	101
PID 2444 wrote to memory of 1428	2444	regsvr32.exe	101
PID 2444 wrote to memory of 1428	2444	regsvr32.exe	101
PID 2444 wrote to memory of 1428	2444	regsvr32.exe	101
PID 2444 wrote to memory of 1428	2444	regsvr32.exe	101
PID 1428 wrote to memory of 4768	1428	explorer.exe	102
PID 1428 wrote to memory of 4768	1428	explorer.exe	102
PID 1428 wrote to memory of 4584	1428	explorer.exe	104
PID 1428 wrote to memory of 4584	1428	explorer.exe	104

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\816a0387056d5d1277904378b78e7ee0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\816a0387056d5d1277904378b78e7ee0_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:680
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xrxaxur /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\816a0387056d5d1277904378b78e7ee0_JaffaCakes118.dll\"" /SC ONCE /Z /ST 02:45 /ET 02:57
      4⤵
      Creates scheduled task(s)
      PID:776

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\816a0387056d5d1277904378b78e7ee0_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\816a0387056d5d1277904378b78e7ee0_JaffaCakes118.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Voubodn" /d "0"
      4⤵
      Windows security bypass
      PID:4768
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Xwpinqom" /d "0"
      4⤵
      Windows security bypass
      PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\816a0387056d5d1277904378b78e7ee0_JaffaCakes118.dll

Filesize
572KB

MD5
816a0387056d5d1277904378b78e7ee0

SHA1
70f47403a91cf57617859f4564d2785af49ce696

SHA256
1f2173e7d1a8d7127d0e99a4364b443c3c40060fe034e7d7a053d2176fe07372

SHA512
4506e34f1b03bccaf01ae945487c1961fe2a3aae0eb93155a93cf94319abcef1381a3c4416bd46482c811c8eab7a1fbde4963211617a7001c910e7efeb228eae

Download Submit
memory/680-3-0x0000000000710000-0x0000000000731000-memory.dmp

Filesize
132KB

Download
memory/680-7-0x0000000000710000-0x0000000000731000-memory.dmp

Filesize
132KB

Download
memory/680-8-0x0000000000710000-0x0000000000731000-memory.dmp

Filesize
132KB

Download
memory/680-9-0x0000000000710000-0x0000000000731000-memory.dmp

Filesize
132KB

Download
memory/680-11-0x0000000000710000-0x0000000000731000-memory.dmp

Filesize
132KB

Download
memory/1428-26-0x0000000000790000-0x00000000007B1000-memory.dmp

Filesize
132KB

Download
memory/1428-24-0x0000000000790000-0x00000000007B1000-memory.dmp

Filesize
132KB

Download
memory/1428-23-0x0000000000790000-0x00000000007B1000-memory.dmp

Filesize
132KB

Download
memory/1428-22-0x0000000000790000-0x00000000007B1000-memory.dmp

Filesize
132KB

Download
memory/1428-18-0x0000000000790000-0x00000000007B1000-memory.dmp

Filesize
132KB

Download
memory/2444-15-0x0000000001CE0000-0x0000000001D15000-memory.dmp

Filesize
212KB

Download
memory/2444-16-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2444-19-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2444-20-0x0000000001CE0000-0x0000000001D15000-memory.dmp

Filesize
212KB

Download
memory/3576-0-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/3576-4-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/3576-2-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/3576-1-0x0000000002BE0000-0x0000000002C15000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads