qakbot | 5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88

General

Target

932cf14b4f91d84439db9c977beee326_JaffaCakes118.dll
Size

689KB
MD5

932cf14b4f91d84439db9c977beee326
SHA1

e9eb1f908042d89d754e843b24b3f7b423fbff37
SHA256

5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88
SHA512

dc6428aa9f16f16d9880d75036a848331522bad5d91b5166ee4157240a05503ad515b4b303956ee80e6335b97c06a72d123b1777b4d5fc366a2ff1963aa97f95
SSDEEP

12288:BrI0bPKn8p/S0jXgfFWVkMXl2xAgwFX2ddG83tNzZ0XssC82H6/vLyWMA:pI0bP1XWMXsAZX6JcTLdM

Score

10^/10

qakbot obama117 1634545803 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama117

Campaign

1634545803

C2

176.45.53.222:443

220.255.25.28:2222

91.178.126.51:995

2.222.167.138:443

65.100.174.110:995

105.198.236.99:995

115.96.64.9:995

196.207.140.40:995

24.231.209.2:2222

146.66.238.74:443

103.82.211.39:995

65.100.174.110:443

103.142.10.177:443

140.82.49.12:443

78.105.213.151:995

41.86.42.158:995

89.101.97.139:443

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Zbqkshdt = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Nmycliiilkc = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2248 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2572 schtasks.exe

pid	process
2248	regsvr32.exe

pid	process
2572	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aavcxaodlifrn\4aa4df48 = 286ee4dac4b0f4f7c42af1c330f7dd4828b7148e2663fc1349cea045b130e88cdda474e75b6c04457a2e85f7ce3de50ccf75ac819b12d8c1ed7755d7851b4aa398c3feb18710d36f5fa5bcf7cda55b1848576695a5b39b38d9481796cd29b132031c51128bb3aaa234cd1ddda628	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aavcxaodlifrn\c7876863 = fa9764bcd78e5f39604c3b4bd491547e066fc122509dcd7e25f682df26403491b8959599d196f446235340a10950c94b6353b73faa571619921e4a	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aavcxaodlifrn	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aavcxaodlifrn\c7876863 = fa9773bcd78e6ae170ca8b8333c5220e106690bc552050cb0461da392b6663f332e205e2d06f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aavcxaodlifrn\f218b82d = af64aa6c169f41667152b597c812533560b9e4f9aa10126605237530adfa945c05d02b353a2a94236ea76ccd74f11f338208be8040d1bceea9559bcd3b6610376f939f11c3ad2e7f80df71dad63afb40c6294c65024072b7653416c32f3e64e1406b5b09f414132f53d656a2403cd8abf895199a580c9f84e33d11e2e4c310605c49bfa711eb7da1ae7f009b6a6de2fc20821bda9191a5f15b4642418ef61cc08be4dcba4c2e9dd2b6107a9ee0447d67723bb035c4ee52f6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aavcxaodlifrn\8d51d7db = 833678503fd6e42300f1c7fbdf0c9380ded5a65d7e66a5b8483c7febfa48e462aa1c2a47c068498881e114e3ecd89dd29a45b59504a20e74feadf1bdc713d795bf784677ae	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aavcxaodlifrn\b8ce0795 = c04abab1ec0d5d611b2c9b58d42c3ba73257f4a648de43fdd8855f297e47c9533c47779a9c85d6d3b94962c27ccc18f9d9db264ea956099ad926fd3a5c1570b00189ebc323f8967312b3c156fc0ca4c21605be3877d7d110db76c1021f7a3ae72360232406725896e9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aavcxaodlifrn\f0599851 = bff111b7928cef76b9d18af43bcbf14cd52bb25662c9dc435872b5f6b0c4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aavcxaodlifrn\48e5ff34 = 6d347f9a89fd853cd8d7f5c278f40a7f718fa91a0212f1afebaf11386b6513ec7223157b943c5b056f70ead6f3f58c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aavcxaodlifrn\35edb0be = 7933da1c2ebe0b821aedc28ee3be8effa9a1544533307be3f553226f44167d0e31798171a487542a3e80f6269936eb892974cacb5e2688f7c9f3df3012ea126591afedcc2f9b259bb8d5ec817d	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2152 rundll32.exe
2248 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2152 rundll32.exe
2248 regsvr32.exe

pid	process
2152	rundll32.exe
2248	regsvr32.exe

pid	process
2152	rundll32.exe
2248	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1624 wrote to memory of 2152	1624	rundll32.exe	rundll32.exe
PID 1624 wrote to memory of 2152	1624	rundll32.exe	rundll32.exe
PID 1624 wrote to memory of 2152	1624	rundll32.exe	rundll32.exe
PID 1624 wrote to memory of 2152	1624	rundll32.exe	rundll32.exe
PID 1624 wrote to memory of 2152	1624	rundll32.exe	rundll32.exe
PID 1624 wrote to memory of 2152	1624	rundll32.exe	rundll32.exe
PID 1624 wrote to memory of 2152	1624	rundll32.exe	rundll32.exe
PID 2152 wrote to memory of 3032	2152	rundll32.exe	explorer.exe
PID 2152 wrote to memory of 3032	2152	rundll32.exe	explorer.exe
PID 2152 wrote to memory of 3032	2152	rundll32.exe	explorer.exe
PID 2152 wrote to memory of 3032	2152	rundll32.exe	explorer.exe
PID 2152 wrote to memory of 3032	2152	rundll32.exe	explorer.exe
PID 2152 wrote to memory of 3032	2152	rundll32.exe	explorer.exe
PID 3032 wrote to memory of 2572	3032	explorer.exe	schtasks.exe
PID 3032 wrote to memory of 2572	3032	explorer.exe	schtasks.exe
PID 3032 wrote to memory of 2572	3032	explorer.exe	schtasks.exe
PID 3032 wrote to memory of 2572	3032	explorer.exe	schtasks.exe
PID 1848 wrote to memory of 2240	1848	taskeng.exe	regsvr32.exe
PID 1848 wrote to memory of 2240	1848	taskeng.exe	regsvr32.exe
PID 1848 wrote to memory of 2240	1848	taskeng.exe	regsvr32.exe
PID 1848 wrote to memory of 2240	1848	taskeng.exe	regsvr32.exe
PID 1848 wrote to memory of 2240	1848	taskeng.exe	regsvr32.exe
PID 2240 wrote to memory of 2248	2240	regsvr32.exe	regsvr32.exe
PID 2240 wrote to memory of 2248	2240	regsvr32.exe	regsvr32.exe
PID 2240 wrote to memory of 2248	2240	regsvr32.exe	regsvr32.exe
PID 2240 wrote to memory of 2248	2240	regsvr32.exe	regsvr32.exe
PID 2240 wrote to memory of 2248	2240	regsvr32.exe	regsvr32.exe
PID 2240 wrote to memory of 2248	2240	regsvr32.exe	regsvr32.exe
PID 2240 wrote to memory of 2248	2240	regsvr32.exe	regsvr32.exe
PID 2248 wrote to memory of 808	2248	regsvr32.exe	explorer.exe
PID 2248 wrote to memory of 808	2248	regsvr32.exe	explorer.exe
PID 2248 wrote to memory of 808	2248	regsvr32.exe	explorer.exe
PID 2248 wrote to memory of 808	2248	regsvr32.exe	explorer.exe
PID 2248 wrote to memory of 808	2248	regsvr32.exe	explorer.exe
PID 2248 wrote to memory of 808	2248	regsvr32.exe	explorer.exe
PID 808 wrote to memory of 832	808	explorer.exe	reg.exe
PID 808 wrote to memory of 832	808	explorer.exe	reg.exe
PID 808 wrote to memory of 832	808	explorer.exe	reg.exe
PID 808 wrote to memory of 832	808	explorer.exe	reg.exe
PID 808 wrote to memory of 1048	808	explorer.exe	reg.exe
PID 808 wrote to memory of 1048	808	explorer.exe	reg.exe
PID 808 wrote to memory of 1048	808	explorer.exe	reg.exe
PID 808 wrote to memory of 1048	808	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\932cf14b4f91d84439db9c977beee326_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\932cf14b4f91d84439db9c977beee326_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2152

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ioscjkjogl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\932cf14b4f91d84439db9c977beee326_JaffaCakes118.dll\"" /SC ONCE /Z /ST 17:56 /ET 18:08
4⤵
- Creates scheduled task(s)
PID:2572

C:\Windows\system32\taskeng.exe
taskeng.exe {B02DFD5D-4216-4D98-A6BB-811B4575468B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\932cf14b4f91d84439db9c977beee326_JaffaCakes118.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\932cf14b4f91d84439db9c977beee326_JaffaCakes118.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2248

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Zbqkshdt" /d "0"
5⤵
- Windows security bypass
PID:832

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Nmycliiilkc" /d "0"
5⤵
- Windows security bypass
PID:1048

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\932cf14b4f91d84439db9c977beee326_JaffaCakes118.dll
Filesize
689KB

MD5
932cf14b4f91d84439db9c977beee326

SHA1
e9eb1f908042d89d754e843b24b3f7b423fbff37

SHA256
5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88

SHA512
dc6428aa9f16f16d9880d75036a848331522bad5d91b5166ee4157240a05503ad515b4b303956ee80e6335b97c06a72d123b1777b4d5fc366a2ff1963aa97f95

Download Submit
memory/808-31-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/808-29-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/808-26-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/808-33-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/808-30-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2152-1-0x0000000074E10000-0x0000000074ECD000-memory.dmp

Filesize
756KB

Download
memory/2152-6-0x0000000074E10000-0x0000000074ECD000-memory.dmp

Filesize
756KB

Download
memory/2152-0-0x0000000074E10000-0x0000000074ECD000-memory.dmp

Filesize
756KB

Download
memory/2152-4-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2152-2-0x0000000074E10000-0x0000000074ECD000-memory.dmp

Filesize
756KB

Download
memory/2248-27-0x00000000743C0000-0x000000007447D000-memory.dmp

Filesize
756KB

Download
memory/2248-20-0x00000000743C0000-0x000000007447D000-memory.dmp

Filesize
756KB

Download
memory/2248-21-0x00000000743C0000-0x000000007447D000-memory.dmp

Filesize
756KB

Download
memory/3032-7-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3032-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3032-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3032-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3032-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3032-5-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads