qakbot | 5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88

General

Target

932cf14b4f91d84439db9c977beee326_JaffaCakes118.dll
Size

689KB
MD5

932cf14b4f91d84439db9c977beee326
SHA1

e9eb1f908042d89d754e843b24b3f7b423fbff37
SHA256

5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88
SHA512

dc6428aa9f16f16d9880d75036a848331522bad5d91b5166ee4157240a05503ad515b4b303956ee80e6335b97c06a72d123b1777b4d5fc366a2ff1963aa97f95
SSDEEP

12288:BrI0bPKn8p/S0jXgfFWVkMXl2xAgwFX2ddG83tNzZ0XssC82H6/vLyWMA:pI0bP1XWMXsAZX6JcTLdM

Score

10^/10

qakbot obama117 1634545803 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama117

Campaign

1634545803

C2

176.45.53.222:443

220.255.25.28:2222

91.178.126.51:995

2.222.167.138:443

65.100.174.110:995

105.198.236.99:995

115.96.64.9:995

196.207.140.40:995

24.231.209.2:2222

146.66.238.74:443

103.82.211.39:995

65.100.174.110:443

103.142.10.177:443

140.82.49.12:443

78.105.213.151:995

41.86.42.158:995

89.101.97.139:443

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Osymaifruv = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Oelbqebmipii = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4476 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

5072 schtasks.exe

pid	process
4476	regsvr32.exe

pid	process
5072	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hhwoaawvta\c30cd4f6 = b3e1f43aeab7014f320f7c1bc5f4925d07b0e7bc0413eabd8dc7e8097d50ce7d0df17d56f0255fca9c91f7bae082001ecc9f71771384	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hhwoaawvta	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hhwoaawvta\bc45bb00 = 9530e7cf2a86b997ab3547a8f5f4aa235ab07176bc8c80e15f32561869e05e05f6d6285c7314eda8fb4980b81bae90a75051d9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hhwoaawvta\89da6b4e = b08d6eeab5af65553cc7bc899f30ba86efbb9540cd89ffd5e0238d74ead07c1e567d7824b0b2fb4647a335a3bd0cc4103bb30d8849c2ea476f043591a1f6c10d677e70e6f788f50b7ad3aac8d6df8a37fff5736d058f8c26069632bb687632725808c777e61f40e721cba38274c7694c3aa1dc8b5ed453181adfff2469a7f49967960df6b83c308c0c2132e25ba04e4fabea3dd18bbd4450cf23cf7ce4a68977215f2cbd0404	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hhwoaawvta\8b9b4b32 = 156152619414cfc2b378f0e0f557cf317a7b0b85e40473a91bb214bc167f62a012ca963ef3a2f1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hhwoaawvta\33272c57 = 8981c3947d4e8a61ce6948342f4b4abc681a7a13f8c925885e3a727a020a0e06cf8f1320d0e51a75935fd7a8477ef9d1c2fbc339eaddeafb4446497e3680	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hhwoaawvta\f69304b8 = 8a2c358e4742d000bb8570f4cc9e9a990712c13e357ee0384939a1c53421b9d86a725cfe4c74017e521539b4166540449eea2c94f3b885a1e607bc7e4f7e7e01ec6e017e04e18ba8d6dc8c2df34a05aaa1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hhwoaawvta\31660c2b = 6e52649040f8c98f8e9e534dabbd563d3999	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hhwoaawvta\4e2f63dd = b6a65f49bcfd610cf62a6cdea543	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hhwoaawvta\bc45bb00 = 9530f0cf2a868c0db9569a8aabe936eb7ab9516003c5026b0ed9d872942a1471843b9cfc89109833b5e9090fc088ac69535c915b4b6971de7e412a12a1adfcf5a064fbf58650beec	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2804 rundll32.exe
2804 rundll32.exe
4476 regsvr32.exe
4476 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2804 rundll32.exe
4476 regsvr32.exe

pid	process
2804	rundll32.exe
2804	rundll32.exe
4476	regsvr32.exe
4476	regsvr32.exe

pid	process
2804	rundll32.exe
4476	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1432 wrote to memory of 2804	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 2804	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 2804	1432	rundll32.exe	rundll32.exe
PID 2804 wrote to memory of 4932	2804	rundll32.exe	explorer.exe
PID 2804 wrote to memory of 4932	2804	rundll32.exe	explorer.exe
PID 2804 wrote to memory of 4932	2804	rundll32.exe	explorer.exe
PID 2804 wrote to memory of 4932	2804	rundll32.exe	explorer.exe
PID 2804 wrote to memory of 4932	2804	rundll32.exe	explorer.exe
PID 4932 wrote to memory of 5072	4932	explorer.exe	schtasks.exe
PID 4932 wrote to memory of 5072	4932	explorer.exe	schtasks.exe
PID 4932 wrote to memory of 5072	4932	explorer.exe	schtasks.exe
PID 4356 wrote to memory of 4476	4356	regsvr32.exe	regsvr32.exe
PID 4356 wrote to memory of 4476	4356	regsvr32.exe	regsvr32.exe
PID 4356 wrote to memory of 4476	4356	regsvr32.exe	regsvr32.exe
PID 4476 wrote to memory of 1508	4476	regsvr32.exe	explorer.exe
PID 4476 wrote to memory of 1508	4476	regsvr32.exe	explorer.exe
PID 4476 wrote to memory of 1508	4476	regsvr32.exe	explorer.exe
PID 4476 wrote to memory of 1508	4476	regsvr32.exe	explorer.exe
PID 4476 wrote to memory of 1508	4476	regsvr32.exe	explorer.exe
PID 1508 wrote to memory of 3448	1508	explorer.exe	reg.exe
PID 1508 wrote to memory of 3448	1508	explorer.exe	reg.exe
PID 1508 wrote to memory of 2920	1508	explorer.exe	reg.exe
PID 1508 wrote to memory of 2920	1508	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\932cf14b4f91d84439db9c977beee326_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\932cf14b4f91d84439db9c977beee326_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4932

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lsgnveyfww /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\932cf14b4f91d84439db9c977beee326_JaffaCakes118.dll\"" /SC ONCE /Z /ST 17:56 /ET 18:08
4⤵
- Creates scheduled task(s)
PID:5072

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\932cf14b4f91d84439db9c977beee326_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4356

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\932cf14b4f91d84439db9c977beee326_JaffaCakes118.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4476

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Osymaifruv" /d "0"
4⤵
- Windows security bypass
PID:3448

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Oelbqebmipii" /d "0"
4⤵
- Windows security bypass
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\932cf14b4f91d84439db9c977beee326_JaffaCakes118.dll
Filesize
689KB

MD5
932cf14b4f91d84439db9c977beee326

SHA1
e9eb1f908042d89d754e843b24b3f7b423fbff37

SHA256
5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88

SHA512
dc6428aa9f16f16d9880d75036a848331522bad5d91b5166ee4157240a05503ad515b4b303956ee80e6335b97c06a72d123b1777b4d5fc366a2ff1963aa97f95

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1508-22-0x0000000001220000-0x0000000001241000-memory.dmp

Filesize
132KB

Download
memory/1508-30-0x0000000001220000-0x0000000001241000-memory.dmp

Filesize
132KB

Download
memory/1508-28-0x0000000001220000-0x0000000001241000-memory.dmp

Filesize
132KB

Download
memory/1508-27-0x0000000001220000-0x0000000001241000-memory.dmp

Filesize
132KB

Download
memory/1508-26-0x0000000001220000-0x0000000001241000-memory.dmp

Filesize
132KB

Download
memory/2804-0-0x00000000754C0000-0x000000007557D000-memory.dmp

Filesize
756KB

Download
memory/2804-6-0x00000000754C0000-0x000000007557D000-memory.dmp

Filesize
756KB

Download
memory/2804-1-0x00000000754C0000-0x000000007557D000-memory.dmp

Filesize
756KB

Download
memory/2804-2-0x0000000001180000-0x0000000001181000-memory.dmp

Filesize
4KB

Download
memory/2804-3-0x00000000754C0000-0x000000007557D000-memory.dmp

Filesize
756KB

Download
memory/4476-17-0x0000000073E00000-0x0000000073EBD000-memory.dmp

Filesize
756KB

Download
memory/4476-18-0x0000000073E00000-0x0000000073EBD000-memory.dmp

Filesize
756KB

Download
memory/4476-21-0x0000000000E80000-0x0000000000E81000-memory.dmp

Filesize
4KB

Download
memory/4476-19-0x0000000073E00000-0x0000000073EBD000-memory.dmp

Filesize
756KB

Download
memory/4476-24-0x0000000073E00000-0x0000000073EBD000-memory.dmp

Filesize
756KB

Download
memory/4932-13-0x00000000009B0000-0x00000000009D1000-memory.dmp

Filesize
132KB

Download
memory/4932-11-0x00000000009B0000-0x00000000009D1000-memory.dmp

Filesize
132KB

Download
memory/4932-10-0x00000000009B0000-0x00000000009D1000-memory.dmp

Filesize
132KB

Download
memory/4932-9-0x00000000009B0000-0x00000000009D1000-memory.dmp

Filesize
132KB

Download
memory/4932-5-0x00000000009B0000-0x00000000009D1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads