qakbot | 7d90e5c0e768763f154805629506d6620ad3c3c08ca5cbbf99123fcea97230ac

General

Target

a121985adcddbb2eb923d45ae3b8cdd9_JaffaCakes118.dll
Size

836KB
MD5

a121985adcddbb2eb923d45ae3b8cdd9
SHA1

713c8fe8286c0090f4027ff49d0fdaa4807153af
SHA256

7d90e5c0e768763f154805629506d6620ad3c3c08ca5cbbf99123fcea97230ac
SHA512

ab8f1997a61ee4252538c0f36d8c1efa4673a172e76f936e8373de7e2191856b569f3321a09d963a0e2a8309b57c3a3d2cc31131bf3726ad3059736793539b57
SSDEEP

24576:/L8cabX4zXsvdilerHJb6NwH1E2C3Nl4Z:jybX4XslKCMwH1E2C3

Score

10^/10

qakbot tr 1633943125 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633943125

C2

140.82.49.12:443

89.137.52.44:443

24.107.165.50:443

66.216.193.114:443

75.131.217.182:443

41.86.42.158:995

24.119.214.7:443

67.166.233.75:443

105.198.236.99:443

120.151.47.189:443

2.222.167.138:443

41.228.22.180:443

78.105.213.151:995

5.193.125.67:995

41.86.42.158:443

96.57.188.174:2078

120.150.218.241:995

66.177.215.152:0

122.11.220.212:2222

73.52.50.32:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Uzkkmyxal = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Zknfoqgygiwi = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1932 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2576 schtasks.exe

pid	process
1932	regsvr32.exe

pid	process
2576	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Deonroo\32ce2def = 4267f62dfe320c1caebaa0e4f1f5ce4bb146dc608db90cf060ff57d4e69c2a6de04c5b6590f05cb3034bb2b5a1f94ba57c5f07c699a2190cf82a9c60556f0e23ce616c3525c3a225dc7cc50bee82edb973e9fb2b1ff6f28a909ad5a7cf19b09760f3f65bf9643cbb9d3340	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Deonroo\751fda1 = eb55e92885525ebfcecf0952a68e28d9c61a1d7f9e9e48f9311fba9e3b48018426c5d63f76e5881ad1b246271223faa49e5c87d6fb4fad61db859a287d2d78d28adf091a22f347bcf6521e6966ec029c4607bbe19add637ba8ad05a4523d65dfd5736b4740a548e47354c990445936f30d43ad174d7294c2ef2412773d47836aca515c3fa44aad9cfd292c218a8b3788eb1211b2dbd9cb8cdfc3441ddd33412919ae166662	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Deonroo\510dddd = 52c17221d0943df01a68362e3b71479231978ab79de9821494408200413ccafe6985ae6c4035219810f7f44ed82ac641a1d186dae62bf6293542ebe434e95d8379cc56c306778b1df0018eafffabe0518df77b7ef1d6a7f3bb7839160e4ed1b64087f7d8d7daf4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Deonroo\78189257 = ccc21880b1f7d9f7507a8702be6ce926cf3061653adab7d45b89441917a35f0ecd5b5c48693daf4f8393aecd8090b44a648dc3d620ce0482df06b5d6b1553e7be53c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Deonroo\4d874219 = d1ef2218b29f31edd11190e6de00a339dc1afc1b14c2360fe601e7f6401c3e7d732ea48c581115c6feb4279895fc5c5eb9161ca7cdab4fc8f3a5ec7956289b7b239b8a91003f949a8a3aeffddb85cb3f2ad36d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Deonroo	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Deonroo\bdacbab8 = ee817f641e486cf45a1cf0df16fc5230cc0febe21ac601eba044e8bf096d6a36	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Deonroo\c0a4f532 = 4f4cdb974453b48f60173d00b844fc02a046ed44f917d3ba15bb9a02da3385a5a2bd397e4a46b596dc637033e9c11ef38590b733560e5127b61b500fdb1d0d11ab0e4b0c5faf7b961b7f17f01aee3ef03e34	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Deonroo\bfed9ac4 = f3df9189f8253550c0a480fa8c35336075342be1dd080e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Deonroo\32ce2def = 4267e12dfe32391e445c87139373d0255772b14a953824349fbeb002be133f1be6a410891030a5797c89988e8f231ad19cf71b30b270ac94d0c2489cdfc28292b440c25ce7f57733412030bfa168ded0a5d126b95fca70ee79238f2b5aaaae9236c3e9c982e1d8cad8ffd565cdb6548bd7f904115117203108a188283415b168	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2268 rundll32.exe
1932 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2268 rundll32.exe
1932 regsvr32.exe

pid	process
2268	rundll32.exe
1932	regsvr32.exe

pid	process
2268	rundll32.exe
1932	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2372 wrote to memory of 2268	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2268	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2268	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2268	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2268	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2268	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2268	2372	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2132	2268	rundll32.exe	explorer.exe
PID 2268 wrote to memory of 2132	2268	rundll32.exe	explorer.exe
PID 2268 wrote to memory of 2132	2268	rundll32.exe	explorer.exe
PID 2268 wrote to memory of 2132	2268	rundll32.exe	explorer.exe
PID 2268 wrote to memory of 2132	2268	rundll32.exe	explorer.exe
PID 2268 wrote to memory of 2132	2268	rundll32.exe	explorer.exe
PID 2132 wrote to memory of 2576	2132	explorer.exe	schtasks.exe
PID 2132 wrote to memory of 2576	2132	explorer.exe	schtasks.exe
PID 2132 wrote to memory of 2576	2132	explorer.exe	schtasks.exe
PID 2132 wrote to memory of 2576	2132	explorer.exe	schtasks.exe
PID 2176 wrote to memory of 776	2176	taskeng.exe	regsvr32.exe
PID 2176 wrote to memory of 776	2176	taskeng.exe	regsvr32.exe
PID 2176 wrote to memory of 776	2176	taskeng.exe	regsvr32.exe
PID 2176 wrote to memory of 776	2176	taskeng.exe	regsvr32.exe
PID 2176 wrote to memory of 776	2176	taskeng.exe	regsvr32.exe
PID 776 wrote to memory of 1932	776	regsvr32.exe	regsvr32.exe
PID 776 wrote to memory of 1932	776	regsvr32.exe	regsvr32.exe
PID 776 wrote to memory of 1932	776	regsvr32.exe	regsvr32.exe
PID 776 wrote to memory of 1932	776	regsvr32.exe	regsvr32.exe
PID 776 wrote to memory of 1932	776	regsvr32.exe	regsvr32.exe
PID 776 wrote to memory of 1932	776	regsvr32.exe	regsvr32.exe
PID 776 wrote to memory of 1932	776	regsvr32.exe	regsvr32.exe
PID 1932 wrote to memory of 1300	1932	regsvr32.exe	explorer.exe
PID 1932 wrote to memory of 1300	1932	regsvr32.exe	explorer.exe
PID 1932 wrote to memory of 1300	1932	regsvr32.exe	explorer.exe
PID 1932 wrote to memory of 1300	1932	regsvr32.exe	explorer.exe
PID 1932 wrote to memory of 1300	1932	regsvr32.exe	explorer.exe
PID 1932 wrote to memory of 1300	1932	regsvr32.exe	explorer.exe
PID 1300 wrote to memory of 2320	1300	explorer.exe	reg.exe
PID 1300 wrote to memory of 2320	1300	explorer.exe	reg.exe
PID 1300 wrote to memory of 2320	1300	explorer.exe	reg.exe
PID 1300 wrote to memory of 2320	1300	explorer.exe	reg.exe
PID 1300 wrote to memory of 2304	1300	explorer.exe	reg.exe
PID 1300 wrote to memory of 2304	1300	explorer.exe	reg.exe
PID 1300 wrote to memory of 2304	1300	explorer.exe	reg.exe
PID 1300 wrote to memory of 2304	1300	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a121985adcddbb2eb923d45ae3b8cdd9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a121985adcddbb2eb923d45ae3b8cdd9_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kwicqnwra /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a121985adcddbb2eb923d45ae3b8cdd9_JaffaCakes118.dll\"" /SC ONCE /Z /ST 05:17 /ET 05:29
4⤵
- Creates scheduled task(s)
PID:2576

C:\Windows\system32\taskeng.exe
taskeng.exe {E990C7F7-A8B3-49A4-8593-8359DE37F7A4} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a121985adcddbb2eb923d45ae3b8cdd9_JaffaCakes118.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\a121985adcddbb2eb923d45ae3b8cdd9_JaffaCakes118.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Uzkkmyxal" /d "0"
5⤵
- Windows security bypass
PID:2320

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Zknfoqgygiwi" /d "0"
5⤵
- Windows security bypass
PID:2304

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a121985adcddbb2eb923d45ae3b8cdd9_JaffaCakes118.dll
Filesize
836KB

MD5
a121985adcddbb2eb923d45ae3b8cdd9

SHA1
713c8fe8286c0090f4027ff49d0fdaa4807153af

SHA256
7d90e5c0e768763f154805629506d6620ad3c3c08ca5cbbf99123fcea97230ac

SHA512
ab8f1997a61ee4252538c0f36d8c1efa4673a172e76f936e8373de7e2191856b569f3321a09d963a0e2a8309b57c3a3d2cc31131bf3726ad3059736793539b57

Download Submit
memory/1300-30-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/1300-29-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/1300-28-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/1300-26-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/1932-25-0x0000000073E00000-0x0000000073F6E000-memory.dmp

Filesize
1.4MB

Download
memory/1932-21-0x0000000073E00000-0x0000000073F6E000-memory.dmp

Filesize
1.4MB

Download
memory/1932-20-0x0000000073E00000-0x0000000073F6E000-memory.dmp

Filesize
1.4MB

Download
memory/2132-5-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/2132-13-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/2132-15-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/2132-12-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/2132-11-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/2132-7-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/2268-8-0x0000000074850000-0x00000000749BE000-memory.dmp

Filesize
1.4MB

Download
memory/2268-0-0x0000000074850000-0x00000000749BE000-memory.dmp

Filesize
1.4MB

Download
memory/2268-1-0x0000000074850000-0x00000000749BE000-memory.dmp

Filesize
1.4MB

Download
memory/2268-4-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2268-2-0x0000000074850000-0x00000000749BE000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads