qakbot | d6f4b6cfcd8d940d1a3c7b98d6019479f30e55b4f0cf4b7fdb1446ad61dbbcca

General

Target

c5dbac2119ba291338313b3d6c587209_JaffaCakes118.dll
Size

855KB
MD5

c5dbac2119ba291338313b3d6c587209
SHA1

b31318d688602a8cab85361f0391b32ccdf9eee8
SHA256

d6f4b6cfcd8d940d1a3c7b98d6019479f30e55b4f0cf4b7fdb1446ad61dbbcca
SHA512

cab46e1c8461bfc04358131ec5260593948abc1b91a9c2ef532ee7196cf0db19ce667986e4fe7e9d7b58568fa8aef40deeb21cc786a26e3a9bf7bf57080fa88d
SSDEEP

24576:1L8cabX4zXsvdilerHJ36NAH1E2CeNl4Z:hybX4XslKCYAH1E2Ce

Score

10^/10

qakbot tr 1633943125 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633943125

C2

140.82.49.12:443

89.137.52.44:443

24.107.165.50:443

66.216.193.114:443

75.131.217.182:443

41.86.42.158:995

24.119.214.7:443

67.166.233.75:443

105.198.236.99:443

120.151.47.189:443

2.222.167.138:443

41.228.22.180:443

78.105.213.151:995

5.193.125.67:995

41.86.42.158:443

96.57.188.174:2078

120.150.218.241:995

66.177.215.152:0

122.11.220.212:2222

73.52.50.32:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Gufofoniv = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Tupyeudatir = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2688 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2520 schtasks.exe

pid	process
2688	regsvr32.exe

pid	process
2520	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pseczkyuvzds	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pseczkyuvzds\dc279a73 = 4eb43399c5ca320ccd46693f284717de286fdf877f2582a4b6365409c9322ada10958749d932c548da9e199d7d54263dde863cff22dd304bdb122a76219947	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pseczkyuvzds\e9b84a3d = c8d74791481b87ab634a701697ad1fabd53f63a0eb9ca1da6b84f3b4dbcfb38c0d738f9a363a0e45a156ad48c1c62269ebb1a243ab551e07c6fcf9bb88e4dd767f3857de9a0c057d32ae64cdde12cd1b7ef2a4f8bcb3ea20b5f63426904e5bf02f818f958dd70b2bf0e0db7d0be6b65f1afd6207501f4151243f40037989502a865bb7266380033fd99086bf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pseczkyuvzds\53450d24 = 57c70cdd161876cafe9b516bdd8215964c7376c4b16dee4125ea1f36b5aba9eabe0eeab9e7e9e65cdb26caf26580f12f7cd9a28af98c2329bc5451c3ed790f4c741bd445dc0097328a762e30866206	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pseczkyuvzds\51042d58 = cea45267a4a3430e3ed92681e96bd92f00bcfc4d9c445cd0e480ddeb70ed7e42effb0c3838b2dd496ec535266aff6612137a2339ecb9c4e5e1c48a53e970f2098b71b392f7d221bc9636b65dd9934b75d9ac50ee00d5fca7f8adbca640709a6a93cd20a3616cb8c98e65a53b9c2535c5b7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pseczkyuvzds\ebf96a41 = 2e0df22151161116436d2a5826471e5b2311ee7be141cc0b70664f4030d49047e26507660f4bbfc6506dab616cf3fcdee300	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pseczkyuvzds\2e4d42ae = 2edc0ef6ad92f4c6a7ed2144df8b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pseczkyuvzds\96f125cb = 24e13f259650b1817984a9aa43717ca4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pseczkyuvzds\a36ef585 = 81bc727814eb1d3e3ee447c74f22371101d46c36e2d03879977c71a8360e12ff1fec48048745626f0d63dce2b06b8a3de654	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pseczkyuvzds\dc279a73 = 4eb42499c5ca0742daf6f166cbefaaa56bd34144fa3ed9a3c7e65b558aea98b29d6ed862afbe930730f0fa2018c9eb2fb203222deba937eba3bbcfb83c5c5c011a9ac85a6a8f54b1b6409a2c5684c1719ca1d5c6	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2748 rundll32.exe
2688 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2748 rundll32.exe
2688 regsvr32.exe

pid	process
2748	rundll32.exe
2688	regsvr32.exe

pid	process
2748	rundll32.exe
2688	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2628 wrote to memory of 2748	2628	rundll32.exe	rundll32.exe
PID 2628 wrote to memory of 2748	2628	rundll32.exe	rundll32.exe
PID 2628 wrote to memory of 2748	2628	rundll32.exe	rundll32.exe
PID 2628 wrote to memory of 2748	2628	rundll32.exe	rundll32.exe
PID 2628 wrote to memory of 2748	2628	rundll32.exe	rundll32.exe
PID 2628 wrote to memory of 2748	2628	rundll32.exe	rundll32.exe
PID 2628 wrote to memory of 2748	2628	rundll32.exe	rundll32.exe
PID 2748 wrote to memory of 2516	2748	rundll32.exe	explorer.exe
PID 2748 wrote to memory of 2516	2748	rundll32.exe	explorer.exe
PID 2748 wrote to memory of 2516	2748	rundll32.exe	explorer.exe
PID 2748 wrote to memory of 2516	2748	rundll32.exe	explorer.exe
PID 2748 wrote to memory of 2516	2748	rundll32.exe	explorer.exe
PID 2748 wrote to memory of 2516	2748	rundll32.exe	explorer.exe
PID 2516 wrote to memory of 2520	2516	explorer.exe	schtasks.exe
PID 2516 wrote to memory of 2520	2516	explorer.exe	schtasks.exe
PID 2516 wrote to memory of 2520	2516	explorer.exe	schtasks.exe
PID 2516 wrote to memory of 2520	2516	explorer.exe	schtasks.exe
PID 1512 wrote to memory of 2656	1512	taskeng.exe	regsvr32.exe
PID 1512 wrote to memory of 2656	1512	taskeng.exe	regsvr32.exe
PID 1512 wrote to memory of 2656	1512	taskeng.exe	regsvr32.exe
PID 1512 wrote to memory of 2656	1512	taskeng.exe	regsvr32.exe
PID 1512 wrote to memory of 2656	1512	taskeng.exe	regsvr32.exe
PID 2656 wrote to memory of 2688	2656	regsvr32.exe	regsvr32.exe
PID 2656 wrote to memory of 2688	2656	regsvr32.exe	regsvr32.exe
PID 2656 wrote to memory of 2688	2656	regsvr32.exe	regsvr32.exe
PID 2656 wrote to memory of 2688	2656	regsvr32.exe	regsvr32.exe
PID 2656 wrote to memory of 2688	2656	regsvr32.exe	regsvr32.exe
PID 2656 wrote to memory of 2688	2656	regsvr32.exe	regsvr32.exe
PID 2656 wrote to memory of 2688	2656	regsvr32.exe	regsvr32.exe
PID 2688 wrote to memory of 1084	2688	regsvr32.exe	explorer.exe
PID 2688 wrote to memory of 1084	2688	regsvr32.exe	explorer.exe
PID 2688 wrote to memory of 1084	2688	regsvr32.exe	explorer.exe
PID 2688 wrote to memory of 1084	2688	regsvr32.exe	explorer.exe
PID 2688 wrote to memory of 1084	2688	regsvr32.exe	explorer.exe
PID 2688 wrote to memory of 1084	2688	regsvr32.exe	explorer.exe
PID 1084 wrote to memory of 1420	1084	explorer.exe	reg.exe
PID 1084 wrote to memory of 1420	1084	explorer.exe	reg.exe
PID 1084 wrote to memory of 1420	1084	explorer.exe	reg.exe
PID 1084 wrote to memory of 1420	1084	explorer.exe	reg.exe
PID 1084 wrote to memory of 1748	1084	explorer.exe	reg.exe
PID 1084 wrote to memory of 1748	1084	explorer.exe	reg.exe
PID 1084 wrote to memory of 1748	1084	explorer.exe	reg.exe
PID 1084 wrote to memory of 1748	1084	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5dbac2119ba291338313b3d6c587209_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5dbac2119ba291338313b3d6c587209_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dwexypnr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\c5dbac2119ba291338313b3d6c587209_JaffaCakes118.dll\"" /SC ONCE /Z /ST 00:28 /ET 00:40
      4⤵
      Creates scheduled task(s)
      PID:2520

C:\Windows\system32\taskeng.exe
taskeng.exe {FC575360-C6A7-4A23-BAC7-21E0A1DF43AE} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\c5dbac2119ba291338313b3d6c587209_JaffaCakes118.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\c5dbac2119ba291338313b3d6c587209_JaffaCakes118.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1084
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Gufofoniv" /d "0"
        5⤵
        Windows security bypass
        
        PID:1420
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Tupyeudatir" /d "0"
        5⤵
        Windows security bypass
        
        PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c5dbac2119ba291338313b3d6c587209_JaffaCakes118.dll

Filesize
855KB

MD5
c5dbac2119ba291338313b3d6c587209

SHA1
b31318d688602a8cab85361f0391b32ccdf9eee8

SHA256
d6f4b6cfcd8d940d1a3c7b98d6019479f30e55b4f0cf4b7fdb1446ad61dbbcca

SHA512
cab46e1c8461bfc04358131ec5260593948abc1b91a9c2ef532ee7196cf0db19ce667986e4fe7e9d7b58568fa8aef40deeb21cc786a26e3a9bf7bf57080fa88d

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1084-32-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/1084-31-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/1084-30-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/1084-27-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2516-7-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2516-5-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2516-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2516-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2516-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2516-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2688-20-0x0000000074640000-0x00000000747AE000-memory.dmp

Filesize
1.4MB

Download
memory/2688-22-0x0000000074640000-0x00000000747AE000-memory.dmp

Filesize
1.4MB

Download
memory/2688-21-0x0000000074640000-0x00000000747AE000-memory.dmp

Filesize
1.4MB

Download
memory/2688-28-0x0000000074640000-0x00000000747AE000-memory.dmp

Filesize
1.4MB

Download
memory/2748-0-0x0000000075080000-0x00000000751EE000-memory.dmp

Filesize
1.4MB

Download
memory/2748-8-0x0000000075080000-0x00000000751EE000-memory.dmp

Filesize
1.4MB

Download
memory/2748-1-0x0000000075080000-0x00000000751EE000-memory.dmp

Filesize
1.4MB

Download
memory/2748-4-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2748-2-0x0000000075080000-0x00000000751EE000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads