qakbot | b6c7c10b2389872e1c16b8c398bb3192103ec858179ecb04c89ea93633173796

General

Target

d03ac99c0404b779cfe3c10e1c804581_JaffaCakes118.dll
Size

1.5MB
MD5

d03ac99c0404b779cfe3c10e1c804581
SHA1

e1e73aa1b7588cd6c3c03e1f108cc66730bdc322
SHA256

b6c7c10b2389872e1c16b8c398bb3192103ec858179ecb04c89ea93633173796
SHA512

45db0a682f46fa5c9ca9e19550429c76b599f5ae2d2cd2c37868741e3b8668c10adccae788db3f81522f43ac415acdde3b74713e97f2c7be40c4077f6b05fa4a
SSDEEP

24576:3GmJKD/08hih1usiHtEy2YbFRf5J8urbjtWkqXYayS2/3T:3f0L08+hiH2yPjXtWEa2

Score

10^/10

qakbot tr 1634541613 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Qyudednfpm = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Iyhko = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

836 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2572 schtasks.exe

pid	process
836	regsvr32.exe

pid	process
2572	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ipddrni\e8a76ae2 = 42dce43a1c1f4e4dde9f6faab2480b8091f77ecea395eac88accbefc5e2954f75d46e3a55e6665ba30a9c23ffdaa27cc0cc1d383e5c2ff395de27dc2db84685e7eaafaba2b98ba3289602d60a082f87123400f8626164f277e0c408933ecf37225ae684f12175d7151a40b38a85d5ed4bd7b953850047fb595f4f1ed1021da07ede8ba01f5fdc68fa8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ipddrni\2f526271 = 049ce6a5dc4534638a80df02bcb746a04056eed606e01837254b2063024ec51e09b77899c1c4365ba44a0fa51fc0340ffe16226829b4447c815f9ddc33e4faeac64e3235d8d4f03fd27c980b916d5b9f25097bb1cdbe177379eb8fd657763f65	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ipddrni\501b0d87 = a9faa44e6c932c4f1d306005f77d59a69692283c9af252bed8ef19684072b20256cad7d5cafc48b481d827df69d8ed0efcc614bfdb4ef44ff51487e3b556eb4cc229d1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ipddrni\dd38baac = 889818a154485ddabc74eb68ec826e4339c14c6e2c4e9ffa9a433192e0b1695f2fae5c32b14f4517869a2a3ed50c63c6bcf45441ce985b15c96b25cf93e838845494bf9b43940e0e7b0dd16af5bd9ff93f17fb11ef7a0f72df4a0312a2ca0f872b0c5392081650334124bf9a	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ipddrni	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ipddrni\dd38baac = 88980fa15448683ac2c250470b2987d219bc04e309d5f538426675b3db28502f5b3023366fe1e97359912b2e30eec251c7a21de2ecad29c41db3929c9d1e1d5c1ca1f3885639bdac4ef7a8772f8c40fcb28eb0f3ecc784	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ipddrni\97ee0514 = fed1c5be31dfaefd40e087bb1222421d1e34b4766631a1da0c4e7ff263a14ccfe0ac388d4fb6d7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ipddrni\a271d55a = 0649431de8dde5f12efb32375ba5a1919b304db2b6953fdf1d470a4fccb5d1e78a44acf9735e81558e44875686330c4f628e226e92dfd1a7c7a06c605100ec256630635b8b4cd9f4d6f8ded81c34fca613f8df3ec2b1272988c3c6507574d12a5bfd13d7a04f860a737f7664	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ipddrni\eae64a9e = 42d0dbc283d1645172dda2d65f2c5f96a01c5cd175114c5f2026ce91b03be7934850bcdd17712a2e7c23bb2d79f39ed6f20d8dd3fc7eab8b134b586b247d43f52530703b10	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ipddrni\525a2dfb = db930a8a730bcbfb7e1d52dea081b069b216ae96736c2b9d4b93e4a69813	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1120 rundll32.exe
836 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1120 rundll32.exe
836 regsvr32.exe

pid	process
1120	rundll32.exe
836	regsvr32.exe

pid	process
1120	rundll32.exe
836	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2156 wrote to memory of 1120	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 1120	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 1120	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 1120	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 1120	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 1120	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 1120	2156	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 2508	1120	rundll32.exe	explorer.exe
PID 1120 wrote to memory of 2508	1120	rundll32.exe	explorer.exe
PID 1120 wrote to memory of 2508	1120	rundll32.exe	explorer.exe
PID 1120 wrote to memory of 2508	1120	rundll32.exe	explorer.exe
PID 1120 wrote to memory of 2508	1120	rundll32.exe	explorer.exe
PID 1120 wrote to memory of 2508	1120	rundll32.exe	explorer.exe
PID 2508 wrote to memory of 2572	2508	explorer.exe	schtasks.exe
PID 2508 wrote to memory of 2572	2508	explorer.exe	schtasks.exe
PID 2508 wrote to memory of 2572	2508	explorer.exe	schtasks.exe
PID 2508 wrote to memory of 2572	2508	explorer.exe	schtasks.exe
PID 2184 wrote to memory of 552	2184	taskeng.exe	regsvr32.exe
PID 2184 wrote to memory of 552	2184	taskeng.exe	regsvr32.exe
PID 2184 wrote to memory of 552	2184	taskeng.exe	regsvr32.exe
PID 2184 wrote to memory of 552	2184	taskeng.exe	regsvr32.exe
PID 2184 wrote to memory of 552	2184	taskeng.exe	regsvr32.exe
PID 552 wrote to memory of 836	552	regsvr32.exe	regsvr32.exe
PID 552 wrote to memory of 836	552	regsvr32.exe	regsvr32.exe
PID 552 wrote to memory of 836	552	regsvr32.exe	regsvr32.exe
PID 552 wrote to memory of 836	552	regsvr32.exe	regsvr32.exe
PID 552 wrote to memory of 836	552	regsvr32.exe	regsvr32.exe
PID 552 wrote to memory of 836	552	regsvr32.exe	regsvr32.exe
PID 552 wrote to memory of 836	552	regsvr32.exe	regsvr32.exe
PID 836 wrote to memory of 2808	836	regsvr32.exe	explorer.exe
PID 836 wrote to memory of 2808	836	regsvr32.exe	explorer.exe
PID 836 wrote to memory of 2808	836	regsvr32.exe	explorer.exe
PID 836 wrote to memory of 2808	836	regsvr32.exe	explorer.exe
PID 836 wrote to memory of 2808	836	regsvr32.exe	explorer.exe
PID 836 wrote to memory of 2808	836	regsvr32.exe	explorer.exe
PID 2808 wrote to memory of 2084	2808	explorer.exe	reg.exe
PID 2808 wrote to memory of 2084	2808	explorer.exe	reg.exe
PID 2808 wrote to memory of 2084	2808	explorer.exe	reg.exe
PID 2808 wrote to memory of 2084	2808	explorer.exe	reg.exe
PID 2808 wrote to memory of 1976	2808	explorer.exe	reg.exe
PID 2808 wrote to memory of 1976	2808	explorer.exe	reg.exe
PID 2808 wrote to memory of 1976	2808	explorer.exe	reg.exe
PID 2808 wrote to memory of 1976	2808	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d03ac99c0404b779cfe3c10e1c804581_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d03ac99c0404b779cfe3c10e1c804581_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dwdzcyelr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\d03ac99c0404b779cfe3c10e1c804581_JaffaCakes118.dll\"" /SC ONCE /Z /ST 09:47 /ET 09:59
      4⤵
      Creates scheduled task(s)
      PID:2572

C:\Windows\system32\taskeng.exe
taskeng.exe {D74084C6-A2CA-4437-8D1B-57026D6A8715} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\d03ac99c0404b779cfe3c10e1c804581_JaffaCakes118.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\d03ac99c0404b779cfe3c10e1c804581_JaffaCakes118.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Qyudednfpm" /d "0"
        5⤵
        Windows security bypass
        
        PID:2084
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Iyhko" /d "0"
        5⤵
        Windows security bypass
        
        PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d03ac99c0404b779cfe3c10e1c804581_JaffaCakes118.dll

Filesize
1.5MB

MD5
d03ac99c0404b779cfe3c10e1c804581

SHA1
e1e73aa1b7588cd6c3c03e1f108cc66730bdc322

SHA256
b6c7c10b2389872e1c16b8c398bb3192103ec858179ecb04c89ea93633173796

SHA512
45db0a682f46fa5c9ca9e19550429c76b599f5ae2d2cd2c37868741e3b8668c10adccae788db3f81522f43ac415acdde3b74713e97f2c7be40c4077f6b05fa4a

Download Submit
memory/836-27-0x0000000073D20000-0x0000000073EB3000-memory.dmp

Filesize
1.6MB

Download
memory/836-21-0x0000000073D20000-0x0000000073EB3000-memory.dmp

Filesize
1.6MB

Download
memory/836-20-0x0000000073D20000-0x0000000073EB3000-memory.dmp

Filesize
1.6MB

Download
memory/1120-1-0x0000000074790000-0x0000000074923000-memory.dmp

Filesize
1.6MB

Download
memory/1120-4-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1120-0-0x0000000074790000-0x0000000074923000-memory.dmp

Filesize
1.6MB

Download
memory/1120-8-0x0000000074790000-0x0000000074923000-memory.dmp

Filesize
1.6MB

Download
memory/2508-7-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2508-14-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2508-15-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2508-13-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2508-12-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2508-11-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2508-5-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/2808-26-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2808-29-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2808-30-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2808-31-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads