qakbot | b6c7c10b2389872e1c16b8c398bb3192103ec858179ecb04c89ea93633173796

General

Target

d03ac99c0404b779cfe3c10e1c804581_JaffaCakes118.dll
Size

1.5MB
MD5

d03ac99c0404b779cfe3c10e1c804581
SHA1

e1e73aa1b7588cd6c3c03e1f108cc66730bdc322
SHA256

b6c7c10b2389872e1c16b8c398bb3192103ec858179ecb04c89ea93633173796
SHA512

45db0a682f46fa5c9ca9e19550429c76b599f5ae2d2cd2c37868741e3b8668c10adccae788db3f81522f43ac415acdde3b74713e97f2c7be40c4077f6b05fa4a
SSDEEP

24576:3GmJKD/08hih1usiHtEy2YbFRf5J8urbjtWkqXYayS2/3T:3f0L08+hiH2yPjXtWEa2

Score

10^/10

qakbot tr 1634541613 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Edsyqzgoierh = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Ussefteaz = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1152 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2280 schtasks.exe

pid	process
1152	regsvr32.exe

pid	process
2280	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zesgtjyespfbpt\b9665f19 = 72ebd81004c02cc351943b0cd4194b54cc2d071e387e628c0e49840d09349cac54d483f7e20af6ca7f9f17a76d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zesgtjyespfbpt\c46e1093 = 41b025d92f5965071058e6b008623da89c02b24e6b580af844	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zesgtjyespfbpt	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zesgtjyespfbpt\3604c84e = 78836639264100cbec847c5c4445b93a0bb6b2f26fc3cd1b549effd5e0c882bea01bf664e4ebd4ebaee050dc12dbca81a572c3ae61a620088e3dc1af0aeb4e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zesgtjyespfbpt\7cd277f6 = 56c4de90b5aa9811619e8b8132a8666b097f6b984e394d238b8d1894128ccc2a49bae42a188fc3d60a7385c6c8e6329d10b2bffd149882eac1493fe65bda5fe616e7333fa181e29fce9bdb63994f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zesgtjyespfbpt\bb277f65 = 9435af75000baa1cd899fc77fb99cdeef4ffb9a84d63bedf672a9f2a4dea8de9f7ccefd0462c44a2bf7f8ca98c8da85484	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zesgtjyespfbpt\494da7b8 = ab543f29499b7d499c4a4de8184a89e162e5d79f2f19468eec9f258154fe35ed956606b1da0322e00ca92f640dbf17e23fd347a07eb14d9037b3c556275ba20b4c74a7e0c4df70b1ab49e888	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zesgtjyespfbpt\3604c84e = 78837139264135c4510b3354cc64a66a9b21088e4dccc06c6aa7d4ddce6b6f288d80eb86bf1ec2b157cbfa444d2a134fd1f43cc58b887ba37e7db2b50e6de53fbb142583529e97031a675e56d0faa7b42fe41f1f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zesgtjyespfbpt\39b1800 = 39352220f945afa320d3db9540f2ba147f4e8f129732cf57414344d59cc9c7682bb349417cdefa6898a9868c892e626b2d74ea1cf6c7aa5e77bc9b8b0c2467e6542898f6c02fd0d339bd2ac816fe61b8cea81eb0aa611741b81d0523ef04e21ca72e7ebbc6702804101d0e4ceb1baff23c6f2a7fa156d267cd80579f55deebce41ba2640f59ba7e729e2a4d874ce632aab218a995acf13816fd8170eab6046f9ad8c7ee594f58580637f0595f7880ac1b05cfe7c0dc476ae8fe0384d5befcbf8460cdb8b83063ba312d4ace947976706	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zesgtjyespfbpt\1da387c = 81535b634a38af9bd76961b2a54df74348c2a95c4b9476aca365b7334c364afb4b7b53c28ab10db07969cbf79822b6c58bd86561a5ae22645e675bc35def87b5fae167cd66fd7768b4331efc97252c653f1c4edb4ed874719b82235b2323046c3713173fe7d752fac112ddef7eecead610	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1688 rundll32.exe
1688 rundll32.exe
1152 regsvr32.exe
1152 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1688 rundll32.exe
1152 regsvr32.exe

pid	process
1688	rundll32.exe
1688	rundll32.exe
1152	regsvr32.exe
1152	regsvr32.exe

pid	process
1688	rundll32.exe
1152	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 5072 wrote to memory of 1688	5072	rundll32.exe	rundll32.exe
PID 5072 wrote to memory of 1688	5072	rundll32.exe	rundll32.exe
PID 5072 wrote to memory of 1688	5072	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 2188	1688	rundll32.exe	explorer.exe
PID 1688 wrote to memory of 2188	1688	rundll32.exe	explorer.exe
PID 1688 wrote to memory of 2188	1688	rundll32.exe	explorer.exe
PID 1688 wrote to memory of 2188	1688	rundll32.exe	explorer.exe
PID 1688 wrote to memory of 2188	1688	rundll32.exe	explorer.exe
PID 2188 wrote to memory of 2280	2188	explorer.exe	schtasks.exe
PID 2188 wrote to memory of 2280	2188	explorer.exe	schtasks.exe
PID 2188 wrote to memory of 2280	2188	explorer.exe	schtasks.exe
PID 4944 wrote to memory of 1152	4944	regsvr32.exe	regsvr32.exe
PID 4944 wrote to memory of 1152	4944	regsvr32.exe	regsvr32.exe
PID 4944 wrote to memory of 1152	4944	regsvr32.exe	regsvr32.exe
PID 1152 wrote to memory of 2940	1152	regsvr32.exe	explorer.exe
PID 1152 wrote to memory of 2940	1152	regsvr32.exe	explorer.exe
PID 1152 wrote to memory of 2940	1152	regsvr32.exe	explorer.exe
PID 1152 wrote to memory of 2940	1152	regsvr32.exe	explorer.exe
PID 1152 wrote to memory of 2940	1152	regsvr32.exe	explorer.exe
PID 2940 wrote to memory of 1836	2940	explorer.exe	reg.exe
PID 2940 wrote to memory of 1836	2940	explorer.exe	reg.exe
PID 2940 wrote to memory of 1820	2940	explorer.exe	reg.exe
PID 2940 wrote to memory of 1820	2940	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d03ac99c0404b779cfe3c10e1c804581_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d03ac99c0404b779cfe3c10e1c804581_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hktepams /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\d03ac99c0404b779cfe3c10e1c804581_JaffaCakes118.dll\"" /SC ONCE /Z /ST 09:47 /ET 09:59
      4⤵
      Creates scheduled task(s)
      PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=3084,i,14217130992253490921,11543335378077656547,262144 --variations-seed-version /prefetch:8
1⤵
PID:3936

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\d03ac99c0404b779cfe3c10e1c804581_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\d03ac99c0404b779cfe3c10e1c804581_JaffaCakes118.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Edsyqzgoierh" /d "0"
      4⤵
      Windows security bypass
      PID:1836
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ussefteaz" /d "0"
      4⤵
      Windows security bypass
      PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d03ac99c0404b779cfe3c10e1c804581_JaffaCakes118.dll

Filesize
1.5MB

MD5
d03ac99c0404b779cfe3c10e1c804581

SHA1
e1e73aa1b7588cd6c3c03e1f108cc66730bdc322

SHA256
b6c7c10b2389872e1c16b8c398bb3192103ec858179ecb04c89ea93633173796

SHA512
45db0a682f46fa5c9ca9e19550429c76b599f5ae2d2cd2c37868741e3b8668c10adccae788db3f81522f43ac415acdde3b74713e97f2c7be40c4077f6b05fa4a

Download Submit
memory/1152-22-0x0000000073E60000-0x0000000073FF3000-memory.dmp

Filesize
1.6MB

Download
memory/1152-19-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/1152-18-0x0000000073E60000-0x0000000073FF3000-memory.dmp

Filesize
1.6MB

Download
memory/1152-17-0x0000000073E60000-0x0000000073FF3000-memory.dmp

Filesize
1.6MB

Download
memory/1688-1-0x00000000755F0000-0x0000000075783000-memory.dmp

Filesize
1.6MB

Download
memory/1688-2-0x00000000016B0000-0x00000000016B1000-memory.dmp

Filesize
4KB

Download
memory/1688-3-0x00000000755F0000-0x0000000075783000-memory.dmp

Filesize
1.6MB

Download
memory/1688-0-0x00000000755F0000-0x0000000075783000-memory.dmp

Filesize
1.6MB

Download
memory/1688-6-0x00000000755F0000-0x0000000075783000-memory.dmp

Filesize
1.6MB

Download
memory/2188-5-0x00000000008F0000-0x0000000000911000-memory.dmp

Filesize
132KB

Download
memory/2188-13-0x00000000008F0000-0x0000000000911000-memory.dmp

Filesize
132KB

Download
memory/2188-11-0x00000000008F0000-0x0000000000911000-memory.dmp

Filesize
132KB

Download
memory/2188-10-0x00000000008F0000-0x0000000000911000-memory.dmp

Filesize
132KB

Download
memory/2188-9-0x00000000008F0000-0x0000000000911000-memory.dmp

Filesize
132KB

Download
memory/2940-21-0x0000000001290000-0x00000000012B1000-memory.dmp

Filesize
132KB

Download
memory/2940-24-0x0000000001290000-0x00000000012B1000-memory.dmp

Filesize
132KB

Download
memory/2940-25-0x0000000001290000-0x00000000012B1000-memory.dmp

Filesize
132KB

Download
memory/2940-26-0x0000000001290000-0x00000000012B1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads