qakbot | c73067384765ba26b0d162ce826c8a1431e26c16ecbf4544c5fc7fd2313e5f3b

General

Target

e194bc1c3f3ba138a2ab72e6f2df8e2a_JaffaCakes118.dll
Size

539KB
MD5

e194bc1c3f3ba138a2ab72e6f2df8e2a
SHA1

34189f1fc6ca3adb676280ea5eef970186a5f80f
SHA256

c73067384765ba26b0d162ce826c8a1431e26c16ecbf4544c5fc7fd2313e5f3b
SHA512

e026397083e84ff7909ffcac83a60960cec5027a927c296826f39b67ed62a0d4f3a6e29d126b4b0eb0e72c03153fe2221ce1e73ca8617334b8b6eb646147c89d
SSDEEP

12288:J1ghp5DubQWErdxA+zM5miTrqZj1kENwNmhxOANU:G9rv05T+ZjHNwKOA

Score

10^/10

qakbot obama102 1632302707 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.318

Botnet

obama102

Campaign

1632302707

C2

120.150.218.241:995

47.22.148.6:443

105.198.236.99:443

95.77.223.148:443

140.82.49.12:443

27.223.92.142:995

73.151.236.31:443

136.232.34.70:443

144.139.47.206:443

45.46.53.140:2222

76.25.142.196:443

173.21.10.71:2222

75.188.35.168:443

71.74.12.34:443

96.37.113.36:993

67.165.206.193:993

189.210.115.207:443

72.252.201.69:443

24.139.72.117:443

24.229.150.54:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

832 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2964 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1728 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1728 rundll32.exe

pid	process
832	regsvr32.exe

pid	process
2964	schtasks.exe

pid	process
1728	rundll32.exe

pid	process
1728	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 2508 wrote to memory of 1728	2508	rundll32.exe	rundll32.exe
PID 2508 wrote to memory of 1728	2508	rundll32.exe	rundll32.exe
PID 2508 wrote to memory of 1728	2508	rundll32.exe	rundll32.exe
PID 2508 wrote to memory of 1728	2508	rundll32.exe	rundll32.exe
PID 2508 wrote to memory of 1728	2508	rundll32.exe	rundll32.exe
PID 2508 wrote to memory of 1728	2508	rundll32.exe	rundll32.exe
PID 2508 wrote to memory of 1728	2508	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 2576	1728	rundll32.exe	explorer.exe
PID 1728 wrote to memory of 2576	1728	rundll32.exe	explorer.exe
PID 1728 wrote to memory of 2576	1728	rundll32.exe	explorer.exe
PID 1728 wrote to memory of 2576	1728	rundll32.exe	explorer.exe
PID 1728 wrote to memory of 2576	1728	rundll32.exe	explorer.exe
PID 1728 wrote to memory of 2576	1728	rundll32.exe	explorer.exe
PID 2576 wrote to memory of 2964	2576	explorer.exe	schtasks.exe
PID 2576 wrote to memory of 2964	2576	explorer.exe	schtasks.exe
PID 2576 wrote to memory of 2964	2576	explorer.exe	schtasks.exe
PID 2576 wrote to memory of 2964	2576	explorer.exe	schtasks.exe
PID 1976 wrote to memory of 1964	1976	taskeng.exe	regsvr32.exe
PID 1976 wrote to memory of 1964	1976	taskeng.exe	regsvr32.exe
PID 1976 wrote to memory of 1964	1976	taskeng.exe	regsvr32.exe
PID 1976 wrote to memory of 1964	1976	taskeng.exe	regsvr32.exe
PID 1976 wrote to memory of 1964	1976	taskeng.exe	regsvr32.exe
PID 1964 wrote to memory of 832	1964	regsvr32.exe	regsvr32.exe
PID 1964 wrote to memory of 832	1964	regsvr32.exe	regsvr32.exe
PID 1964 wrote to memory of 832	1964	regsvr32.exe	regsvr32.exe
PID 1964 wrote to memory of 832	1964	regsvr32.exe	regsvr32.exe
PID 1964 wrote to memory of 832	1964	regsvr32.exe	regsvr32.exe
PID 1964 wrote to memory of 832	1964	regsvr32.exe	regsvr32.exe
PID 1964 wrote to memory of 832	1964	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e194bc1c3f3ba138a2ab72e6f2df8e2a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2508

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e194bc1c3f3ba138a2ab72e6f2df8e2a_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2576

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kudlplfx /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\e194bc1c3f3ba138a2ab72e6f2df8e2a_JaffaCakes118.dll\"" /SC ONCE /Z /ST 09:42 /ET 09:54
4⤵
- Creates scheduled task(s)
PID:2964

C:\Windows\system32\taskeng.exe
taskeng.exe {7A68F05B-2729-432B-BB87-A74C83E8871B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\e194bc1c3f3ba138a2ab72e6f2df8e2a_JaffaCakes118.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\e194bc1c3f3ba138a2ab72e6f2df8e2a_JaffaCakes118.dll"
3⤵
- Loads dropped DLL
PID:832

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e194bc1c3f3ba138a2ab72e6f2df8e2a_JaffaCakes118.dll
Filesize
539KB

MD5
59cb5c6e583e87493f431f223c16d836

SHA1
05045f644563022ea8497dfc869fecc6139a9dda

SHA256
79a9adc315e0c156dc1ae29e9c6f28d2cb50ce25637eac6bb269d146619ce39e

SHA512
f95430612774f7cbf18ed8f0f78ece87e3c9652f8f27317508ff89ad56de060e86242c401049c4f26a5b3b1ea7e055ae9fbc68354c5b9102309306b417c97dc3

Download Submit
memory/1728-0-0x0000000074400000-0x00000000744A1000-memory.dmp

Filesize
644KB

Download
memory/1728-2-0x0000000074400000-0x00000000744A1000-memory.dmp

Filesize
644KB

Download
memory/1728-4-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1728-8-0x0000000074400000-0x00000000744A1000-memory.dmp

Filesize
644KB

Download
memory/2576-5-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/2576-7-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2576-10-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2576-11-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2576-12-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2576-14-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads