qakbot | 414e40d3c075919c25fdba9c3bc914227700f398d42dd5a3bb84d92d0a5e3351

General

Target

1f1b5e4487d71fd77319ac1fa5fbacb5_JaffaCakes118.dll
Size

708KB
MD5

1f1b5e4487d71fd77319ac1fa5fbacb5
SHA1

524d2dc30a395ce85cf02c294df995af8aeba5e3
SHA256

414e40d3c075919c25fdba9c3bc914227700f398d42dd5a3bb84d92d0a5e3351
SHA512

74d1c7fbdac0a2550b603712a9d80860251534c5022af365fc5a70583a4b7b58dec5781cdbe7b08b5da0e049b2137b387be7b6140d37a514d85f59957840686a
SSDEEP

12288:AFbAcis08s7gQFMWC24/MFS+AWmdnWJIjJ5F3+DpEFs3H6v/+VoTN1:AtDis0dFA24/MFSptIJKnx+NE23a3+VY

Score

10^/10

qakbot obama106 1632905607 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama106

Campaign

1632905607

C2

37.210.152.224:995

120.151.47.189:443

105.198.236.99:443

122.11.220.212:2222

199.27.127.129:443

41.251.41.14:995

216.201.162.158:443

124.123.42.115:2078

181.118.183.94:443

120.150.218.241:995

185.250.148.74:443

217.17.56.163:443

182.181.78.18:995

140.82.49.12:443

105.159.144.186:995

89.101.97.139:443

217.17.56.163:0

27.223.92.142:995

95.77.223.148:443

109.190.253.11:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Zkexibkn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Jvkxda = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2184 regsvr32.exe

pid	process
2184	regsvr32.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzioebuittcaxu\d2fcb725 = b66c71f3563b25e54a3929422ef219aca19cf044412c53f9231cf35b4c25f7071ada8877ed1eeff6dbc8222a03fe65e7cd23f04087a4e781f51e480d4808428f5a8c75538ea2bb3b1c6a50bb87cc591b7474e849c314da3f4629274afd01fe91413dd6b8bf5ebd47dccca8abb150a3	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gzioebuittcaxu	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzioebuittcaxu\d2fcb725 = b66c66f3563b10a03617562995e910891332ad9eb0f8289e5e96e570cd86b6013acd307d770f0946e8004f510316457d0d93eba8565eb10645b204dcb20d722a343aff7dd41995bfd098bcc1bdefb883b98b0a208e1c1bc01b45	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzioebuittcaxu\5d9e2072 = 1aa61dda92275671c9faf2aca39cfc79550dcaa1dfda57e42625641f3e8d783689397401a805229b05736e8291d19c09d669aa3199004753fc0053d9b5acfe09bb941cf7592a7406004f0fe5a5dea5ad22f15c90115b09e0819663692f810d32a94c93a430f4e5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzioebuittcaxu\20966ff8 = c5a96309d104d834defba9940ec8e6c7c6e02505ad2ba24b987b055ea636dd9720796979f9720418b2ff282270899d8b16d2b105ca68ea79ea967c6e84d4821927	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzioebuittcaxu\adb5d8d3 = 485551e8c54eaed556fcaade3f843957da08721f2a9f7e39305ca3f82fac1a7b164e756168e91bf9e625efc5ae60062c3e72163dd384a4820d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzioebuittcaxu\e763676b = d0c405ea7bee7fa3526191866380df1f2f718f3dcaec700fbe5dd36329ac82d3f117a53d460b5e9167b2a2fad47389a141138e2bcf81a5d9dee51980761571de712b2c1d6a2eeb87dc5a4bbeeb502e8b3038d435cd21aeae9684313a2532e4cb2c906aab23b185b41f0a186128d6cb96c7befd52d1e6eed8c5131e14b6d87ad98dd7a6bb8110b14712dbd61d666635b0b8bfa8429b284ac7a835118f7cfbc0912539977d4ab05340a1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzioebuittcaxu\e5224717 = e0eceb5ee724a5f8cf5225666aadb6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzioebuittcaxu\982a089d = 8baa33b080139d66dfa2d8f4ffa978faffaf96af8c73cb8c8565c2489f0082c18c0392b216340d73d458062abcb4c86e84f4042fdcc618428b1c134c90770aa619652a13c3e38f174b5a95781278dcb57391	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gzioebuittcaxu\5fdf000e = c86e0f14686a32d012c7ae07d24141747c91da840e57783dc587bde5ea	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3032 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1540 rundll32.exe
2184 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1540 rundll32.exe
2184 regsvr32.exe

pid	process
3032	schtasks.exe

pid	process
1540	rundll32.exe
2184	regsvr32.exe

pid	process
1540	rundll32.exe
2184	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2140 wrote to memory of 1540	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 1540	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 1540	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 1540	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 1540	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 1540	2140	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 1540	2140	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 2752	1540	rundll32.exe	explorer.exe
PID 1540 wrote to memory of 2752	1540	rundll32.exe	explorer.exe
PID 1540 wrote to memory of 2752	1540	rundll32.exe	explorer.exe
PID 1540 wrote to memory of 2752	1540	rundll32.exe	explorer.exe
PID 1540 wrote to memory of 2752	1540	rundll32.exe	explorer.exe
PID 1540 wrote to memory of 2752	1540	rundll32.exe	explorer.exe
PID 2752 wrote to memory of 3032	2752	explorer.exe	schtasks.exe
PID 2752 wrote to memory of 3032	2752	explorer.exe	schtasks.exe
PID 2752 wrote to memory of 3032	2752	explorer.exe	schtasks.exe
PID 2752 wrote to memory of 3032	2752	explorer.exe	schtasks.exe
PID 752 wrote to memory of 1428	752	taskeng.exe	regsvr32.exe
PID 752 wrote to memory of 1428	752	taskeng.exe	regsvr32.exe
PID 752 wrote to memory of 1428	752	taskeng.exe	regsvr32.exe
PID 752 wrote to memory of 1428	752	taskeng.exe	regsvr32.exe
PID 752 wrote to memory of 1428	752	taskeng.exe	regsvr32.exe
PID 1428 wrote to memory of 2184	1428	regsvr32.exe	regsvr32.exe
PID 1428 wrote to memory of 2184	1428	regsvr32.exe	regsvr32.exe
PID 1428 wrote to memory of 2184	1428	regsvr32.exe	regsvr32.exe
PID 1428 wrote to memory of 2184	1428	regsvr32.exe	regsvr32.exe
PID 1428 wrote to memory of 2184	1428	regsvr32.exe	regsvr32.exe
PID 1428 wrote to memory of 2184	1428	regsvr32.exe	regsvr32.exe
PID 1428 wrote to memory of 2184	1428	regsvr32.exe	regsvr32.exe
PID 2184 wrote to memory of 1796	2184	regsvr32.exe	explorer.exe
PID 2184 wrote to memory of 1796	2184	regsvr32.exe	explorer.exe
PID 2184 wrote to memory of 1796	2184	regsvr32.exe	explorer.exe
PID 2184 wrote to memory of 1796	2184	regsvr32.exe	explorer.exe
PID 2184 wrote to memory of 1796	2184	regsvr32.exe	explorer.exe
PID 2184 wrote to memory of 1796	2184	regsvr32.exe	explorer.exe
PID 1796 wrote to memory of 1584	1796	explorer.exe	reg.exe
PID 1796 wrote to memory of 1584	1796	explorer.exe	reg.exe
PID 1796 wrote to memory of 1584	1796	explorer.exe	reg.exe
PID 1796 wrote to memory of 1584	1796	explorer.exe	reg.exe
PID 1796 wrote to memory of 2384	1796	explorer.exe	reg.exe
PID 1796 wrote to memory of 2384	1796	explorer.exe	reg.exe
PID 1796 wrote to memory of 2384	1796	explorer.exe	reg.exe
PID 1796 wrote to memory of 2384	1796	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f1b5e4487d71fd77319ac1fa5fbacb5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f1b5e4487d71fd77319ac1fa5fbacb5_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2752

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rqavide /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\1f1b5e4487d71fd77319ac1fa5fbacb5_JaffaCakes118.dll\"" /SC ONCE /Z /ST 11:12 /ET 11:24
4⤵
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\taskeng.exe
taskeng.exe {353F5972-6F00-4FE0-AE7C-447440AA01C7} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\1f1b5e4487d71fd77319ac1fa5fbacb5_JaffaCakes118.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\1f1b5e4487d71fd77319ac1fa5fbacb5_JaffaCakes118.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Zkexibkn" /d "0"
5⤵
- Windows security bypass
PID:1584

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Jvkxda" /d "0"
5⤵
- Windows security bypass
PID:2384

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1f1b5e4487d71fd77319ac1fa5fbacb5_JaffaCakes118.dll
Filesize
708KB

MD5
1f1b5e4487d71fd77319ac1fa5fbacb5

SHA1
524d2dc30a395ce85cf02c294df995af8aeba5e3

SHA256
414e40d3c075919c25fdba9c3bc914227700f398d42dd5a3bb84d92d0a5e3351

SHA512
74d1c7fbdac0a2550b603712a9d80860251534c5022af365fc5a70583a4b7b58dec5781cdbe7b08b5da0e049b2137b387be7b6140d37a514d85f59957840686a

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1540-7-0x0000000074EC0000-0x0000000074F8A000-memory.dmp

Filesize
808KB

Download
memory/1540-3-0x0000000074F71000-0x0000000074F77000-memory.dmp

Filesize
24KB

Download
memory/1540-0-0x0000000074EC0000-0x0000000074F8A000-memory.dmp

Filesize
808KB

Download
memory/1540-4-0x0000000074EC0000-0x0000000074F8A000-memory.dmp

Filesize
808KB

Download
memory/1540-1-0x0000000074EC0000-0x0000000074F8A000-memory.dmp

Filesize
808KB

Download
memory/1796-27-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1796-28-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1796-26-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2184-19-0x00000000745D0000-0x000000007469A000-memory.dmp

Filesize
808KB

Download
memory/2184-24-0x00000000745D0000-0x000000007469A000-memory.dmp

Filesize
808KB

Download
memory/2184-20-0x00000000745D0000-0x000000007469A000-memory.dmp

Filesize
808KB

Download
memory/2752-6-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2752-14-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2752-13-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2752-11-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2752-12-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2752-10-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2752-5-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads