qakbot | 748f51c10cfa4ca818b1528dce17e6bb4f866a9bfd498af72fa68ed9f28be554

General

Target

4b136db6cbe7cf8f3f046ed8a71dea55_JaffaCakes118.dll
Size

843KB
MD5

4b136db6cbe7cf8f3f046ed8a71dea55
SHA1

b7489a92ceefddfbc7f79a9c6345989e4a481877
SHA256

748f51c10cfa4ca818b1528dce17e6bb4f866a9bfd498af72fa68ed9f28be554
SHA512

9472e3534f61322ea24592d43d5c242284903f380141d7320439f5879ca5fe6f45243d505cd5dc74a07dc03fb1495f31ab1f73be35c9f6755e77e99b5ddca4ad
SSDEEP

12288:+ahjP5R/1Pw+p83iHDqQyykPfZhpHUmBvj0KML8tf8j:+aLRNPPp83ijGLddU

Score

10^/10

qakbot tr 1613385567 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

tr

Campaign

1613385567

C2

78.63.226.32:443

197.51.82.72:443

193.248.221.184:2222

95.77.223.148:443

71.199.192.62:443

77.211.30.202:995

80.227.5.69:443

77.27.204.204:995

81.97.154.100:443

173.184.119.153:995

38.92.225.121:443

81.150.181.168:2222

90.65.236.181:2222

83.110.103.152:443

73.153.211.227:443

188.25.63.105:443

89.137.211.239:995

202.188.138.162:443

98.173.34.212:995

87.202.87.210:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3292 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4548 3292 WerFault.exe regsvr32.exe

pid	process
3292	regsvr32.exe

pid	pid_target	process	target process
4548	3292	WerFault.exe	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	regsvr32.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3140 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exe

pid process

2092 regsvr32.exe
2092 regsvr32.exe
2092 regsvr32.exe
2092 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

2092 regsvr32.exe

pid	process
3140	schtasks.exe

pid	process
2092	regsvr32.exe
2092	regsvr32.exe
2092	regsvr32.exe
2092	regsvr32.exe

pid	process
2092	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 1708 wrote to memory of 2092	1708	regsvr32.exe	regsvr32.exe
PID 1708 wrote to memory of 2092	1708	regsvr32.exe	regsvr32.exe
PID 1708 wrote to memory of 2092	1708	regsvr32.exe	regsvr32.exe
PID 2092 wrote to memory of 4840	2092	regsvr32.exe	explorer.exe
PID 2092 wrote to memory of 4840	2092	regsvr32.exe	explorer.exe
PID 2092 wrote to memory of 4840	2092	regsvr32.exe	explorer.exe
PID 2092 wrote to memory of 4840	2092	regsvr32.exe	explorer.exe
PID 2092 wrote to memory of 4840	2092	regsvr32.exe	explorer.exe
PID 4840 wrote to memory of 3140	4840	explorer.exe	schtasks.exe
PID 4840 wrote to memory of 3140	4840	explorer.exe	schtasks.exe
PID 4840 wrote to memory of 3140	4840	explorer.exe	schtasks.exe
PID 1220 wrote to memory of 3292	1220	regsvr32.exe	regsvr32.exe
PID 1220 wrote to memory of 3292	1220	regsvr32.exe	regsvr32.exe
PID 1220 wrote to memory of 3292	1220	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4b136db6cbe7cf8f3f046ed8a71dea55_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4b136db6cbe7cf8f3f046ed8a71dea55_JaffaCakes118.dll
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn imvwrogzp /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\4b136db6cbe7cf8f3f046ed8a71dea55_JaffaCakes118.dll\"" /SC ONCE /Z /ST 19:28 /ET 19:40
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3140

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\4b136db6cbe7cf8f3f046ed8a71dea55_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\4b136db6cbe7cf8f3f046ed8a71dea55_JaffaCakes118.dll"
  2⤵
  - Loads dropped DLL
  PID:3292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 584
    3⤵
    - Program crash
    PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3292 -ip 3292
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4b136db6cbe7cf8f3f046ed8a71dea55_JaffaCakes118.dll

Filesize
843KB

MD5
7b5c302aabdf4d449cf5814b6120fca5

SHA1
9a2438572b87062e460a2dd083e150ea7480600d

SHA256
6ee8150dc8c9041b079d1c84e3a30e692a4f4c47ce04763360d75ffb63719bb0

SHA512
7336e754ca98767b19085513aea7f4b00cfef797e1cecf3742c192cf6bf3ad7964b8cb7889ae06a30b1862e6aef82bcbbe81c98f6584f994fe6ed9cf7913c5df

Download Submit
memory/2092-0-0x0000000000409000-0x000000000040A000-memory.dmp

Filesize
4KB

Download
memory/2092-1-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2092-2-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4840-3-0x0000000001370000-0x00000000013A5000-memory.dmp

Filesize
212KB

Download
memory/4840-5-0x0000000001370000-0x00000000013A5000-memory.dmp

Filesize
212KB

Download
memory/4840-7-0x0000000001370000-0x00000000013A5000-memory.dmp

Filesize
212KB

Download
memory/4840-6-0x0000000001370000-0x00000000013A5000-memory.dmp

Filesize
212KB

Download
memory/4840-9-0x0000000001370000-0x00000000013A5000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads