qakbot | 0dfa8d04fff81c0abaa91bdd60203a22606be027365967383f3a75cc1fb65c96

General

Target

5906b211144bb691aba80030e1aeebc5_JaffaCakes118.dll
Size

957KB
MD5

5906b211144bb691aba80030e1aeebc5
SHA1

1912a17b81527a4703093e95e3985780ae73f01d
SHA256

0dfa8d04fff81c0abaa91bdd60203a22606be027365967383f3a75cc1fb65c96
SHA512

ae16d01e5abbc1a609141ea27fc7fdc9bce8bb8e05be714ad1d30eb67c48b69f7144e44c26fa0c2c8964a2f08edc64b655dd25ac1cad2f00f3c05c329c4c7656
SSDEEP

24576:ixvBJCYfTVuEw7wJarOIq0PqJtp050YjpovM:iolEJtWyYqvM

Score

10^/10

qakbot tr 1613385567 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

tr

Campaign

1613385567

C2

78.63.226.32:443

197.51.82.72:443

193.248.221.184:2222

95.77.223.148:443

71.199.192.62:443

77.211.30.202:995

80.227.5.69:443

77.27.204.204:995

81.97.154.100:443

173.184.119.153:995

38.92.225.121:443

81.150.181.168:2222

90.65.236.181:2222

83.110.103.152:443

73.153.211.227:443

188.25.63.105:443

89.137.211.239:995

202.188.138.162:443

98.173.34.212:995

87.202.87.210:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2116 regsvr32.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2808 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2208 rundll32.exe
2208 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2208 rundll32.exe

pid	process
2116	regsvr32.exe

pid	process
2808	schtasks.exe

pid	process
2208	rundll32.exe
2208	rundll32.exe

pid	process
2208	rundll32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 2336 wrote to memory of 2208	2336	rundll32.exe	rundll32.exe
PID 2336 wrote to memory of 2208	2336	rundll32.exe	rundll32.exe
PID 2336 wrote to memory of 2208	2336	rundll32.exe	rundll32.exe
PID 2336 wrote to memory of 2208	2336	rundll32.exe	rundll32.exe
PID 2336 wrote to memory of 2208	2336	rundll32.exe	rundll32.exe
PID 2336 wrote to memory of 2208	2336	rundll32.exe	rundll32.exe
PID 2336 wrote to memory of 2208	2336	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 2236	2208	rundll32.exe	explorer.exe
PID 2208 wrote to memory of 2236	2208	rundll32.exe	explorer.exe
PID 2208 wrote to memory of 2236	2208	rundll32.exe	explorer.exe
PID 2208 wrote to memory of 2236	2208	rundll32.exe	explorer.exe
PID 2208 wrote to memory of 2236	2208	rundll32.exe	explorer.exe
PID 2208 wrote to memory of 2236	2208	rundll32.exe	explorer.exe
PID 2236 wrote to memory of 2808	2236	explorer.exe	schtasks.exe
PID 2236 wrote to memory of 2808	2236	explorer.exe	schtasks.exe
PID 2236 wrote to memory of 2808	2236	explorer.exe	schtasks.exe
PID 2236 wrote to memory of 2808	2236	explorer.exe	schtasks.exe
PID 1664 wrote to memory of 1820	1664	taskeng.exe	regsvr32.exe
PID 1664 wrote to memory of 1820	1664	taskeng.exe	regsvr32.exe
PID 1664 wrote to memory of 1820	1664	taskeng.exe	regsvr32.exe
PID 1664 wrote to memory of 1820	1664	taskeng.exe	regsvr32.exe
PID 1664 wrote to memory of 1820	1664	taskeng.exe	regsvr32.exe
PID 1820 wrote to memory of 2116	1820	regsvr32.exe	regsvr32.exe
PID 1820 wrote to memory of 2116	1820	regsvr32.exe	regsvr32.exe
PID 1820 wrote to memory of 2116	1820	regsvr32.exe	regsvr32.exe
PID 1820 wrote to memory of 2116	1820	regsvr32.exe	regsvr32.exe
PID 1820 wrote to memory of 2116	1820	regsvr32.exe	regsvr32.exe
PID 1820 wrote to memory of 2116	1820	regsvr32.exe	regsvr32.exe
PID 1820 wrote to memory of 2116	1820	regsvr32.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5906b211144bb691aba80030e1aeebc5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5906b211144bb691aba80030e1aeebc5_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zkmvftqn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\5906b211144bb691aba80030e1aeebc5_JaffaCakes118.dll\"" /SC ONCE /Z /ST 20:56 /ET 21:08
4⤵
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\taskeng.exe
taskeng.exe {0A4FF1AE-AC91-4755-BDA8-84E3C084A3C1} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\5906b211144bb691aba80030e1aeebc5_JaffaCakes118.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\5906b211144bb691aba80030e1aeebc5_JaffaCakes118.dll"
3⤵
- Loads dropped DLL
PID:2116

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5906b211144bb691aba80030e1aeebc5_JaffaCakes118.dll
Filesize
957KB

MD5
0e61d00ba5cd59a176825d4d5b60a7d8

SHA1
8ef31644a1f5106c140e00181456e1508d4a8fe5

SHA256
c2043b2457263ee6fc04b0b9845721343290b03021f51153d23ab71e62fa0d28

SHA512
afcb8eca52ca7e7f0ffba0f94d910f774a20d8e7eee8374b0e09a3fe5c613f92ff40583d97cb96b2139d08d63d8e4a0c0c7d567441d252cdd560047ee0716127

Download Submit
memory/2208-1-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2208-2-0x00000000001E0000-0x0000000000213000-memory.dmp

Filesize
204KB

Download
memory/2208-3-0x00000000007E0000-0x0000000000815000-memory.dmp

Filesize
212KB

Download
memory/2208-5-0x00000000007E0000-0x0000000000815000-memory.dmp

Filesize
212KB

Download
memory/2208-4-0x00000000007E0000-0x0000000000815000-memory.dmp

Filesize
212KB

Download
memory/2208-0-0x0000000000340000-0x0000000000431000-memory.dmp

Filesize
964KB

Download
memory/2208-9-0x00000000007E0000-0x0000000000815000-memory.dmp

Filesize
212KB

Download
memory/2208-8-0x0000000000340000-0x0000000000431000-memory.dmp

Filesize
964KB

Download
memory/2236-6-0x0000000000100000-0x0000000000102000-memory.dmp

Filesize
8KB

Download
memory/2236-12-0x00000000000C0000-0x00000000000F5000-memory.dmp

Filesize
212KB

Download
memory/2236-13-0x00000000000C0000-0x00000000000F5000-memory.dmp

Filesize
212KB

Download
memory/2236-14-0x00000000000C0000-0x00000000000F5000-memory.dmp

Filesize
212KB

Download
memory/2236-15-0x00000000000C0000-0x00000000000F5000-memory.dmp

Filesize
212KB

Download
memory/2236-11-0x00000000007E0000-0x0000000000A61000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads