qakbot | 6bcb50b1401155c9af99c8e54dbcb88d3f742076a181fc6a08da283559858146

General

Target

5f4fa55001452036259a28d4ce2ce6a8_JaffaCakes118.dll
Size

484KB
MD5

5f4fa55001452036259a28d4ce2ce6a8
SHA1

d854e805bd41df6e6c816747c321b5e2f7a9a548
SHA256

6bcb50b1401155c9af99c8e54dbcb88d3f742076a181fc6a08da283559858146
SHA512

c75ae33674ed862081186edd23f32821aa80ce55195edfa312b30e56ce5da468efc65889e42a1faf2c7b5e762fafb7a2188aff0ed6d051073e9c9e17cae40a4c
SSDEEP

6144:bbqzVbbUYjG8AClk8+u05KhoSiMsJZuSsnDxeHakVqhhmaM+5Vg0nKH5PnFyunY:XqxgYjG8ACv+dKhpsJZRXH52LMcg5n

Score

10^/10

qakbot obama103 1632477754 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

obama103

Campaign

1632477754

C2

136.232.34.70:443

216.201.162.158:443

92.59.35.196:2222

105.198.236.99:443

185.250.148.74:443

73.77.87.137:443

196.218.227.241:995

103.148.120.144:443

120.150.218.241:995

47.22.148.6:443

140.82.49.12:443

71.74.12.34:443

27.223.92.142:995

76.25.142.196:443

95.77.223.148:443

75.188.35.168:443

96.37.113.36:993

173.21.10.71:2222

45.46.53.140:2222

73.151.236.31:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Baysy = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Zotsssi = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1756 regsvr32.exe

pid	process
1756	regsvr32.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozegfiu\cbf26f6d = 40b863151df5daad79150f428985155a58cced8a75c619ea38ec32e0416ef250dc2a13e443e6244d668e985e75349c39dd55ce7b6f88567d86d82f86edce094cd5483a21018c50b34ab14567b55562	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozegfiu\fe6dbf23 = d71be3b899db7c2401e96c66daf9cb6ea550c75c7614d6930944e2299805ec67a95facf40505ecdc3002615436ef86b1502f2872a2ffdc7e9543b2424b5e9bfa333bb4a3a1a38ff4a53db0c104951b7f80881968f98f45f92c278ab845e03d9628a12b7012a59b041e5269edf3ce5d21a59f8d9aef478a06e89757ef71d3813cf428716bd9e680e1fff82963c0c9fb5d02491a8ee92f71	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozegfiu\fc2c9f5f = 8db8e8da4a81aff6b1621c13fe601050c744ac8fa2095f0de0f0feeb8c2261a44b90fdbe693ee2a93afbdb0997a10c033a62	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozegfiu\cbf26f6d = 40b874151df5efccc3011aa46fc034d1bd26e655bebe8ada0fcc1284cf25ba8b75693a32c03b925e7a4d072700fcd7adea0e6999527b4dd38fc9644ba9baafc496a263aa22648e66af0bcc1b177a0e338bc0e8652b801288c493d3499bec82ab8f5bc092	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozegfiu\b4bb009b = 1180e128a23330728d0c2e2460ddc312dd06a7960bfde26defb2a6d8e0e385fff467f46741f4aa9a59868864f77e9124f88978d0683317a7	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozegfiu	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozegfiu\4490f83a = 749ea6f0eeb79cd7fc817c03e84667cd632ebac805c456e18500aa481ef15cdca201d19ce122c50743d2b40ea87194cd1067aba1dc2bc36c811aa8b1cc5243490b97a00db4abe8297ee7974332b21c373e016e47b0b2aea0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozegfiu\3998b7b0 = aac47337d9cdd7791ab78e4b601913bf63ae6d98001a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozegfiu\8124d0d5 = 29713e65366c82dd33343ff5e807c19c2d7a1746546c76663a36eaf446042f9c6f2b94657ffcf3357ef1b62b8fc04d959c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ozegfiu\46d1d846 = da72e050a1d8bfad0c36009af7800ea327fa7ebcd53a0a0204fb00b8b63d1677348e34ee44f8a2a14b3629212ca275	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2336 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1148 rundll32.exe
1756 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1148 rundll32.exe
1756 regsvr32.exe

pid	process
2336	schtasks.exe

pid	process
1148	rundll32.exe
1756	regsvr32.exe

pid	process
1148	rundll32.exe
1756	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 448 wrote to memory of 1148	448	rundll32.exe	rundll32.exe
PID 448 wrote to memory of 1148	448	rundll32.exe	rundll32.exe
PID 448 wrote to memory of 1148	448	rundll32.exe	rundll32.exe
PID 448 wrote to memory of 1148	448	rundll32.exe	rundll32.exe
PID 448 wrote to memory of 1148	448	rundll32.exe	rundll32.exe
PID 448 wrote to memory of 1148	448	rundll32.exe	rundll32.exe
PID 448 wrote to memory of 1148	448	rundll32.exe	rundll32.exe
PID 1148 wrote to memory of 2760	1148	rundll32.exe	explorer.exe
PID 1148 wrote to memory of 2760	1148	rundll32.exe	explorer.exe
PID 1148 wrote to memory of 2760	1148	rundll32.exe	explorer.exe
PID 1148 wrote to memory of 2760	1148	rundll32.exe	explorer.exe
PID 1148 wrote to memory of 2760	1148	rundll32.exe	explorer.exe
PID 1148 wrote to memory of 2760	1148	rundll32.exe	explorer.exe
PID 2760 wrote to memory of 2336	2760	explorer.exe	schtasks.exe
PID 2760 wrote to memory of 2336	2760	explorer.exe	schtasks.exe
PID 2760 wrote to memory of 2336	2760	explorer.exe	schtasks.exe
PID 2760 wrote to memory of 2336	2760	explorer.exe	schtasks.exe
PID 760 wrote to memory of 2968	760	taskeng.exe	regsvr32.exe
PID 760 wrote to memory of 2968	760	taskeng.exe	regsvr32.exe
PID 760 wrote to memory of 2968	760	taskeng.exe	regsvr32.exe
PID 760 wrote to memory of 2968	760	taskeng.exe	regsvr32.exe
PID 760 wrote to memory of 2968	760	taskeng.exe	regsvr32.exe
PID 2968 wrote to memory of 1756	2968	regsvr32.exe	regsvr32.exe
PID 2968 wrote to memory of 1756	2968	regsvr32.exe	regsvr32.exe
PID 2968 wrote to memory of 1756	2968	regsvr32.exe	regsvr32.exe
PID 2968 wrote to memory of 1756	2968	regsvr32.exe	regsvr32.exe
PID 2968 wrote to memory of 1756	2968	regsvr32.exe	regsvr32.exe
PID 2968 wrote to memory of 1756	2968	regsvr32.exe	regsvr32.exe
PID 2968 wrote to memory of 1756	2968	regsvr32.exe	regsvr32.exe
PID 1756 wrote to memory of 2108	1756	regsvr32.exe	explorer.exe
PID 1756 wrote to memory of 2108	1756	regsvr32.exe	explorer.exe
PID 1756 wrote to memory of 2108	1756	regsvr32.exe	explorer.exe
PID 1756 wrote to memory of 2108	1756	regsvr32.exe	explorer.exe
PID 1756 wrote to memory of 2108	1756	regsvr32.exe	explorer.exe
PID 1756 wrote to memory of 2108	1756	regsvr32.exe	explorer.exe
PID 2108 wrote to memory of 2044	2108	explorer.exe	reg.exe
PID 2108 wrote to memory of 2044	2108	explorer.exe	reg.exe
PID 2108 wrote to memory of 2044	2108	explorer.exe	reg.exe
PID 2108 wrote to memory of 2044	2108	explorer.exe	reg.exe
PID 2108 wrote to memory of 2068	2108	explorer.exe	reg.exe
PID 2108 wrote to memory of 2068	2108	explorer.exe	reg.exe
PID 2108 wrote to memory of 2068	2108	explorer.exe	reg.exe
PID 2108 wrote to memory of 2068	2108	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f4fa55001452036259a28d4ce2ce6a8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:448

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f4fa55001452036259a28d4ce2ce6a8_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn sxpvgbw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\5f4fa55001452036259a28d4ce2ce6a8_JaffaCakes118.dll\"" /SC ONCE /Z /ST 06:08 /ET 06:20
4⤵
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\taskeng.exe
taskeng.exe {E5136483-BB1C-4A6E-AB16-B9988CA199E6} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\5f4fa55001452036259a28d4ce2ce6a8_JaffaCakes118.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:2968

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\5f4fa55001452036259a28d4ce2ce6a8_JaffaCakes118.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Baysy" /d "0"
5⤵
- Windows security bypass
PID:2044

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Zotsssi" /d "0"
5⤵
- Windows security bypass
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5f4fa55001452036259a28d4ce2ce6a8_JaffaCakes118.dll

Filesize
484KB

MD5
5f4fa55001452036259a28d4ce2ce6a8

SHA1
d854e805bd41df6e6c816747c321b5e2f7a9a548

SHA256
6bcb50b1401155c9af99c8e54dbcb88d3f742076a181fc6a08da283559858146

SHA512
c75ae33674ed862081186edd23f32821aa80ce55195edfa312b30e56ce5da468efc65889e42a1faf2c7b5e762fafb7a2188aff0ed6d051073e9c9e17cae40a4c

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1148-9-0x0000000010000000-0x0000000010119000-memory.dmp

Filesize
1.1MB

Download
memory/1148-5-0x0000000010000000-0x0000000010119000-memory.dmp

Filesize
1.1MB

Download
memory/1148-0-0x0000000010000000-0x0000000010119000-memory.dmp

Filesize
1.1MB

Download
memory/1148-4-0x0000000010077000-0x000000001007D000-memory.dmp

Filesize
24KB

Download
memory/1148-1-0x0000000010000000-0x0000000010119000-memory.dmp

Filesize
1.1MB

Download
memory/1756-21-0x0000000010000000-0x0000000010119000-memory.dmp

Filesize
1.1MB

Download
memory/1756-26-0x0000000010000000-0x0000000010119000-memory.dmp

Filesize
1.1MB

Download
memory/1756-22-0x0000000010000000-0x0000000010119000-memory.dmp

Filesize
1.1MB

Download
memory/2108-30-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2108-29-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2108-28-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2760-8-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2760-16-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2760-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2760-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2760-14-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2760-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2760-6-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads