qakbot | 6bcb50b1401155c9af99c8e54dbcb88d3f742076a181fc6a08da283559858146

General

Target

5f4fa55001452036259a28d4ce2ce6a8_JaffaCakes118.dll
Size

484KB
MD5

5f4fa55001452036259a28d4ce2ce6a8
SHA1

d854e805bd41df6e6c816747c321b5e2f7a9a548
SHA256

6bcb50b1401155c9af99c8e54dbcb88d3f742076a181fc6a08da283559858146
SHA512

c75ae33674ed862081186edd23f32821aa80ce55195edfa312b30e56ce5da468efc65889e42a1faf2c7b5e762fafb7a2188aff0ed6d051073e9c9e17cae40a4c
SSDEEP

6144:bbqzVbbUYjG8AClk8+u05KhoSiMsJZuSsnDxeHakVqhhmaM+5Vg0nKH5PnFyunY:XqxgYjG8ACv+dKhpsJZRXH52LMcg5n

Score

10^/10

qakbot obama103 1632477754 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

obama103

Campaign

1632477754

C2

136.232.34.70:443

216.201.162.158:443

92.59.35.196:2222

105.198.236.99:443

185.250.148.74:443

73.77.87.137:443

196.218.227.241:995

103.148.120.144:443

120.150.218.241:995

47.22.148.6:443

140.82.49.12:443

71.74.12.34:443

27.223.92.142:995

76.25.142.196:443

95.77.223.148:443

75.188.35.168:443

96.37.113.36:993

173.21.10.71:2222

45.46.53.140:2222

73.151.236.31:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Kroramyhw = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Bpayhyaavb = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3864 regsvr32.exe

pid	process
3864	regsvr32.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Csuolrq\c6537b53 = f51044e41c94a90c2a2afb7efa44fc5adeca3beaf98a9ffdade8a979f61074e538c6b61d474388d6dd8e8ef8bca2e4cbbbff0666f92cf3493ebfd65f2bd16ab0bf992e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Csuolrq\1a673c0 = d24bcbff06791aa996e9accf229f1f8354c4c10ad219e37b1c45f47dba4688c4eaaf1b03a503510a4f08ccfc542d09f9d1d8c4d628b53ba4aa6da71b0a0f1c304cc8400eadb8d8cf43155b466d808280629786e87c490983a0cf0c2c7e3bd18f38ab966392ae62e7883c2095bffdca2700f1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Csuolrq\8c85c4eb = fb9494986de01cbad6dac99ccd718921bf290a0066863efd6466e8ff1beb45626ba69c30e031ebae9e38f6637f896e54021abff3d7d65b31f4f1ccbc6a0219c5cb8923bbdadfda4084186786de363c91ffb04cb7d611573fd8aa5a3a7d294ee499	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Csuolrq\b91a14a5 = ea16a366c3cfbbf393c72edf2820e06aa5959ece3e87b2f0ceaaed0270181b0b3f3841cf1c1a2607917c5ae6155796e72824cc2fcbfd6569b61100db2299a00a63401b771e7533cc63001de82684acad1d43024f4e6526a22d6a825ab5819cb5193a04e61ceb3a468e6bf8eedecd02ed38709714271552b20d5cac3271b270e2f1cfee90c9e604e5b2d074c25ece68c6484a498753b7cc6f869cb18d4697bdc2da3c55604476c4e08f00677c308928e284ae8144654409be202ae46b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Csuolrq\3e753bc = ae9bb823a5686692cb94fe8a9067c17892f746f0f047579dc9b39cde7ea4a47a4be181d1a52f59e71c617989afea0d3608a884288e39a5a5f4766b51e63bafe7ae4e5de1a63f0b3808ed888528c63c46f8031bedb02be15af3012356192b6d36d5b7bc97	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Csuolrq\7eef1c36 = 29254a4a8daebb5db42862cf3d5802131b140270f877d14a3a441feff026593a9da0bc394fef4dd1880ef5c871c32311ecd1541ccd4297a4910b929f3c32178c432b2a9ab910b0603e58f5685d64be4a286c5c6fde31557fa79083a93354b870	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Csuolrq	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Csuolrq\bb5b34d9 = 5e82c15646f99b903f9bc23c2a4fb78bbe05	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Csuolrq\f3ccab1d = f061663de6bce329b63e8950392c041e034eefd8ce05040aee726dcdd766a7d27a31442de3919015bc46a97a0b7093d156ac6fe7dbc42e4e6f90ae521712dff957a40e93f3eea905fe7f333e117b98ee8c7416b51622691d9598bcdb65b64e2fb119914227d812fbb1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Csuolrq\8c85c4eb = fb9483986de0299ee212bee107ef98d3bd5e188de3edac0abeef72321f8864fd577a58c250b2c23e5ed67b0f5d86f093bd8740e2e1446d3634bea6ff22bae234c3e270ffe099aa956155f531a3e68a42ab4868fc9c9bfe91d1f5d82a91a82cc0ce4a9c02f85034d20182e59a9abcbad506c07c1f9e20	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2284 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3032 rundll32.exe
3032 rundll32.exe
3864 regsvr32.exe
3864 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3032 rundll32.exe
3864 regsvr32.exe

pid	process
2284	schtasks.exe

pid	process
3032	rundll32.exe
3032	rundll32.exe
3864	regsvr32.exe
3864	regsvr32.exe

pid	process
3032	rundll32.exe
3864	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2992 wrote to memory of 3032	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 3032	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 3032	2992	rundll32.exe	rundll32.exe
PID 3032 wrote to memory of 2292	3032	rundll32.exe	explorer.exe
PID 3032 wrote to memory of 2292	3032	rundll32.exe	explorer.exe
PID 3032 wrote to memory of 2292	3032	rundll32.exe	explorer.exe
PID 3032 wrote to memory of 2292	3032	rundll32.exe	explorer.exe
PID 3032 wrote to memory of 2292	3032	rundll32.exe	explorer.exe
PID 2292 wrote to memory of 2284	2292	explorer.exe	schtasks.exe
PID 2292 wrote to memory of 2284	2292	explorer.exe	schtasks.exe
PID 2292 wrote to memory of 2284	2292	explorer.exe	schtasks.exe
PID 4480 wrote to memory of 3864	4480	regsvr32.exe	regsvr32.exe
PID 4480 wrote to memory of 3864	4480	regsvr32.exe	regsvr32.exe
PID 4480 wrote to memory of 3864	4480	regsvr32.exe	regsvr32.exe
PID 3864 wrote to memory of 2204	3864	regsvr32.exe	explorer.exe
PID 3864 wrote to memory of 2204	3864	regsvr32.exe	explorer.exe
PID 3864 wrote to memory of 2204	3864	regsvr32.exe	explorer.exe
PID 3864 wrote to memory of 2204	3864	regsvr32.exe	explorer.exe
PID 3864 wrote to memory of 2204	3864	regsvr32.exe	explorer.exe
PID 2204 wrote to memory of 1820	2204	explorer.exe	reg.exe
PID 2204 wrote to memory of 1820	2204	explorer.exe	reg.exe
PID 2204 wrote to memory of 4372	2204	explorer.exe	reg.exe
PID 2204 wrote to memory of 4372	2204	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f4fa55001452036259a28d4ce2ce6a8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f4fa55001452036259a28d4ce2ce6a8_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2292

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ckmjydal /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\5f4fa55001452036259a28d4ce2ce6a8_JaffaCakes118.dll\"" /SC ONCE /Z /ST 06:08 /ET 06:20
4⤵
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\5f4fa55001452036259a28d4ce2ce6a8_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4480

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\5f4fa55001452036259a28d4ce2ce6a8_JaffaCakes118.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3864

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2204

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Kroramyhw" /d "0"
4⤵
- Windows security bypass
PID:1820

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Bpayhyaavb" /d "0"
4⤵
- Windows security bypass
PID:4372

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5f4fa55001452036259a28d4ce2ce6a8_JaffaCakes118.dll
Filesize
484KB

MD5
5f4fa55001452036259a28d4ce2ce6a8

SHA1
d854e805bd41df6e6c816747c321b5e2f7a9a548

SHA256
6bcb50b1401155c9af99c8e54dbcb88d3f742076a181fc6a08da283559858146

SHA512
c75ae33674ed862081186edd23f32821aa80ce55195edfa312b30e56ce5da468efc65889e42a1faf2c7b5e762fafb7a2188aff0ed6d051073e9c9e17cae40a4c

Download Submit
memory/2204-25-0x0000000001530000-0x0000000001551000-memory.dmp

Filesize
132KB

Download
memory/2204-24-0x0000000001530000-0x0000000001551000-memory.dmp

Filesize
132KB

Download
memory/2204-23-0x0000000001530000-0x0000000001551000-memory.dmp

Filesize
132KB

Download
memory/2292-10-0x00000000008F0000-0x0000000000911000-memory.dmp

Filesize
132KB

Download
memory/2292-12-0x00000000008F0000-0x0000000000911000-memory.dmp

Filesize
132KB

Download
memory/2292-11-0x00000000008F0000-0x0000000000911000-memory.dmp

Filesize
132KB

Download
memory/2292-14-0x00000000008F0000-0x0000000000911000-memory.dmp

Filesize
132KB

Download
memory/2292-5-0x00000000008F0000-0x0000000000911000-memory.dmp

Filesize
132KB

Download
memory/3032-7-0x0000000010000000-0x0000000010119000-memory.dmp

Filesize
1.1MB

Download
memory/3032-1-0x0000000010077000-0x000000001007D000-memory.dmp

Filesize
24KB

Download
memory/3032-3-0x0000000010000000-0x0000000010119000-memory.dmp

Filesize
1.1MB

Download
memory/3032-0-0x0000000010000000-0x0000000010119000-memory.dmp

Filesize
1.1MB

Download
memory/3032-2-0x0000000010000000-0x0000000010119000-memory.dmp

Filesize
1.1MB

Download
memory/3864-18-0x0000000010000000-0x0000000010119000-memory.dmp

Filesize
1.1MB

Download
memory/3864-19-0x0000000010000000-0x0000000010119000-memory.dmp

Filesize
1.1MB

Download
memory/3864-21-0x0000000010000000-0x0000000010119000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads