qakbot | 564827da0667de0cded3fbfc3cebf8deec5f27b2224d112006d7e8aa3991ca62

General

Target

899d41e22f178978c1d04af951ef1ee8_JaffaCakes118.dll
Size

398KB
MD5

899d41e22f178978c1d04af951ef1ee8
SHA1

908cf1b5e6311e41d1391890a217af7c82462949
SHA256

564827da0667de0cded3fbfc3cebf8deec5f27b2224d112006d7e8aa3991ca62
SHA512

099e61e5855ee93b2eca6f0d9bc23636123c4f86d3fd34777a24fdc2776b0875976c2b34f7f437b31926ffe154a3f59e2c4f5d78e77d16af24f8676674bc643e
SSDEEP

6144:l9ykYklEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesN23wU7HuAmHK+V:z2wr03pdf8vhhOKJET8Byq+V

Score

10^/10

qakbot biden01 1613656969 banker discovery stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

biden01

Campaign

1613656969

C2

172.87.157.235:3389

173.184.119.153:995

81.150.181.168:2222

71.187.170.235:443

197.45.110.165:995

86.160.137.132:443

86.236.77.68:2222

106.51.85.162:443

108.31.15.10:995

38.92.225.121:443

72.252.201.69:443

71.117.132.169:443

98.173.34.212:995

83.110.12.140:2222

95.77.223.148:443

41.39.134.183:443

85.52.72.32:2222

195.12.154.8:443

108.160.123.244:443

96.57.188.174:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2924 regsvr32.exe

pid	process
2924	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

regsvr32.exeexplorer.exeschtasks.exeregsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2860 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2332 regsvr32.exe
2332 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

2332 regsvr32.exe

pid	process
2860	schtasks.exe

pid	process
2332	regsvr32.exe
2332	regsvr32.exe

pid	process
2332	regsvr32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 2976 wrote to memory of 2332	2976	regsvr32.exe	regsvr32.exe
PID 2976 wrote to memory of 2332	2976	regsvr32.exe	regsvr32.exe
PID 2976 wrote to memory of 2332	2976	regsvr32.exe	regsvr32.exe
PID 2976 wrote to memory of 2332	2976	regsvr32.exe	regsvr32.exe
PID 2976 wrote to memory of 2332	2976	regsvr32.exe	regsvr32.exe
PID 2976 wrote to memory of 2332	2976	regsvr32.exe	regsvr32.exe
PID 2976 wrote to memory of 2332	2976	regsvr32.exe	regsvr32.exe
PID 2332 wrote to memory of 2336	2332	regsvr32.exe	explorer.exe
PID 2332 wrote to memory of 2336	2332	regsvr32.exe	explorer.exe
PID 2332 wrote to memory of 2336	2332	regsvr32.exe	explorer.exe
PID 2332 wrote to memory of 2336	2332	regsvr32.exe	explorer.exe
PID 2332 wrote to memory of 2336	2332	regsvr32.exe	explorer.exe
PID 2332 wrote to memory of 2336	2332	regsvr32.exe	explorer.exe
PID 2336 wrote to memory of 2860	2336	explorer.exe	schtasks.exe
PID 2336 wrote to memory of 2860	2336	explorer.exe	schtasks.exe
PID 2336 wrote to memory of 2860	2336	explorer.exe	schtasks.exe
PID 2336 wrote to memory of 2860	2336	explorer.exe	schtasks.exe
PID 2368 wrote to memory of 2592	2368	taskeng.exe	regsvr32.exe
PID 2368 wrote to memory of 2592	2368	taskeng.exe	regsvr32.exe
PID 2368 wrote to memory of 2592	2368	taskeng.exe	regsvr32.exe
PID 2368 wrote to memory of 2592	2368	taskeng.exe	regsvr32.exe
PID 2368 wrote to memory of 2592	2368	taskeng.exe	regsvr32.exe
PID 2592 wrote to memory of 2924	2592	regsvr32.exe	regsvr32.exe
PID 2592 wrote to memory of 2924	2592	regsvr32.exe	regsvr32.exe
PID 2592 wrote to memory of 2924	2592	regsvr32.exe	regsvr32.exe
PID 2592 wrote to memory of 2924	2592	regsvr32.exe	regsvr32.exe
PID 2592 wrote to memory of 2924	2592	regsvr32.exe	regsvr32.exe
PID 2592 wrote to memory of 2924	2592	regsvr32.exe	regsvr32.exe
PID 2592 wrote to memory of 2924	2592	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\899d41e22f178978c1d04af951ef1ee8_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\899d41e22f178978c1d04af951ef1ee8_JaffaCakes118.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wyyzkww /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\899d41e22f178978c1d04af951ef1ee8_JaffaCakes118.dll\"" /SC ONCE /Z /ST 08:05 /ET 08:17
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2860

C:\Windows\system32\taskeng.exe
taskeng.exe {F9B0805E-48E4-4269-9AF1-4332E1D5F02D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\899d41e22f178978c1d04af951ef1ee8_JaffaCakes118.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\899d41e22f178978c1d04af951ef1ee8_JaffaCakes118.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\899d41e22f178978c1d04af951ef1ee8_JaffaCakes118.dll

Filesize
398KB

MD5
90656a1ab5821d21f38cd9d597028da9

SHA1
2079b1e345494f280aae599aded7637dc3b3cd57

SHA256
d0c3375e911113e1a5483654e21cfde80009cd1638d585d41be28b8f4b83fae1

SHA512
ded34fa94ee769364230d9393a4ca52d7705aabe74e2d1fa5c54ebca7a45a6dfa891f7d92fae1c8a11f3c59f5eb9b94b0642306ed7e3cb75f68082bca489be4f

Download Submit
memory/2332-0-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download
memory/2332-2-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download
memory/2332-1-0x0000000000360000-0x00000000003C4000-memory.dmp

Filesize
400KB

Download
memory/2332-6-0x0000000000360000-0x00000000003C4000-memory.dmp

Filesize
400KB

Download
memory/2336-3-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/2336-7-0x00000000000D0000-0x0000000000105000-memory.dmp

Filesize
212KB

Download
memory/2336-8-0x00000000000D0000-0x0000000000105000-memory.dmp

Filesize
212KB

Download
memory/2336-10-0x00000000000D0000-0x0000000000105000-memory.dmp

Filesize
212KB

Download
memory/2336-9-0x00000000000D0000-0x0000000000105000-memory.dmp

Filesize
212KB

Download
memory/2336-11-0x00000000000D0000-0x0000000000105000-memory.dmp

Filesize
212KB

Download
memory/2336-12-0x00000000000D0000-0x0000000000105000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads