qakbot | 564827da0667de0cded3fbfc3cebf8deec5f27b2224d112006d7e8aa3991ca62

General

Target

899d41e22f178978c1d04af951ef1ee8_JaffaCakes118.dll
Size

398KB
MD5

899d41e22f178978c1d04af951ef1ee8
SHA1

908cf1b5e6311e41d1391890a217af7c82462949
SHA256

564827da0667de0cded3fbfc3cebf8deec5f27b2224d112006d7e8aa3991ca62
SHA512

099e61e5855ee93b2eca6f0d9bc23636123c4f86d3fd34777a24fdc2776b0875976c2b34f7f437b31926ffe154a3f59e2c4f5d78e77d16af24f8676674bc643e
SSDEEP

6144:l9ykYklEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesN23wU7HuAmHK+V:z2wr03pdf8vhhOKJET8Byq+V

Score

10^/10

qakbot biden01 1613656969 banker discovery stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

biden01

Campaign

1613656969

C2

172.87.157.235:3389

173.184.119.153:995

81.150.181.168:2222

71.187.170.235:443

197.45.110.165:995

86.160.137.132:443

86.236.77.68:2222

106.51.85.162:443

108.31.15.10:995

38.92.225.121:443

72.252.201.69:443

71.117.132.169:443

98.173.34.212:995

83.110.12.140:2222

95.77.223.148:443

41.39.134.183:443

85.52.72.32:2222

195.12.154.8:443

108.160.123.244:443

96.57.188.174:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1176 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1524 1176 WerFault.exe regsvr32.exe

pid	process
1176	regsvr32.exe

pid	pid_target	process	target process
1524	1176	WerFault.exe	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

regsvr32.exeregsvr32.exeexplorer.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	regsvr32.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2776 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exe

pid process

3468 regsvr32.exe
3468 regsvr32.exe
3468 regsvr32.exe
3468 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

3468 regsvr32.exe

pid	process
2776	schtasks.exe

pid	process
3468	regsvr32.exe
3468	regsvr32.exe
3468	regsvr32.exe
3468	regsvr32.exe

pid	process
3468	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exe

description	pid	process	target process
PID 3972 wrote to memory of 3468	3972	regsvr32.exe	regsvr32.exe
PID 3972 wrote to memory of 3468	3972	regsvr32.exe	regsvr32.exe
PID 3972 wrote to memory of 3468	3972	regsvr32.exe	regsvr32.exe
PID 3468 wrote to memory of 752	3468	regsvr32.exe	explorer.exe
PID 3468 wrote to memory of 752	3468	regsvr32.exe	explorer.exe
PID 3468 wrote to memory of 752	3468	regsvr32.exe	explorer.exe
PID 3468 wrote to memory of 752	3468	regsvr32.exe	explorer.exe
PID 3468 wrote to memory of 752	3468	regsvr32.exe	explorer.exe
PID 752 wrote to memory of 2776	752	explorer.exe	schtasks.exe
PID 752 wrote to memory of 2776	752	explorer.exe	schtasks.exe
PID 752 wrote to memory of 2776	752	explorer.exe	schtasks.exe
PID 4108 wrote to memory of 1176	4108	regsvr32.exe	regsvr32.exe
PID 4108 wrote to memory of 1176	4108	regsvr32.exe	regsvr32.exe
PID 4108 wrote to memory of 1176	4108	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\899d41e22f178978c1d04af951ef1ee8_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\899d41e22f178978c1d04af951ef1ee8_JaffaCakes118.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bnggtibf /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\899d41e22f178978c1d04af951ef1ee8_JaffaCakes118.dll\"" /SC ONCE /Z /ST 08:05 /ET 08:17
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4384,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:8
1⤵
PID:1112

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\899d41e22f178978c1d04af951ef1ee8_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\899d41e22f178978c1d04af951ef1ee8_JaffaCakes118.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 584
    3⤵
    - Program crash
    PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1176 -ip 1176
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\899d41e22f178978c1d04af951ef1ee8_JaffaCakes118.dll

Filesize
398KB

MD5
90656a1ab5821d21f38cd9d597028da9

SHA1
2079b1e345494f280aae599aded7637dc3b3cd57

SHA256
d0c3375e911113e1a5483654e21cfde80009cd1638d585d41be28b8f4b83fae1

SHA512
ded34fa94ee769364230d9393a4ca52d7705aabe74e2d1fa5c54ebca7a45a6dfa891f7d92fae1c8a11f3c59f5eb9b94b0642306ed7e3cb75f68082bca489be4f

Download Submit
memory/752-3-0x0000000000800000-0x0000000000835000-memory.dmp

Filesize
212KB

Download
memory/752-6-0x0000000000800000-0x0000000000835000-memory.dmp

Filesize
212KB

Download
memory/752-8-0x0000000000800000-0x0000000000835000-memory.dmp

Filesize
212KB

Download
memory/752-7-0x0000000000800000-0x0000000000835000-memory.dmp

Filesize
212KB

Download
memory/752-10-0x0000000000800000-0x0000000000835000-memory.dmp

Filesize
212KB

Download
memory/1176-14-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download
memory/3468-0-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download
memory/3468-1-0x0000000002990000-0x00000000029F4000-memory.dmp

Filesize
400KB

Download
memory/3468-2-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download
memory/3468-5-0x0000000002990000-0x00000000029F4000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads