qakbot | 207327b6784ed008dcdd8616aac692eec86667d4de1fa89ff28f4bb5eab7e7a2

General

Target

bd822f8b088df0df6697eb3612d0cbbf_JaffaCakes118.dll
Size

506KB
MD5

bd822f8b088df0df6697eb3612d0cbbf
SHA1

c38cb27d961b7ee71e4ab06fe8e8563e98186f7a
SHA256

207327b6784ed008dcdd8616aac692eec86667d4de1fa89ff28f4bb5eab7e7a2
SHA512

8ceddf45dc65cd43b78c96eb6f3b6db2014625c997b42160e87d06c926eabcd8f1a61d529b61d05c969bd40f78e1fecee71853f3e34ba5cea39b625a9055df5b
SSDEEP

12288:IW7OY3YTn155L/9hFTMq2EKMAcuCSF7aqxETMNIp0Fh6bUV:IWf3YTnJLBv2EKMAcOgqxETMNIpM6Q

Score

10^/10

qakbot obama108 1633342139 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama108

Campaign

1633342139

C2

206.47.134.234:2222

73.230.205.91:443

190.198.206.189:2222

103.246.130.2:20

103.246.130.122:20

81.250.153.227:2222

167.248.100.227:443

37.210.152.224:995

96.57.188.174:2078

2.99.100.134:2222

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

136.232.34.70:443

68.186.192.69:443

167.248.111.245:443

81.241.252.59:2078

94.200.181.154:443

96.46.103.226:443

187.116.124.82:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Tkbsm = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Vigyco = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

576 regsvr32.exe

pid	process
576	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rundll32.exeexplorer.exeschtasks.exeregsvr32.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xyudfovwsp\20f43b0e = 9dfabf2d7a2ac57de9bf87aa824d899e18791b874d63dbf2acd0f6cc300f4bf042d5776345cd3630af344e70b0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xyudfovwsp\5fbd54f8 = f452488bb2821252be8c4713400ab0995afaf53004ef680c66a9ea181924136d7c7913c68e1a139fbbb7c9059f21b3620235df664031fc6bfe08aea6847fc1479f1a	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Xyudfovwsp	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xyudfovwsp\5fbd54f8 = f4525f8bb28227da4e23a5cfbe9f3eea2a16d5f8146297ccc491b5495c178d2592bac522dc8e261b7f008362e0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xyudfovwsp\d0dfc3af = fb1508c5d84e5d6312e5a489277632263a204be2e1b7acbfcf165f7f27c18214170550ac28f5e1c07c67957d11fb8cfc651b683a8b883b72276692b538974ac792f6917b7b2649	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xyudfovwsp\156beb40 = 49008d0085b4e94a5e50a67d66551d9564afd20cf3e694959727d09c53c6dd66dd9d60454396901c4913d9aa8396390392efec5b7ac3406a33bfe73f1109edc633aeac636e2b9cf56fbafaa53d4b72767c25db35a595db31cb062fc613eaf5d3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xyudfovwsp\d29ee3d3 = b0d1759e72b4d369ea18359145e36570000d916f5232ad7a5df4db554455b178ae7821e51d7f666f7af23da16e5bc8e593b6730ebf8ff2793ccfe11cd748234cf6ee119a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xyudfovwsp\6a2284b6 = 4260cdef14d72947b6a680ff297150301697c851fc225bd03c9121569c56d74cb518f176e6f4b27d5aecdb4ebef92a36dcba5ed0e75548b5da2f323fa9e25cc0bded8ff9121561f1326e21dc6c20d17b9d0c6c5b49cc5cf247d6be7d4f78432cd8bc837655f9a9cfd0c2b6a0b82084a9f754	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xyudfovwsp\6863a4ca = 739328da13b80da4790339115e00ccd4aee57a294894d733239e31a90dbf670ffac5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Xyudfovwsp\add78c25 = 61efcdad19ab4c0832d9356790a74df3d1e8169d34df8f5640e2e8dbfc8aa592a184b4991c7089306186b535cd9b333c67a3b7022376f0bcc0438af975211fe782cf62b58e733c2a1ae1bb	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2844 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2632 rundll32.exe
576 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2632 rundll32.exe
576 regsvr32.exe

pid	process
2844	schtasks.exe

pid	process
2632	rundll32.exe
576	regsvr32.exe

pid	process
2632	rundll32.exe
576	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2372 wrote to memory of 2632	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2632	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2632	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2632	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2632	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2632	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2632	2372	rundll32.exe	rundll32.exe
PID 2632 wrote to memory of 3032	2632	rundll32.exe	explorer.exe
PID 2632 wrote to memory of 3032	2632	rundll32.exe	explorer.exe
PID 2632 wrote to memory of 3032	2632	rundll32.exe	explorer.exe
PID 2632 wrote to memory of 3032	2632	rundll32.exe	explorer.exe
PID 2632 wrote to memory of 3032	2632	rundll32.exe	explorer.exe
PID 2632 wrote to memory of 3032	2632	rundll32.exe	explorer.exe
PID 3032 wrote to memory of 2844	3032	explorer.exe	schtasks.exe
PID 3032 wrote to memory of 2844	3032	explorer.exe	schtasks.exe
PID 3032 wrote to memory of 2844	3032	explorer.exe	schtasks.exe
PID 3032 wrote to memory of 2844	3032	explorer.exe	schtasks.exe
PID 2000 wrote to memory of 2456	2000	taskeng.exe	regsvr32.exe
PID 2000 wrote to memory of 2456	2000	taskeng.exe	regsvr32.exe
PID 2000 wrote to memory of 2456	2000	taskeng.exe	regsvr32.exe
PID 2000 wrote to memory of 2456	2000	taskeng.exe	regsvr32.exe
PID 2000 wrote to memory of 2456	2000	taskeng.exe	regsvr32.exe
PID 2456 wrote to memory of 576	2456	regsvr32.exe	regsvr32.exe
PID 2456 wrote to memory of 576	2456	regsvr32.exe	regsvr32.exe
PID 2456 wrote to memory of 576	2456	regsvr32.exe	regsvr32.exe
PID 2456 wrote to memory of 576	2456	regsvr32.exe	regsvr32.exe
PID 2456 wrote to memory of 576	2456	regsvr32.exe	regsvr32.exe
PID 2456 wrote to memory of 576	2456	regsvr32.exe	regsvr32.exe
PID 2456 wrote to memory of 576	2456	regsvr32.exe	regsvr32.exe
PID 576 wrote to memory of 1752	576	regsvr32.exe	explorer.exe
PID 576 wrote to memory of 1752	576	regsvr32.exe	explorer.exe
PID 576 wrote to memory of 1752	576	regsvr32.exe	explorer.exe
PID 576 wrote to memory of 1752	576	regsvr32.exe	explorer.exe
PID 576 wrote to memory of 1752	576	regsvr32.exe	explorer.exe
PID 576 wrote to memory of 1752	576	regsvr32.exe	explorer.exe
PID 1752 wrote to memory of 380	1752	explorer.exe	reg.exe
PID 1752 wrote to memory of 380	1752	explorer.exe	reg.exe
PID 1752 wrote to memory of 380	1752	explorer.exe	reg.exe
PID 1752 wrote to memory of 380	1752	explorer.exe	reg.exe
PID 1752 wrote to memory of 1768	1752	explorer.exe	reg.exe
PID 1752 wrote to memory of 1768	1752	explorer.exe	reg.exe
PID 1752 wrote to memory of 1768	1752	explorer.exe	reg.exe
PID 1752 wrote to memory of 1768	1752	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd822f8b088df0df6697eb3612d0cbbf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd822f8b088df0df6697eb3612d0cbbf_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bbhglsstbn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\bd822f8b088df0df6697eb3612d0cbbf_JaffaCakes118.dll\"" /SC ONCE /Z /ST 23:03 /ET 23:15
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2844

C:\Windows\system32\taskeng.exe
taskeng.exe {D83022C4-5506-496F-A449-3EA8A2DF6302} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\bd822f8b088df0df6697eb3612d0cbbf_JaffaCakes118.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\bd822f8b088df0df6697eb3612d0cbbf_JaffaCakes118.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:576
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1752
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Vigyco" /d "0"
        5⤵
        Windows security bypass
        
        PID:380
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Tkbsm" /d "0"
        5⤵
        Windows security bypass
        
        PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bd822f8b088df0df6697eb3612d0cbbf_JaffaCakes118.dll

Filesize
506KB

MD5
bd822f8b088df0df6697eb3612d0cbbf

SHA1
c38cb27d961b7ee71e4ab06fe8e8563e98186f7a

SHA256
207327b6784ed008dcdd8616aac692eec86667d4de1fa89ff28f4bb5eab7e7a2

SHA512
8ceddf45dc65cd43b78c96eb6f3b6db2014625c997b42160e87d06c926eabcd8f1a61d529b61d05c969bd40f78e1fecee71853f3e34ba5cea39b625a9055df5b

Download Submit
memory/576-20-0x00000000727D0000-0x000000007315A000-memory.dmp

Filesize
9.5MB

Download
memory/576-24-0x00000000727D0000-0x000000007315A000-memory.dmp

Filesize
9.5MB

Download
memory/576-21-0x00000000727D0000-0x000000007315A000-memory.dmp

Filesize
9.5MB

Download
memory/1752-27-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1752-28-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1752-26-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2632-4-0x0000000073160000-0x0000000073AEA000-memory.dmp

Filesize
9.5MB

Download
memory/2632-0-0x0000000073160000-0x0000000073AEA000-memory.dmp

Filesize
9.5MB

Download
memory/2632-3-0x00000000731DF000-0x00000000731E5000-memory.dmp

Filesize
24KB

Download
memory/2632-1-0x0000000073160000-0x0000000073AEA000-memory.dmp

Filesize
9.5MB

Download
memory/2632-8-0x0000000073160000-0x0000000073AEA000-memory.dmp

Filesize
9.5MB

Download
memory/3032-5-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/3032-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3032-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3032-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3032-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3032-6-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads