qakbot | 207327b6784ed008dcdd8616aac692eec86667d4de1fa89ff28f4bb5eab7e7a2

General

Target

bd822f8b088df0df6697eb3612d0cbbf_JaffaCakes118.dll
Size

506KB
MD5

bd822f8b088df0df6697eb3612d0cbbf
SHA1

c38cb27d961b7ee71e4ab06fe8e8563e98186f7a
SHA256

207327b6784ed008dcdd8616aac692eec86667d4de1fa89ff28f4bb5eab7e7a2
SHA512

8ceddf45dc65cd43b78c96eb6f3b6db2014625c997b42160e87d06c926eabcd8f1a61d529b61d05c969bd40f78e1fecee71853f3e34ba5cea39b625a9055df5b
SSDEEP

12288:IW7OY3YTn155L/9hFTMq2EKMAcuCSF7aqxETMNIp0Fh6bUV:IWf3YTnJLBv2EKMAcOgqxETMNIpM6Q

Score

10^/10

qakbot obama108 1633342139 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama108

Campaign

1633342139

C2

206.47.134.234:2222

73.230.205.91:443

190.198.206.189:2222

103.246.130.2:20

103.246.130.122:20

81.250.153.227:2222

167.248.100.227:443

37.210.152.224:995

96.57.188.174:2078

2.99.100.134:2222

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

136.232.34.70:443

68.186.192.69:443

167.248.111.245:443

81.241.252.59:2078

94.200.181.154:443

96.46.103.226:443

187.116.124.82:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Vldedeaxtaab = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Myyiu = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

532 regsvr32.exe

pid	process
532	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rundll32.exeexplorer.exeschtasks.exeregsvr32.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hlozuzojidjqp\a61d1c0e = a86a743d4e59215669661b2527fb32b64418422cdca8fe191a9f7d3d595291b8042c159582c590537343a4fdf744fa82b8f5c0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hlozuzojidjqp\5477c4d3 = 265e87ce24e70ebb8484a749f2c0c799198e0aabf2625bc2cee2be50ebe350cacc42ef3fee5bc478ac13401f2936a55b00f48e4e86e1090ccfa348d47587b1ad7c11e2ad565eacfe45c58df2ff14c9dfa8295da3e76ddc275fb1a8ae05	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hlozuzojidjqp\eccba3b6 = 8a0197722ee438d796dd73d294ffa8b42f60e0320d9cabe9ac86f96876202b3b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hlozuzojidjqp\2b3eab25 = 9cdc00f6d16b20a28ff6f73b5a78ee786d70d627390a49f08d1e0aee2bcaad9eb521e47f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hlozuzojidjqp\91c3ec3c = 8e235d8f434337fa74246955231a64fe54966fba	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hlozuzojidjqp\297f8b59 = f5a973bae99816def893d32780421a81a3585cf0e59f2f56d6cd02e69f866e63923ef6605161b1eb874183c033560bce0a0fbdc51b023a9381274b8ea9d4d52ef93e9491a2a3067d1dc89224414acee9083740e29d894b5aa68e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hlozuzojidjqp\d95473f8 = 6fd81bb07131731538345b876e4ead984c0081b9b31acb053f400a2b6a3afb4d098c2d7b7daceb0d0379f98b71e898c2ad5049d06643cac5806c3f84f21747e090	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hlozuzojidjqp	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hlozuzojidjqp\a61d1c0e = a86a633d4e5914ffddfd066e1449b3ed7ad88ba883b23d1845961c21775b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hlozuzojidjqp\9382cc40 = 38b069388a42f81ea7596d38a22d96b1958cecd409889e69052a34b1832beb8d23f789afec80c2f6fb115d2755a3bb86dd9631258e772cfa86162c6b477fea430eb462731bc0c98b0b14d3b90a41350c8f27e9b95df0f82ef0102a283676be03874496093f819ce25987277489b1d728d5ec631a94442afa0feadfa91273bb1b4158ab7ea744fc3dc39e19ffbec278ce59be2c35cea17d8039b380930f27c94d2655289e32f83b8385fe1beff103919f03ea7d283325e5470229e7a3	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3380 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1244 rundll32.exe
1244 rundll32.exe
532 regsvr32.exe
532 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1244 rundll32.exe
532 regsvr32.exe

pid	process
3380	schtasks.exe

pid	process
1244	rundll32.exe
1244	rundll32.exe
532	regsvr32.exe
532	regsvr32.exe

pid	process
1244	rundll32.exe
532	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 5000 wrote to memory of 1244	5000	rundll32.exe	rundll32.exe
PID 5000 wrote to memory of 1244	5000	rundll32.exe	rundll32.exe
PID 5000 wrote to memory of 1244	5000	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 1528	1244	rundll32.exe	explorer.exe
PID 1244 wrote to memory of 1528	1244	rundll32.exe	explorer.exe
PID 1244 wrote to memory of 1528	1244	rundll32.exe	explorer.exe
PID 1244 wrote to memory of 1528	1244	rundll32.exe	explorer.exe
PID 1244 wrote to memory of 1528	1244	rundll32.exe	explorer.exe
PID 1528 wrote to memory of 3380	1528	explorer.exe	schtasks.exe
PID 1528 wrote to memory of 3380	1528	explorer.exe	schtasks.exe
PID 1528 wrote to memory of 3380	1528	explorer.exe	schtasks.exe
PID 2172 wrote to memory of 532	2172	regsvr32.exe	regsvr32.exe
PID 2172 wrote to memory of 532	2172	regsvr32.exe	regsvr32.exe
PID 2172 wrote to memory of 532	2172	regsvr32.exe	regsvr32.exe
PID 532 wrote to memory of 2404	532	regsvr32.exe	explorer.exe
PID 532 wrote to memory of 2404	532	regsvr32.exe	explorer.exe
PID 532 wrote to memory of 2404	532	regsvr32.exe	explorer.exe
PID 532 wrote to memory of 2404	532	regsvr32.exe	explorer.exe
PID 532 wrote to memory of 2404	532	regsvr32.exe	explorer.exe
PID 2404 wrote to memory of 3408	2404	explorer.exe	reg.exe
PID 2404 wrote to memory of 3408	2404	explorer.exe	reg.exe
PID 2404 wrote to memory of 3524	2404	explorer.exe	reg.exe
PID 2404 wrote to memory of 3524	2404	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd822f8b088df0df6697eb3612d0cbbf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd822f8b088df0df6697eb3612d0cbbf_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bdfjadf /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\bd822f8b088df0df6697eb3612d0cbbf_JaffaCakes118.dll\"" /SC ONCE /Z /ST 23:03 /ET 23:15
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3380

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\bd822f8b088df0df6697eb3612d0cbbf_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\bd822f8b088df0df6697eb3612d0cbbf_JaffaCakes118.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Vldedeaxtaab" /d "0"
      4⤵
      Windows security bypass
      PID:3408
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Myyiu" /d "0"
      4⤵
      Windows security bypass
      PID:3524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bd822f8b088df0df6697eb3612d0cbbf_JaffaCakes118.dll

Filesize
506KB

MD5
bd822f8b088df0df6697eb3612d0cbbf

SHA1
c38cb27d961b7ee71e4ab06fe8e8563e98186f7a

SHA256
207327b6784ed008dcdd8616aac692eec86667d4de1fa89ff28f4bb5eab7e7a2

SHA512
8ceddf45dc65cd43b78c96eb6f3b6db2014625c997b42160e87d06c926eabcd8f1a61d529b61d05c969bd40f78e1fecee71853f3e34ba5cea39b625a9055df5b

Download Submit
memory/532-20-0x0000000072C80000-0x000000007360A000-memory.dmp

Filesize
9.5MB

Download
memory/532-18-0x0000000072C80000-0x000000007360A000-memory.dmp

Filesize
9.5MB

Download
memory/532-17-0x0000000072C80000-0x000000007360A000-memory.dmp

Filesize
9.5MB

Download
memory/1244-6-0x0000000074C00000-0x000000007558A000-memory.dmp

Filesize
9.5MB

Download
memory/1244-1-0x0000000074C7F000-0x0000000074C85000-memory.dmp

Filesize
24KB

Download
memory/1244-4-0x0000000074C00000-0x000000007558A000-memory.dmp

Filesize
9.5MB

Download
memory/1244-0-0x0000000074C00000-0x000000007558A000-memory.dmp

Filesize
9.5MB

Download
memory/1528-9-0x00000000012F0000-0x0000000001311000-memory.dmp

Filesize
132KB

Download
memory/1528-11-0x00000000012F0000-0x0000000001311000-memory.dmp

Filesize
132KB

Download
memory/1528-10-0x00000000012F0000-0x0000000001311000-memory.dmp

Filesize
132KB

Download
memory/1528-13-0x00000000012F0000-0x0000000001311000-memory.dmp

Filesize
132KB

Download
memory/1528-5-0x00000000012F0000-0x0000000001311000-memory.dmp

Filesize
132KB

Download
memory/2404-22-0x0000000000980000-0x00000000009A1000-memory.dmp

Filesize
132KB

Download
memory/2404-23-0x0000000000980000-0x00000000009A1000-memory.dmp

Filesize
132KB

Download
memory/2404-24-0x0000000000980000-0x00000000009A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads