qakbot | 4282612879c57ba4dd32713af8a97f1f776b75bc48f492c8e57a6c445dbcb87b

General

Target

bd9d4783879e02862d919ea345180077_JaffaCakes118.dll
Size

1.1MB
MD5

bd9d4783879e02862d919ea345180077
SHA1

e0231aa5588a4c4aceaa50043b47ab201ac0cd96
SHA256

4282612879c57ba4dd32713af8a97f1f776b75bc48f492c8e57a6c445dbcb87b
SHA512

cb1d9c7d5b7969cf428020e51300834581a22a1e6ee48a2ad11be226cc66c9c2d36de24fc96305795b2dab101f34f9e84b9391ed082668f01f702e28c966c89e
SSDEEP

24576:tsSQSXRSFsPWWkVotdc3g+5coB4lzWrHtGOGpCXSenrO+1Zpf9vYxkXcJYCEC3AW:W2IFsOnCdc3g+6G4lsHtYpCXFnrOKXl+

Score

10^/10

qakbot tr 1633334141 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633334141

C2

75.75.179.226:443

185.250.148.74:443

122.11.220.212:2222

120.150.218.241:995

103.148.120.144:443

140.82.49.12:443

40.131.140.155:995

206.47.134.234:2222

73.230.205.91:443

190.198.206.189:2222

103.157.122.198:995

81.250.153.227:2222

167.248.100.227:443

96.57.188.174:2078

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

136.232.34.70:443

68.186.192.69:443

167.248.111.245:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Htdraoazw = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Xykgeb = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1356 regsvr32.exe

pid	process
1356	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rundll32.exeexplorer.exeschtasks.exeregsvr32.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ggesiwxlbzo\4083e6f0 = efc954835415a14a68c5d043894379b19aa1eb2e9d56998b148fe3c7a147bfd8be4ff2b2486d3fbd7e310d7bcb02bbac76145ba1575118808c9428b36d8184d2aa36cab81d899c1e7a4219c3582b7f3c025c557b22a6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ggesiwxlbzo\a555948 = 23b3ab22d160d34e68769d4950c11d53ece2b93c14ae2999299dc789bc6e110145c4d023de3fd0e19743dec49153c3194ccba5a676534b1677a38ead28fd9157437145934a664f8716505a4d0a2471c97970c5b42c18c4233278353ba137755c016c60c2712eb8b16be40fe47e71641a19325822439e88263d7562ee1a2ea4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ggesiwxlbzo\8147934 = 890a2671fcee2ec072eb7b003686f2d956510e01b09e957ca8c07117221ff8d4b2f9c65e69face48834fd48ef7c3513b793819d053fde004b89a7f693b568945c3a108940239c3ae19f50cebf90ed7504fff3c072a751e7eeec14bc87504c3fa0d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ggesiwxlbzo\cda051db = fda7ed54ad1ff5a8e64c188680b2e18c94a0dd6ccf65ef56a8cac1d9330eed1bd44ccca93fc67187787d01831418b88d8256a750fcdbe3ea0ebc3e3af23dd4798f7789d77fa73b2db1f1f7d142ac7f8686101a2ea7332ff8137e3ee7ddd5c6d74962	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ggesiwxlbzo\751c36be = f3656b7601b90907db37cd6f0166b8bceecfabbc4d53	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ggesiwxlbzo\3fca8906 = 6bbf01a992861b19f7a295f1736fa7445473cab83f7834013f25a704e37713eb773faa93e8d947df544f759fafcd4c657b1ad7b5e09c977c9526b88e7d3a99ebe9a589b8032e8e5687049dfe66ca24ff26cda44e1c9044a9	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ggesiwxlbzo	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ggesiwxlbzo\3fca8906 = 6bbf16a992862ec71f04b2d22f72b8c5ff545745bf930105ffa7b3d4a7f9f4454be8e5836e4f0be454713f535db046c4f1d8a255003ac6ff3f6efacf38a1de248077ee	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ggesiwxlbzo\b0a81e51 = 169a72683417619ad9b57aed56bb83c7b35de4e02861dd24729085cbe758b7918015a4725644c927b37af3bdc189f8cc87b313b46c79637505c9061310be274b781c39f4a6d83adc9025bd2b5a9f31d3233dd05fd9fac2aa8305297d4437	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ggesiwxlbzo\b2e93e2d = ccce9c9d311e104c154f6155da9574c070a307df8596661a8f212f103538745d8bf2793dce9a26b19dd96f7a4c7ebad97c6ac1	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2852 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2576 rundll32.exe
1356 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2576 rundll32.exe
1356 regsvr32.exe

pid	process
2852	schtasks.exe

pid	process
2576	rundll32.exe
1356	regsvr32.exe

pid	process
2576	rundll32.exe
1356	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2380 wrote to memory of 2576	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 2576	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 2576	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 2576	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 2576	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 2576	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 2576	2380	rundll32.exe	rundll32.exe
PID 2576 wrote to memory of 2420	2576	rundll32.exe	explorer.exe
PID 2576 wrote to memory of 2420	2576	rundll32.exe	explorer.exe
PID 2576 wrote to memory of 2420	2576	rundll32.exe	explorer.exe
PID 2576 wrote to memory of 2420	2576	rundll32.exe	explorer.exe
PID 2576 wrote to memory of 2420	2576	rundll32.exe	explorer.exe
PID 2576 wrote to memory of 2420	2576	rundll32.exe	explorer.exe
PID 2420 wrote to memory of 2852	2420	explorer.exe	schtasks.exe
PID 2420 wrote to memory of 2852	2420	explorer.exe	schtasks.exe
PID 2420 wrote to memory of 2852	2420	explorer.exe	schtasks.exe
PID 2420 wrote to memory of 2852	2420	explorer.exe	schtasks.exe
PID 1544 wrote to memory of 1064	1544	taskeng.exe	regsvr32.exe
PID 1544 wrote to memory of 1064	1544	taskeng.exe	regsvr32.exe
PID 1544 wrote to memory of 1064	1544	taskeng.exe	regsvr32.exe
PID 1544 wrote to memory of 1064	1544	taskeng.exe	regsvr32.exe
PID 1544 wrote to memory of 1064	1544	taskeng.exe	regsvr32.exe
PID 1064 wrote to memory of 1356	1064	regsvr32.exe	regsvr32.exe
PID 1064 wrote to memory of 1356	1064	regsvr32.exe	regsvr32.exe
PID 1064 wrote to memory of 1356	1064	regsvr32.exe	regsvr32.exe
PID 1064 wrote to memory of 1356	1064	regsvr32.exe	regsvr32.exe
PID 1064 wrote to memory of 1356	1064	regsvr32.exe	regsvr32.exe
PID 1064 wrote to memory of 1356	1064	regsvr32.exe	regsvr32.exe
PID 1064 wrote to memory of 1356	1064	regsvr32.exe	regsvr32.exe
PID 1356 wrote to memory of 2204	1356	regsvr32.exe	explorer.exe
PID 1356 wrote to memory of 2204	1356	regsvr32.exe	explorer.exe
PID 1356 wrote to memory of 2204	1356	regsvr32.exe	explorer.exe
PID 1356 wrote to memory of 2204	1356	regsvr32.exe	explorer.exe
PID 1356 wrote to memory of 2204	1356	regsvr32.exe	explorer.exe
PID 1356 wrote to memory of 2204	1356	regsvr32.exe	explorer.exe
PID 2204 wrote to memory of 2524	2204	explorer.exe	reg.exe
PID 2204 wrote to memory of 2524	2204	explorer.exe	reg.exe
PID 2204 wrote to memory of 2524	2204	explorer.exe	reg.exe
PID 2204 wrote to memory of 2524	2204	explorer.exe	reg.exe
PID 2204 wrote to memory of 640	2204	explorer.exe	reg.exe
PID 2204 wrote to memory of 640	2204	explorer.exe	reg.exe
PID 2204 wrote to memory of 640	2204	explorer.exe	reg.exe
PID 2204 wrote to memory of 640	2204	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd9d4783879e02862d919ea345180077_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd9d4783879e02862d919ea345180077_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn acgapmqw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\bd9d4783879e02862d919ea345180077_JaffaCakes118.dll\"" /SC ONCE /Z /ST 00:04 /ET 00:16
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2852

C:\Windows\system32\taskeng.exe
taskeng.exe {FF476FAB-07D3-497D-AB2D-4F5DC8F6A8AD} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\bd9d4783879e02862d919ea345180077_JaffaCakes118.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\bd9d4783879e02862d919ea345180077_JaffaCakes118.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2204
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Htdraoazw" /d "0"
        5⤵
        Windows security bypass
        
        PID:2524
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Xykgeb" /d "0"
        5⤵
        Windows security bypass
        
        PID:640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bd9d4783879e02862d919ea345180077_JaffaCakes118.dll

Filesize
1.1MB

MD5
bd9d4783879e02862d919ea345180077

SHA1
e0231aa5588a4c4aceaa50043b47ab201ac0cd96

SHA256
4282612879c57ba4dd32713af8a97f1f776b75bc48f492c8e57a6c445dbcb87b

SHA512
cb1d9c7d5b7969cf428020e51300834581a22a1e6ee48a2ad11be226cc66c9c2d36de24fc96305795b2dab101f34f9e84b9391ed082668f01f702e28c966c89e

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1356-25-0x0000000072C50000-0x000000007366C000-memory.dmp

Filesize
10.1MB

Download
memory/1356-21-0x0000000072C50000-0x000000007366C000-memory.dmp

Filesize
10.1MB

Download
memory/1356-20-0x0000000072C50000-0x000000007366C000-memory.dmp

Filesize
10.1MB

Download
memory/2204-27-0x0000000000120000-0x0000000000141000-memory.dmp

Filesize
132KB

Download
memory/2204-28-0x0000000000120000-0x0000000000141000-memory.dmp

Filesize
132KB

Download
memory/2204-29-0x0000000000120000-0x0000000000141000-memory.dmp

Filesize
132KB

Download
memory/2420-7-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2420-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2420-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2420-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2420-14-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2420-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2420-5-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2576-8-0x0000000073670000-0x000000007408C000-memory.dmp

Filesize
10.1MB

Download
memory/2576-1-0x0000000073670000-0x000000007408C000-memory.dmp

Filesize
10.1MB

Download
memory/2576-3-0x000000007377A000-0x0000000073781000-memory.dmp

Filesize
28KB

Download
memory/2576-0-0x0000000073670000-0x000000007408C000-memory.dmp

Filesize
10.1MB

Download
memory/2576-4-0x0000000073670000-0x000000007408C000-memory.dmp

Filesize
10.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads