qakbot | 59b7483e0e252b0d5d3bc65cf1e11dc47033bcddda5c02a8b63105a001a338e7

General

Target

f656d6ccef1f3f9499e9a07e22782271_JaffaCakes118.dll
Size

506KB
MD5

f656d6ccef1f3f9499e9a07e22782271
SHA1

46d6812d888fadf561def0f65c0a59bcf4bdd8f5
SHA256

59b7483e0e252b0d5d3bc65cf1e11dc47033bcddda5c02a8b63105a001a338e7
SHA512

46ce130f1b3f7624a0cc8df9d9f18e6c80a5154825cb075a2a9dd6b45320e87c8c553985278984487c817bb6a8ed36e50e1aef6bc8795cb25ed61d2d36eb1769
SSDEEP

12288:hW7OY3YTn155L/9hFTMq2EKMAcuCSF7aqxETMNIp0Fh6jUV:hWf3YTnJLBv2EKMAcOgqxETMNIpM6o

Score

10^/10

qakbot obama108 1633342139 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama108

Campaign

1633342139

C2

206.47.134.234:2222

73.230.205.91:443

190.198.206.189:2222

103.246.130.2:20

103.246.130.122:20

81.250.153.227:2222

167.248.100.227:443

37.210.152.224:995

96.57.188.174:2078

2.99.100.134:2222

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

136.232.34.70:443

68.186.192.69:443

167.248.111.245:443

81.241.252.59:2078

94.200.181.154:443

96.46.103.226:443

187.116.124.82:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Mgyezlxj = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Gevhndrftju = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4740 regsvr32.exe

pid	process
4740	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rundll32.exeexplorer.exeschtasks.exeregsvr32.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gypvashefb\e6d7449c = aa4f1c6c7c234f39ad83f3aeb0ddbdd2ce75afc2b2c8d929c5c15a9ff54c4c54596ec964f3cd492763a4d2e0cbb604acb29e5c49251ffd62ed9b57d22c888d51e83508b09fb958c362a464b4c2a090da7e740f621b341bfe0cec	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gypvashefb\5e6b23f9 = 11b028f88807e75e8b73bd1b5e054279aa50319b3783bfdaa0032ec3aed7f4e8b9dbab840a41b8603d986e48a43a56ee3e1bfdc3122e11c4b76aefd0a3c5a72ecb3ab63964e49b5a56666830cbb383448749d7cc166cb7cd3bb7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gypvashefb\23636c73 = 463d845a8e2322af918a901ce52b46bcdb79b68e62f80519d2a1b8a9068351b4f747ea1e9048f26ad285ecef0093d041006d32c900e20f110319068531fadbbfb0bf40d92dcccb05333a8571b0c51f96a07d26698d3c277f7f86399ea845	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gypvashefb\5c2a0385 = 7129af8389d5d97ded7560f60f04d3b367bf8742537d51a8d2801b33b566d16db5bd826818c01d50ca9d4016781796fc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gypvashefb\ae40db58 = 6367c071a47a7162eb821099a7a56154bbea75a2f0f16444910aadf102a178f955eb1b397440b7957449ff3f6452d5b55eeab68e9c64cef8c81b1076e667ed82e01be9	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gypvashefb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gypvashefb\d109b4ae = 3f234ddb53731e9ffdbc1cf5bd16681320c544add726e8f47fea8226f0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gypvashefb\d109b4ae = 3f235adb53732b80fad8539c29e74b0e06527ca87a5d8349df5f346a54bb656c6b91e5e6652a2d25dae331d8dfe3f8380754	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gypvashefb\e49664e0 = 39034316ef2347fffd2b830c596516541377440f8b18eace9da4907a6025aff1ce1d7c59bd48fb98cbc14ef590521357a030ea99f1995494a88f9a7d85d19f0640a47d603161ff1be8db004201a367bc870e9cac84423c34bbd2403cf932cda8984ba62f38fa6240caa145ac0eacd4c0f1333c791b36a48558e0d3bfa4164b50328f5e81e08598373079600d8e0f141daa8cec19fd6790023b72c5d957115778941e8b86962bdd0ca9ce2b62dcb58bcf55e555a55d9d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Gypvashefb\9bdf0b16 = 55a624581706a107b6b9492a4ff76e86fa3dc3216087c3f30de02090ce3f8b04ea25e97ca4e8df78f0ab87e704fd9892db0497c2f11024532858404c6c88ab7209bec1	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1788 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2540 rundll32.exe
2540 rundll32.exe
4740 regsvr32.exe
4740 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2540 rundll32.exe
4740 regsvr32.exe

pid	process
1788	schtasks.exe

pid	process
2540	rundll32.exe
2540	rundll32.exe
4740	regsvr32.exe
4740	regsvr32.exe

pid	process
2540	rundll32.exe
4740	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2212 wrote to memory of 2540	2212	rundll32.exe	rundll32.exe
PID 2212 wrote to memory of 2540	2212	rundll32.exe	rundll32.exe
PID 2212 wrote to memory of 2540	2212	rundll32.exe	rundll32.exe
PID 2540 wrote to memory of 1060	2540	rundll32.exe	explorer.exe
PID 2540 wrote to memory of 1060	2540	rundll32.exe	explorer.exe
PID 2540 wrote to memory of 1060	2540	rundll32.exe	explorer.exe
PID 2540 wrote to memory of 1060	2540	rundll32.exe	explorer.exe
PID 2540 wrote to memory of 1060	2540	rundll32.exe	explorer.exe
PID 1060 wrote to memory of 1788	1060	explorer.exe	schtasks.exe
PID 1060 wrote to memory of 1788	1060	explorer.exe	schtasks.exe
PID 1060 wrote to memory of 1788	1060	explorer.exe	schtasks.exe
PID 1672 wrote to memory of 4740	1672	regsvr32.exe	regsvr32.exe
PID 1672 wrote to memory of 4740	1672	regsvr32.exe	regsvr32.exe
PID 1672 wrote to memory of 4740	1672	regsvr32.exe	regsvr32.exe
PID 4740 wrote to memory of 432	4740	regsvr32.exe	explorer.exe
PID 4740 wrote to memory of 432	4740	regsvr32.exe	explorer.exe
PID 4740 wrote to memory of 432	4740	regsvr32.exe	explorer.exe
PID 4740 wrote to memory of 432	4740	regsvr32.exe	explorer.exe
PID 4740 wrote to memory of 432	4740	regsvr32.exe	explorer.exe
PID 432 wrote to memory of 3320	432	explorer.exe	reg.exe
PID 432 wrote to memory of 3320	432	explorer.exe	reg.exe
PID 432 wrote to memory of 60	432	explorer.exe	reg.exe
PID 432 wrote to memory of 60	432	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f656d6ccef1f3f9499e9a07e22782271_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f656d6ccef1f3f9499e9a07e22782271_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vbijtprwvl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\f656d6ccef1f3f9499e9a07e22782271_JaffaCakes118.dll\"" /SC ONCE /Z /ST 15:49 /ET 16:01
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1788

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\f656d6ccef1f3f9499e9a07e22782271_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\f656d6ccef1f3f9499e9a07e22782271_JaffaCakes118.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Mgyezlxj" /d "0"
      4⤵
      Windows security bypass
      PID:3320
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Gevhndrftju" /d "0"
      4⤵
      Windows security bypass
      PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f656d6ccef1f3f9499e9a07e22782271_JaffaCakes118.dll

Filesize
506KB

MD5
f656d6ccef1f3f9499e9a07e22782271

SHA1
46d6812d888fadf561def0f65c0a59bcf4bdd8f5

SHA256
59b7483e0e252b0d5d3bc65cf1e11dc47033bcddda5c02a8b63105a001a338e7

SHA512
46ce130f1b3f7624a0cc8df9d9f18e6c80a5154825cb075a2a9dd6b45320e87c8c553985278984487c817bb6a8ed36e50e1aef6bc8795cb25ed61d2d36eb1769

Download Submit
memory/432-24-0x0000000000F50000-0x0000000000F71000-memory.dmp

Filesize
132KB

Download
memory/432-25-0x0000000000F50000-0x0000000000F71000-memory.dmp

Filesize
132KB

Download
memory/432-23-0x0000000000F50000-0x0000000000F71000-memory.dmp

Filesize
132KB

Download
memory/1060-11-0x0000000000180000-0x00000000001A1000-memory.dmp

Filesize
132KB

Download
memory/1060-10-0x0000000000180000-0x00000000001A1000-memory.dmp

Filesize
132KB

Download
memory/1060-12-0x0000000000180000-0x00000000001A1000-memory.dmp

Filesize
132KB

Download
memory/1060-14-0x0000000000180000-0x00000000001A1000-memory.dmp

Filesize
132KB

Download
memory/1060-5-0x0000000000180000-0x00000000001A1000-memory.dmp

Filesize
132KB

Download
memory/2540-7-0x0000000074E40000-0x00000000757CA000-memory.dmp

Filesize
9.5MB

Download
memory/2540-2-0x0000000074E40000-0x00000000757CA000-memory.dmp

Filesize
9.5MB

Download
memory/2540-0-0x0000000074E40000-0x00000000757CA000-memory.dmp

Filesize
9.5MB

Download
memory/2540-4-0x0000000074E40000-0x00000000757CA000-memory.dmp

Filesize
9.5MB

Download
memory/2540-1-0x0000000074EBF000-0x0000000074EC5000-memory.dmp

Filesize
24KB

Download
memory/4740-18-0x0000000072EC0000-0x000000007384A000-memory.dmp

Filesize
9.5MB

Download
memory/4740-19-0x0000000072EC0000-0x000000007384A000-memory.dmp

Filesize
9.5MB

Download
memory/4740-21-0x0000000072EC0000-0x000000007384A000-memory.dmp

Filesize
9.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads