qakbot | 0adf44d05a91b852c6b607f69ce113baf8e23793867b18beed004989622e2278

General

Target

503aef4038049697f0f2b69c5f5fb310_JaffaCakes118.dll
Size

708KB
MD5

503aef4038049697f0f2b69c5f5fb310
SHA1

e70fa094e5d6be7f3823963fc5ee4973295ea58e
SHA256

0adf44d05a91b852c6b607f69ce113baf8e23793867b18beed004989622e2278
SHA512

f06ff5b308da81a936c4ee0a403f449dac55eded3e3507ac547d2c1bb8bb15e10d2c82749bfa76420f5f3857012826ef3adde90efd510ee76d4290e7e3fa678f
SSDEEP

12288:4gbAcis08s7gQFMWC24/MFS+AWmdnWJIjJ5F3+DpEFs3H6v/+toTNxQ:4aDis0dFA24/MFSptIJKnx+NE23a3+t7

Score

10^/10

qakbot obama106 1632905607 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama106

Campaign

1632905607

C2

37.210.152.224:995

120.151.47.189:443

105.198.236.99:443

122.11.220.212:2222

199.27.127.129:443

41.251.41.14:995

216.201.162.158:443

124.123.42.115:2078

181.118.183.94:443

120.150.218.241:995

185.250.148.74:443

217.17.56.163:443

182.181.78.18:995

140.82.49.12:443

105.159.144.186:995

89.101.97.139:443

217.17.56.163:0

27.223.92.142:995

95.77.223.148:443

109.190.253.11:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Itaob = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Jplajr = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1140 regsvr32.exe

pid	process
1140	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

schtasks.exeregsvr32.exeexplorer.exerundll32.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uibhpjkazqfkz\72efbd0e = b874796ba6234d5723c212e435b399bf241231675fe7e5d29a38b6397b4d22160b987862ca848b57766351a6f87397f32eb5201f29d6a23239c8ead7c56c3c61bfe12666567c98013455c7e78b613e2bc0c761ff427ce146ee035744dfffb7baf9ded056cb82c2269e39d7ed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uibhpjkazqfkz	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uibhpjkazqfkz\72efbd0e = b8746e6ba62378e5c701e22f83cfbf0996891f16c6ee6d8d9155896c5ade36f35d9dd3be08c14aa9a728a79274522853eca0327ef306814972e0ef6e82e9c903106c24ce6e9e35ce864a1d13fbe07bd66d267137048e8a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uibhpjkazqfkz\47706d40 = 247384a443a9fae5065a52dfe60bca44069011ce061116ad9487c688bc6a2d5a496f421ef63bd8c41912c3f04e79017d6b1ccb6e49a32120166fd99c80456cdf4a87ce323d4d733cc4871c64998287aa92952f89891d26eb966aee41edff7551f929faba7c4b68e1a044d93b169f8022846e3c2f6fab20948aa1a645	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uibhpjkazqfkz\fd8d2a59 = 10627a1eba7d0b8c0b9aa889492f94b490531c494eb81b90abdd4ba4e539548a243c86e4d5bcccd358f70c2264	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uibhpjkazqfkz\ffcc0a25 = 6337d2157a101e3fddb806902f37149b8e4424eb7213a03bd31dac653aaf29662af0b2b246d863a8a128effa545c648f7fe9cca4b43595	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uibhpjkazqfkz\da6d2f8 = a8f471d26d905909789a801e1f2e68631470ab53a41c9c2249b598871d03883efc0d421b5b926f7e28c925f28c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uibhpjkazqfkz\45314d3c = 6e4a95c605ea1672006d9598eba929ac428c633f27384edc6929b5b7cbc6be9bf714b79a1144e9050359ea0fad19ba9f49e0807bff84ed68c1500304728caa9a65bf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uibhpjkazqfkz\808565d3 = 96d9952881c046c999ea9eed2ff6526018e640a87e83947fd2bdcc45001bce53f6af83819341dcf4b439b7400fdfce960a3fa6e099dae26f4fe965ab911b5604d21f51be5c1178a2db8fe1c6675ec9eef65380bef5d7af2cc3012de1b1c3518effaa7a4204252ddc3c21bc155270cfaa	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uibhpjkazqfkz\383902b6 = 589c19f6476f8fda80f6305743fc4209f925f1b60ee2dba04a5975d40a74a7bfe954425ac7d10645cc57	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2732 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2264 rundll32.exe
1140 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

2264 rundll32.exe
1140 regsvr32.exe

pid	process
2732	schtasks.exe

pid	process
2264	rundll32.exe
1140	regsvr32.exe

pid	process
2264	rundll32.exe
1140	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2644 wrote to memory of 2264	2644	rundll32.exe	rundll32.exe
PID 2644 wrote to memory of 2264	2644	rundll32.exe	rundll32.exe
PID 2644 wrote to memory of 2264	2644	rundll32.exe	rundll32.exe
PID 2644 wrote to memory of 2264	2644	rundll32.exe	rundll32.exe
PID 2644 wrote to memory of 2264	2644	rundll32.exe	rundll32.exe
PID 2644 wrote to memory of 2264	2644	rundll32.exe	rundll32.exe
PID 2644 wrote to memory of 2264	2644	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 2772	2264	rundll32.exe	explorer.exe
PID 2264 wrote to memory of 2772	2264	rundll32.exe	explorer.exe
PID 2264 wrote to memory of 2772	2264	rundll32.exe	explorer.exe
PID 2264 wrote to memory of 2772	2264	rundll32.exe	explorer.exe
PID 2264 wrote to memory of 2772	2264	rundll32.exe	explorer.exe
PID 2264 wrote to memory of 2772	2264	rundll32.exe	explorer.exe
PID 2772 wrote to memory of 2732	2772	explorer.exe	schtasks.exe
PID 2772 wrote to memory of 2732	2772	explorer.exe	schtasks.exe
PID 2772 wrote to memory of 2732	2772	explorer.exe	schtasks.exe
PID 2772 wrote to memory of 2732	2772	explorer.exe	schtasks.exe
PID 1404 wrote to memory of 2324	1404	taskeng.exe	regsvr32.exe
PID 1404 wrote to memory of 2324	1404	taskeng.exe	regsvr32.exe
PID 1404 wrote to memory of 2324	1404	taskeng.exe	regsvr32.exe
PID 1404 wrote to memory of 2324	1404	taskeng.exe	regsvr32.exe
PID 1404 wrote to memory of 2324	1404	taskeng.exe	regsvr32.exe
PID 2324 wrote to memory of 1140	2324	regsvr32.exe	regsvr32.exe
PID 2324 wrote to memory of 1140	2324	regsvr32.exe	regsvr32.exe
PID 2324 wrote to memory of 1140	2324	regsvr32.exe	regsvr32.exe
PID 2324 wrote to memory of 1140	2324	regsvr32.exe	regsvr32.exe
PID 2324 wrote to memory of 1140	2324	regsvr32.exe	regsvr32.exe
PID 2324 wrote to memory of 1140	2324	regsvr32.exe	regsvr32.exe
PID 2324 wrote to memory of 1140	2324	regsvr32.exe	regsvr32.exe
PID 1140 wrote to memory of 320	1140	regsvr32.exe	explorer.exe
PID 1140 wrote to memory of 320	1140	regsvr32.exe	explorer.exe
PID 1140 wrote to memory of 320	1140	regsvr32.exe	explorer.exe
PID 1140 wrote to memory of 320	1140	regsvr32.exe	explorer.exe
PID 1140 wrote to memory of 320	1140	regsvr32.exe	explorer.exe
PID 1140 wrote to memory of 320	1140	regsvr32.exe	explorer.exe
PID 320 wrote to memory of 1228	320	explorer.exe	reg.exe
PID 320 wrote to memory of 1228	320	explorer.exe	reg.exe
PID 320 wrote to memory of 1228	320	explorer.exe	reg.exe
PID 320 wrote to memory of 1228	320	explorer.exe	reg.exe
PID 320 wrote to memory of 1688	320	explorer.exe	reg.exe
PID 320 wrote to memory of 1688	320	explorer.exe	reg.exe
PID 320 wrote to memory of 1688	320	explorer.exe	reg.exe
PID 320 wrote to memory of 1688	320	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\503aef4038049697f0f2b69c5f5fb310_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\503aef4038049697f0f2b69c5f5fb310_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xfoibphk /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\503aef4038049697f0f2b69c5f5fb310_JaffaCakes118.dll\"" /SC ONCE /Z /ST 01:56 /ET 02:08
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2732

C:\Windows\system32\taskeng.exe
taskeng.exe {5D4E3BC4-B4E2-457E-BF15-642F39CB906D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\503aef4038049697f0f2b69c5f5fb310_JaffaCakes118.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\503aef4038049697f0f2b69c5f5fb310_JaffaCakes118.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:320
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Itaob" /d "0"
        5⤵
        Windows security bypass
        
        PID:1228
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Jplajr" /d "0"
        5⤵
        Windows security bypass
        
        PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\503aef4038049697f0f2b69c5f5fb310_JaffaCakes118.dll

Filesize
708KB

MD5
503aef4038049697f0f2b69c5f5fb310

SHA1
e70fa094e5d6be7f3823963fc5ee4973295ea58e

SHA256
0adf44d05a91b852c6b607f69ce113baf8e23793867b18beed004989622e2278

SHA512
f06ff5b308da81a936c4ee0a403f449dac55eded3e3507ac547d2c1bb8bb15e10d2c82749bfa76420f5f3857012826ef3adde90efd510ee76d4290e7e3fa678f

Download Submit
memory/320-26-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/320-27-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/320-29-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1140-21-0x0000000074C20000-0x0000000074CEA000-memory.dmp

Filesize
808KB

Download
memory/1140-24-0x0000000074C20000-0x0000000074CEA000-memory.dmp

Filesize
808KB

Download
memory/1140-20-0x0000000074C20000-0x0000000074CEA000-memory.dmp

Filesize
808KB

Download
memory/2264-1-0x0000000074DC0000-0x0000000074E8A000-memory.dmp

Filesize
808KB

Download
memory/2264-4-0x0000000074DC0000-0x0000000074E8A000-memory.dmp

Filesize
808KB

Download
memory/2264-3-0x0000000074E71000-0x0000000074E77000-memory.dmp

Filesize
24KB

Download
memory/2264-0-0x0000000074DC0000-0x0000000074E8A000-memory.dmp

Filesize
808KB

Download
memory/2264-8-0x0000000074DC0000-0x0000000074E8A000-memory.dmp

Filesize
808KB

Download
memory/2772-5-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/2772-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2772-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2772-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2772-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2772-7-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads