qakbot | bd4e582af21117a0783b78abd3c42268bb857ed07f3a8e5217dfef63c1e9745d

General

Target

bd8f313e941b5b98eec8dcca79dbbeb2_JaffaCakes118.dll
Size

378KB
MD5

bd8f313e941b5b98eec8dcca79dbbeb2
SHA1

6eb20ae92ade25fc4d838ceefaf7530297978691
SHA256

bd4e582af21117a0783b78abd3c42268bb857ed07f3a8e5217dfef63c1e9745d
SHA512

3dfd1437230b54a72102150fd2dc99c2f89f7fa5a33b94cee64f0d8ed2aa1cadb06f855c5a3520887a8e23cf9b410fa2e51ba6894916af26e9a0ad2eb60fb5fd
SSDEEP

3072:Do6vBnby4Yx0XjFFzPQ0MslzERfQB24hLxBVi/b/9+PdpiWC35ol/uwfTuT2b2Mj:vs6Xpq0H3Jhds/9+qC/zfTPLV

Score

10^/10

qakbot obama104 1632729661 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

obama104

Campaign

1632729661

C2

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Xatora = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Nqjalmsrkiq = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
4996	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pcwkoluanqj\16133d5a = 6d8317f61beacb385102aaab80	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pcwkoluanqj\9b308a71 = 25b4101cefc66947f0ab1551c988eed56a6e0b99056c2438a2011621048c400261a1f3476c8b1d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pcwkoluanqj\695a52ac = 7201733f2eff79bfe0e3c2bb3a2700107a1030afa38c3ce5f484efef5b91683ae20e5a4118a3db9bc909f1dd2bb4d572d6f0db9aaac27df4bf8f32b01a0f4890f9594e66b466588b50501b0a00b091bef35abc5229496456	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pcwkoluanqj	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pcwkoluanqj\238ced14 = 7d28dc5fa998f57475703777c351cc69eb4d1a90aeb29165b5b9494712077efad2b7035de67f8b01c4398f13732bf0ca040f253bf80f49e7a2a4484cd95208feb3c1dfb8e2e55cde1faa4905029b1c2e57bbc89285c7e00e0337bca7e2a2a3993b72e54fb96e7abc561a3912bc83691fb17cb5575597d229271774d731a22796ff20d30741e6363148042cdc96f0318c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pcwkoluanqj\21cdcd68 = 90948d0618512681ac21f24b34ccdda504104228f0f41e10eb1f82360cd2980fbb8a1842b740136ce4f5fcbf09fbb6b64f433ca63a66edac883b283d77ccdaa7fd46836d6adde3953c5cbef13b369515fc7678383c3df6905813fcd480abc74f7e1a7875f1b322218548773800d5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pcwkoluanqj\9971aa0d = b88a3360006c7ec6e0f690dba4740b3ec7092487b31635add80da9c352297335cd0f670a2ab7015583d90d171fe7f8dbd96b1359807ee21e46e179a6af41fda6f1cafad9146226fc3673bd33689e5c5c046892d7bb2848509e1ad8477f9b89007e5d6244040daa856a5a055a68e4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pcwkoluanqj\e479e587 = 0fd81e802e58e8dc152f6209ef92192c2fab9d03bc32400c6effe3e6ec8162a75b5cf9c55ca984bdc37efbc2de66	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pcwkoluanqj\5cc582e2 = fbcf3e63feebd4fd6e40184c675f66e87131ae632ae0f1357b74d8a3404252b62b6063036c63031d8283aa4d572ca2e1104ba4a10dc0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pcwkoluanqj\16133d5a = 6d8300f61beafe016d904cf5f89e12c99654ee67cef6f538f530ebbcd79445b7aa9d	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2408	rundll32.exe
2408	rundll32.exe
4996	regsvr32.exe
4996	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2408	rundll32.exe
4996	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2408	2024	rundll32.exe	83
PID 2024 wrote to memory of 2408	2024	rundll32.exe	83
PID 2024 wrote to memory of 2408	2024	rundll32.exe	83
PID 2408 wrote to memory of 5112	2408	rundll32.exe	84
PID 2408 wrote to memory of 5112	2408	rundll32.exe	84
PID 2408 wrote to memory of 5112	2408	rundll32.exe	84
PID 2408 wrote to memory of 5112	2408	rundll32.exe	84
PID 2408 wrote to memory of 5112	2408	rundll32.exe	84
PID 5112 wrote to memory of 2044	5112	explorer.exe	85
PID 5112 wrote to memory of 2044	5112	explorer.exe	85
PID 5112 wrote to memory of 2044	5112	explorer.exe	85
PID 3472 wrote to memory of 4996	3472	regsvr32.exe	104
PID 3472 wrote to memory of 4996	3472	regsvr32.exe	104
PID 3472 wrote to memory of 4996	3472	regsvr32.exe	104
PID 4996 wrote to memory of 456	4996	regsvr32.exe	105
PID 4996 wrote to memory of 456	4996	regsvr32.exe	105
PID 4996 wrote to memory of 456	4996	regsvr32.exe	105
PID 4996 wrote to memory of 456	4996	regsvr32.exe	105
PID 4996 wrote to memory of 456	4996	regsvr32.exe	105
PID 456 wrote to memory of 1236	456	explorer.exe	106
PID 456 wrote to memory of 1236	456	explorer.exe	106
PID 456 wrote to memory of 1504	456	explorer.exe	108
PID 456 wrote to memory of 1504	456	explorer.exe	108

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd8f313e941b5b98eec8dcca79dbbeb2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd8f313e941b5b98eec8dcca79dbbeb2_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qztjbote /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\bd8f313e941b5b98eec8dcca79dbbeb2_JaffaCakes118.dll\"" /SC ONCE /Z /ST 13:16 /ET 13:28
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2044

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\bd8f313e941b5b98eec8dcca79dbbeb2_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\bd8f313e941b5b98eec8dcca79dbbeb2_JaffaCakes118.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:456
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Xatora" /d "0"
      4⤵
      Windows security bypass
      PID:1236
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Nqjalmsrkiq" /d "0"
      4⤵
      Windows security bypass
      PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bd8f313e941b5b98eec8dcca79dbbeb2_JaffaCakes118.dll

Filesize
378KB

MD5
bd8f313e941b5b98eec8dcca79dbbeb2

SHA1
6eb20ae92ade25fc4d838ceefaf7530297978691

SHA256
bd4e582af21117a0783b78abd3c42268bb857ed07f3a8e5217dfef63c1e9745d

SHA512
3dfd1437230b54a72102150fd2dc99c2f89f7fa5a33b94cee64f0d8ed2aa1cadb06f855c5a3520887a8e23cf9b410fa2e51ba6894916af26e9a0ad2eb60fb5fd

Download Submit
memory/456-21-0x0000000000B20000-0x0000000000B41000-memory.dmp

Filesize
132KB

Download
memory/456-20-0x0000000000B20000-0x0000000000B41000-memory.dmp

Filesize
132KB

Download
memory/456-19-0x0000000000B20000-0x0000000000B41000-memory.dmp

Filesize
132KB

Download
memory/2408-4-0x0000000002AB0000-0x0000000002AF2000-memory.dmp

Filesize
264KB

Download
memory/2408-5-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/2408-0-0x0000000002AB0000-0x0000000002AF2000-memory.dmp

Filesize
264KB

Download
memory/2408-3-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/2408-1-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/4996-17-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/5112-8-0x0000000000430000-0x0000000000451000-memory.dmp

Filesize
132KB

Download
memory/5112-10-0x0000000000430000-0x0000000000451000-memory.dmp

Filesize
132KB

Download
memory/5112-9-0x0000000000430000-0x0000000000451000-memory.dmp

Filesize
132KB

Download
memory/5112-11-0x0000000000430000-0x0000000000451000-memory.dmp

Filesize
132KB

Download
memory/5112-12-0x0000000000430000-0x0000000000451000-memory.dmp

Filesize
132KB

Download
memory/5112-2-0x0000000000430000-0x0000000000451000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads