qakbot | e60cc81f630400a2fda362feb1d54fbbb9974f73232139b0c7af38b70408b9e7

General

Target

JaffaCakes118_1b3aaa8206bb7fe453d79379d5b6ae72.dll
Size

689KB
MD5

1b3aaa8206bb7fe453d79379d5b6ae72
SHA1

96caed40aac51f3cb119a5edeb7a8b10c8b75a15
SHA256

e60cc81f630400a2fda362feb1d54fbbb9974f73232139b0c7af38b70408b9e7
SHA512

92b642b9b7d5de9eb608ef7fd3c6b0a0df360f0edef9f3f29eff60acc89973bc499cc6b1ef6802c8086bbe5b6496e12fa60b035ea36820c1c188cf4421c25f56
SSDEEP

12288:1rI0bPKn8p/S0jXgfFWVkMXl2xAgwFX2dpG83tNzZ0XssC82H6/vLy2MAc:VI0bP1XWMXsAZX6tcTLFM3

Score

10^/10

qakbot obama117 1634545803 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama117

Campaign

1634545803

C2

176.45.53.222:443

220.255.25.28:2222

91.178.126.51:995

2.222.167.138:443

65.100.174.110:995

105.198.236.99:995

115.96.64.9:995

196.207.140.40:995

24.231.209.2:2222

146.66.238.74:443

103.82.211.39:995

65.100.174.110:443

103.142.10.177:443

140.82.49.12:443

78.105.213.151:995

41.86.42.158:995

89.101.97.139:443

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Yzxflrgm = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Iggxscontyfb = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
212	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zzwuatu\bfd03608 = aabd138da86a793d6cbf65c8a7a0f49f0c2ce98a2b6f2e42f4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zzwuatu\32f38123 = 0defa025c4f33d2bdbbdad0315b78fd116a24781e9231f3cdb45a82026d3055187f2c1ff69bff56fee07da307900413afe4f92bff2feb69502fcc46cb66d7f98562b694826ddc462354bc556c9935a22e0d76532908ae40f6ff51747024b4a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zzwuatu\32f38123 = 0defb725c4f308a7c27019a38834758f6076225032a0d52fb87d7309973eec0657154263fdf6b165bb57d260d5cb79adfa8c769c381c780c0ae88f41d0bff62f22e9718519cf76d96348	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zzwuatu\76c516d = be745f6bcb85d206fc1461ca1f01109b6d8c2d75cb788310f7edd861a8c01c1cbf3c0fe76a05eccbc59e7ad32cc222a8552ddbeb0fce14dadd7bae0f9edc2f06870e2d09afba0e5a1d61d2ff85452f8d3b41e3fd5be88f1e8b8d3fe2b3800e8cea295e1bb020ea35d4f37ba29f769af5839664d450bc34401ceab5e092099f7732d778af6e252febf30f291db6ff5a8d22f0b3bc04eef417f4db	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zzwuatu\52d7111 = b569c26063aad243f8fd9d0ef43601a3c5360fabf634eb5f7d2a4558a4da692654000027058f81be39846ad3b0c5a058bc6d4d650c0a9c7b15c23eef85	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zzwuatu\78253e9b = 4080339bd3dcfd8f86d4064d44746a1bbaf14c2aa859e2967572ad209951307ba32ae3bb6481f8768acd80495dfaf5e56dced16e81120cd07c407f470ed48455e246c992c27c0daa0d5599be05c20645a12ff78d4851	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zzwuatu	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zzwuatu\bd911674 = ee8c9dc5fd0ca23feaf13a3160a4e1a915b0ad3968c2611dab5207e0fe76	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zzwuatu\c09959fe = c3c556e958d7740b1778a4cc29b3450a987c461d9082b521fa4c2b8950c772f0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zzwuatu\4dbaeed5 = bac7d67e06970da9ddc8f0e866082e96710b11080880372049f6867191c38e2e4271ae6232b45184074852ffac9cf43c110d15e861669350d7628bbdfe781260ccaf879c0eaa1ae2a52d10a94f78f990b58c9cf511db839f935131e6a1e758003965db338b	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
844	rundll32.exe
844	rundll32.exe
212	regsvr32.exe
212	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
844	rundll32.exe
212	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 844	5096	rundll32.exe	83
PID 5096 wrote to memory of 844	5096	rundll32.exe	83
PID 5096 wrote to memory of 844	5096	rundll32.exe	83
PID 844 wrote to memory of 1620	844	rundll32.exe	93
PID 844 wrote to memory of 1620	844	rundll32.exe	93
PID 844 wrote to memory of 1620	844	rundll32.exe	93
PID 844 wrote to memory of 1620	844	rundll32.exe	93
PID 844 wrote to memory of 1620	844	rundll32.exe	93
PID 1620 wrote to memory of 2016	1620	explorer.exe	94
PID 1620 wrote to memory of 2016	1620	explorer.exe	94
PID 1620 wrote to memory of 2016	1620	explorer.exe	94
PID 1060 wrote to memory of 212	1060	regsvr32.exe	104
PID 1060 wrote to memory of 212	1060	regsvr32.exe	104
PID 1060 wrote to memory of 212	1060	regsvr32.exe	104
PID 212 wrote to memory of 3040	212	regsvr32.exe	105
PID 212 wrote to memory of 3040	212	regsvr32.exe	105
PID 212 wrote to memory of 3040	212	regsvr32.exe	105
PID 212 wrote to memory of 3040	212	regsvr32.exe	105
PID 212 wrote to memory of 3040	212	regsvr32.exe	105
PID 3040 wrote to memory of 4364	3040	explorer.exe	106
PID 3040 wrote to memory of 4364	3040	explorer.exe	106
PID 3040 wrote to memory of 3024	3040	explorer.exe	108
PID 3040 wrote to memory of 3024	3040	explorer.exe	108

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b3aaa8206bb7fe453d79379d5b6ae72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b3aaa8206bb7fe453d79379d5b6ae72.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ktglfxbr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b3aaa8206bb7fe453d79379d5b6ae72.dll\"" /SC ONCE /Z /ST 12:28 /ET 12:40
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2016

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b3aaa8206bb7fe453d79379d5b6ae72.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b3aaa8206bb7fe453d79379d5b6ae72.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Yzxflrgm" /d "0"
      4⤵
      Windows security bypass
      PID:4364
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Iggxscontyfb" /d "0"
      4⤵
      Windows security bypass
      PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b3aaa8206bb7fe453d79379d5b6ae72.dll

Filesize
689KB

MD5
1b3aaa8206bb7fe453d79379d5b6ae72

SHA1
96caed40aac51f3cb119a5edeb7a8b10c8b75a15

SHA256
e60cc81f630400a2fda362feb1d54fbbb9974f73232139b0c7af38b70408b9e7

SHA512
92b642b9b7d5de9eb608ef7fd3c6b0a0df360f0edef9f3f29eff60acc89973bc499cc6b1ef6802c8086bbe5b6496e12fa60b035ea36820c1c188cf4421c25f56

Download Submit
memory/212-22-0x00000000731E0000-0x000000007329D000-memory.dmp

Filesize
756KB

Download
memory/212-21-0x00000000731E0000-0x000000007329D000-memory.dmp

Filesize
756KB

Download
memory/212-19-0x00000000731E0000-0x000000007329D000-memory.dmp

Filesize
756KB

Download
memory/212-18-0x00000000731E0000-0x000000007329D000-memory.dmp

Filesize
756KB

Download
memory/844-2-0x000000007494C000-0x0000000074952000-memory.dmp

Filesize
24KB

Download
memory/844-3-0x00000000748A0000-0x000000007495D000-memory.dmp

Filesize
756KB

Download
memory/844-5-0x00000000748A0000-0x000000007495D000-memory.dmp

Filesize
756KB

Download
memory/844-0-0x00000000748A0000-0x000000007495D000-memory.dmp

Filesize
756KB

Download
memory/844-7-0x00000000748A0000-0x000000007495D000-memory.dmp

Filesize
756KB

Download
memory/1620-6-0x0000000000550000-0x0000000000571000-memory.dmp

Filesize
132KB

Download
memory/1620-14-0x0000000000550000-0x0000000000571000-memory.dmp

Filesize
132KB

Download
memory/1620-11-0x0000000000550000-0x0000000000571000-memory.dmp

Filesize
132KB

Download
memory/1620-12-0x0000000000550000-0x0000000000571000-memory.dmp

Filesize
132KB

Download
memory/1620-10-0x0000000000550000-0x0000000000571000-memory.dmp

Filesize
132KB

Download
memory/3040-24-0x0000000000830000-0x0000000000851000-memory.dmp

Filesize
132KB

Download
memory/3040-25-0x0000000000830000-0x0000000000851000-memory.dmp

Filesize
132KB

Download
memory/3040-26-0x0000000000830000-0x0000000000851000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads