qakbot | 4eebacf9b5e2267f88df9011b3f6027116a2b765a4eb34bade925892705a9dab

General

Target

JaffaCakes118_591c417ad8fe1811a1716c513ce86500.dll
Size

572KB
MD5

591c417ad8fe1811a1716c513ce86500
SHA1

d2ce8d500ba3b56a2dd020c7d48e2a253c0993bc
SHA256

4eebacf9b5e2267f88df9011b3f6027116a2b765a4eb34bade925892705a9dab
SHA512

56c252c7d8e8d4e49b4d7731e6219fbebe91626294f59d4e1c1101145cafc8e152dcdd275add832e7e298688bde79698b0981cccce946708f7ca2a20b8a93016
SSDEEP

6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eHu:VvAfLfaEkAz5J

Score

10^/10

qakbot obama114 1634112211 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

C2

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Ggdafcqs = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Oyeapswoixu = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
932	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Irxvxrw\1b4373ff = 5557f7b4e07f8657226d377e63dfc6957ec28520e79c68e84c1019b748366e135406bcbf5f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Irxvxrw\a3ff149a = 73a957910e4cbb57a1c5a751818e7141166a5a44df68277a5466b460579855ceb04f56697817bd4521c60286676a9f27de9181ad3e271d2ce7865cf016743826f367df5d25256c46191643be9b81653c74	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Irxvxrw\640a1c09 = 9ecff3a6d1718b447a2e210c50eb87ff313fd5869d20d12a35cb4547e1adffac9e9a7098e0d080aee80920ea939722f39f7c90dd6e1dd809bf7638bb23de5529b71e7c6c85715e4f5f0a3987cd52d4240021287d3de02a122f38c49b05188b85b4f9326d66	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Irxvxrw\9660c4d4 = bd6661b34c9802b7c01f7a55a679bb31e21e8fdb35894f8afe3f85996f7f7b8a38c9e59a42ac5f320b67	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Irxvxrw	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Irxvxrw\e929ab22 = 5a14ed55c605b01104fe646f6c070cbaf05da1d00f871ed6792563b706114f240e4a622dade324371f24e4a6afce046fefb496e1829d5fb1ac17d0b3a394bfedab5506c75cf7368c0800610a7e0fad0d140e14f85a831204f9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Irxvxrw\dcb67b6c = 90e4e8f03081912cb8b0a59d99333fbf3c80ac2b65ce74906a923d4cdd16173f77b5f5b3a83ad8d979f9bc16d01acad1544fb08da472f21c892ab559171750957cfccbc62d05ff11a4b7d15b05ed0315a2cd030b76fe1625922cfb4939be0574f652395e99c32f8b892ba6c96906af3dddd226e6b9e4fe60224547e419e785be8b5ae83123b81f0aef1651dafaeaf12e997fa279d27a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Irxvxrw\def75b10 = 9448599489d48d4cad745e20f22257c08089f4fc47ead7d45c9af57b72f41ff5ac5fba4980dba41a2394d76bf07915a4c0b3b5b53388e9637415ef311666699431c0b9110f83	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Irxvxrw\e929ab22 = 5a14fa55c60585f12e9060178238d0d7534a860785cd178ab046b11db5f4fad1a8d154f9964a9a21cd3770c8ab8faf615da5fc51aecc77764e42d403b92139b89a3e666417b5afa54621ddc53ab5009c1f4961420a58946f13eaf3994b74b60f4a2079e2d44aa0e6785039457f72	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Irxvxrw\664b3c75 = 87a1b0ccf30220e349616e8d3d46e02275760076	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3272	rundll32.exe
3272	rundll32.exe
932	regsvr32.exe
932	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3272	rundll32.exe
932	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 3272	2040	rundll32.exe	83
PID 2040 wrote to memory of 3272	2040	rundll32.exe	83
PID 2040 wrote to memory of 3272	2040	rundll32.exe	83
PID 3272 wrote to memory of 4836	3272	rundll32.exe	84
PID 3272 wrote to memory of 4836	3272	rundll32.exe	84
PID 3272 wrote to memory of 4836	3272	rundll32.exe	84
PID 3272 wrote to memory of 4836	3272	rundll32.exe	84
PID 3272 wrote to memory of 4836	3272	rundll32.exe	84
PID 4836 wrote to memory of 2588	4836	explorer.exe	85
PID 4836 wrote to memory of 2588	4836	explorer.exe	85
PID 4836 wrote to memory of 2588	4836	explorer.exe	85
PID 2572 wrote to memory of 932	2572	regsvr32.exe	105
PID 2572 wrote to memory of 932	2572	regsvr32.exe	105
PID 2572 wrote to memory of 932	2572	regsvr32.exe	105
PID 932 wrote to memory of 2036	932	regsvr32.exe	106
PID 932 wrote to memory of 2036	932	regsvr32.exe	106
PID 932 wrote to memory of 2036	932	regsvr32.exe	106
PID 932 wrote to memory of 2036	932	regsvr32.exe	106
PID 932 wrote to memory of 2036	932	regsvr32.exe	106
PID 2036 wrote to memory of 5088	2036	explorer.exe	107
PID 2036 wrote to memory of 5088	2036	explorer.exe	107
PID 2036 wrote to memory of 444	2036	explorer.exe	109
PID 2036 wrote to memory of 444	2036	explorer.exe	109

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_591c417ad8fe1811a1716c513ce86500.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_591c417ad8fe1811a1716c513ce86500.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fbbjdhwl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_591c417ad8fe1811a1716c513ce86500.dll\"" /SC ONCE /Z /ST 14:45 /ET 14:57
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2588

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_591c417ad8fe1811a1716c513ce86500.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_591c417ad8fe1811a1716c513ce86500.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Oyeapswoixu" /d "0"
      4⤵
      Windows security bypass
      PID:5088
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ggdafcqs" /d "0"
      4⤵
      Windows security bypass
      PID:444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_591c417ad8fe1811a1716c513ce86500.dll

Filesize
572KB

MD5
591c417ad8fe1811a1716c513ce86500

SHA1
d2ce8d500ba3b56a2dd020c7d48e2a253c0993bc

SHA256
4eebacf9b5e2267f88df9011b3f6027116a2b765a4eb34bade925892705a9dab

SHA512
56c252c7d8e8d4e49b4d7731e6219fbebe91626294f59d4e1c1101145cafc8e152dcdd275add832e7e298688bde79698b0981cccce946708f7ca2a20b8a93016

Download Submit
memory/932-18-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2036-21-0x0000000001060000-0x0000000001081000-memory.dmp

Filesize
132KB

Download
memory/2036-22-0x0000000001060000-0x0000000001081000-memory.dmp

Filesize
132KB

Download
memory/2036-20-0x0000000001060000-0x0000000001081000-memory.dmp

Filesize
132KB

Download
memory/3272-4-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/3272-5-0x0000000002E10000-0x0000000002E45000-memory.dmp

Filesize
212KB

Download
memory/3272-6-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/3272-0-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/3272-2-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/3272-1-0x0000000002E10000-0x0000000002E45000-memory.dmp

Filesize
212KB

Download
memory/4836-9-0x00000000008A0000-0x00000000008C1000-memory.dmp

Filesize
132KB

Download
memory/4836-11-0x00000000008A0000-0x00000000008C1000-memory.dmp

Filesize
132KB

Download
memory/4836-10-0x00000000008A0000-0x00000000008C1000-memory.dmp

Filesize
132KB

Download
memory/4836-13-0x00000000008A0000-0x00000000008C1000-memory.dmp

Filesize
132KB

Download
memory/4836-3-0x00000000008A0000-0x00000000008C1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads