qakbot | e055a9749b019a264531d5cb9eec06980f93a74e9e886bf0eba57e9c56f706dd

General

Target

JaffaCakes118_05f82bbe64559994c8bc1d6a6a9055f3.dll
Size

890KB
MD5

05f82bbe64559994c8bc1d6a6a9055f3
SHA1

8d1d5870ffc385c7e1937059795cb7ace08fd551
SHA256

e055a9749b019a264531d5cb9eec06980f93a74e9e886bf0eba57e9c56f706dd
SHA512

0fde6b00425fbac8bf35823dce38b2c5a3e101c77f981f96040dabe8f10911ff5bbac8a22828da3cdaaca827605be68d17c17cb3a755ca3aaf146e72b4f3af42
SSDEEP

24576:svmCko3miQH9ZfSCFEz8uViMKvb/o2ggJcWieQRqg:svme3m1jSCFMKvjjXJcL9qg

Score

10^/10

qakbot biden54 1634810637 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden54

Campaign

1634810637

C2

136.143.11.232:443

63.143.92.99:995

182.176.180.73:443

136.232.34.70:443

123.252.190.14:443

216.201.162.158:443

37.208.181.198:61200

140.82.49.12:443

197.89.144.102:443

89.137.52.44:443

109.12.111.14:443

78.191.24.189:995

105.198.236.99:995

196.207.140.40:995

41.235.69.115:443

2.222.167.138:443

117.198.156.56:443

24.231.209.2:6881

27.223.92.142:995

96.246.158.154:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Pcxpkfb = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Ibnuzydpiss = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
2248	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dslndym	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dslndym\2aef9e8b = 64e244ba38600d355c23017fa1bf68526b8a730d71b01bdfb012cca53c19cc7da1f2dd1741839e0ca2bd0354e2905b22e30ae7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dslndym\ed1a9618 = b48fca8b24b12ae6acb6d77443a4dc5ec3d62a0d839237c0eeddbfb5093c80fc0745fd336b7a3a38fa352c23dcab1b95e8067165c94ae1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dslndym\60392133 = 64526c3e4f28a7c2f6dcff4aaf649ab0cbd2e25c2e4694b7fc40fbdeefc3e9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dslndym\60392133 = 64527b3e4f289209a770	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dslndym\55a6f17d = eb9553bd27bb012ecfb367885625fc44aa8fab723a54aed0f4fce4c575f81aa8c3222432dc89b6e84436961d2f06db9716f7d0bee356fe797429f90f4a26833a3f11a3917923fb73d7146ff31bba03a3105e1465615474e6efc9cfdb336c68710e338168c02b3d351ffd62379a06ab30fb2fb734b95b85d3a100266cb3a896adee5ce6fbcd0e46cb39e7551ca17bf88684fd0c9450f3192dc3ce9646b05b1de4837a11	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dslndym\57e7d101 = 40e2fe75a6676d456f10cace4ae713933a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dslndym\ef5bb664 = 60f7f97a64ad54d1a528815c161b660e36f523	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dslndym\9253f9ee = 6b119df9b9af077cf960abe27342314f8637825be3f9698a3d6c2a3e70d157f06fc9299680fbdfdcf5add745f13d043e390a92c8de930ae74d45cf6a4fcb6de42743a7ba860b3e098793644a578bd8d99c9b12ef6af25349dcc4f9be99f0f354ab8c896c7dee57c6dca4efcf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dslndym\1f704ec5 = 1e7071432927ad4c7d1d1fdc953a5dda8107fff89d06bc21e5619e8431950332a9a3c196dc64	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4876	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1968	rundll32.exe
1968	rundll32.exe
2248	regsvr32.exe
2248	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1968	rundll32.exe
2248	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 1968	3932	rundll32.exe	83
PID 3932 wrote to memory of 1968	3932	rundll32.exe	83
PID 3932 wrote to memory of 1968	3932	rundll32.exe	83
PID 1968 wrote to memory of 2128	1968	rundll32.exe	94
PID 1968 wrote to memory of 2128	1968	rundll32.exe	94
PID 1968 wrote to memory of 2128	1968	rundll32.exe	94
PID 1968 wrote to memory of 2128	1968	rundll32.exe	94
PID 1968 wrote to memory of 2128	1968	rundll32.exe	94
PID 2128 wrote to memory of 4876	2128	explorer.exe	95
PID 2128 wrote to memory of 4876	2128	explorer.exe	95
PID 2128 wrote to memory of 4876	2128	explorer.exe	95
PID 5084 wrote to memory of 2248	5084	regsvr32.exe	101
PID 5084 wrote to memory of 2248	5084	regsvr32.exe	101
PID 5084 wrote to memory of 2248	5084	regsvr32.exe	101
PID 2248 wrote to memory of 4356	2248	regsvr32.exe	102
PID 2248 wrote to memory of 4356	2248	regsvr32.exe	102
PID 2248 wrote to memory of 4356	2248	regsvr32.exe	102
PID 2248 wrote to memory of 4356	2248	regsvr32.exe	102
PID 2248 wrote to memory of 4356	2248	regsvr32.exe	102
PID 4356 wrote to memory of 540	4356	explorer.exe	103
PID 4356 wrote to memory of 540	4356	explorer.exe	103
PID 4356 wrote to memory of 1380	4356	explorer.exe	105
PID 4356 wrote to memory of 1380	4356	explorer.exe	105

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_05f82bbe64559994c8bc1d6a6a9055f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_05f82bbe64559994c8bc1d6a6a9055f3.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn uxvmouvgca /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_05f82bbe64559994c8bc1d6a6a9055f3.dll\"" /SC ONCE /Z /ST 01:18 /ET 01:30
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4876

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_05f82bbe64559994c8bc1d6a6a9055f3.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_05f82bbe64559994c8bc1d6a6a9055f3.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ibnuzydpiss" /d "0"
      4⤵
      Windows security bypass
      PID:540
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Pcxpkfb" /d "0"
      4⤵
      Windows security bypass
      PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_05f82bbe64559994c8bc1d6a6a9055f3.dll

Filesize
890KB

MD5
05f82bbe64559994c8bc1d6a6a9055f3

SHA1
8d1d5870ffc385c7e1937059795cb7ace08fd551

SHA256
e055a9749b019a264531d5cb9eec06980f93a74e9e886bf0eba57e9c56f706dd

SHA512
0fde6b00425fbac8bf35823dce38b2c5a3e101c77f981f96040dabe8f10911ff5bbac8a22828da3cdaaca827605be68d17c17cb3a755ca3aaf146e72b4f3af42

Download Submit
memory/1968-1-0x0000000074B6F000-0x0000000074B75000-memory.dmp

Filesize
24KB

Download
memory/1968-0-0x0000000074A90000-0x0000000074B83000-memory.dmp

Filesize
972KB

Download
memory/1968-2-0x0000000074A90000-0x0000000074B83000-memory.dmp

Filesize
972KB

Download
memory/1968-3-0x0000000074A90000-0x0000000074B83000-memory.dmp

Filesize
972KB

Download
memory/1968-6-0x0000000074A90000-0x0000000074B83000-memory.dmp

Filesize
972KB

Download
memory/2128-9-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Filesize
132KB

Download
memory/2128-11-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Filesize
132KB

Download
memory/2128-10-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Filesize
132KB

Download
memory/2128-13-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Filesize
132KB

Download
memory/2128-5-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Filesize
132KB

Download
memory/2248-17-0x0000000074A00000-0x0000000074AF3000-memory.dmp

Filesize
972KB

Download
memory/2248-18-0x0000000074A00000-0x0000000074AF3000-memory.dmp

Filesize
972KB

Download
memory/2248-20-0x0000000074A00000-0x0000000074AF3000-memory.dmp

Filesize
972KB

Download
memory/4356-22-0x00000000008C0000-0x00000000008E1000-memory.dmp

Filesize
132KB

Download
memory/4356-23-0x00000000008C0000-0x00000000008E1000-memory.dmp

Filesize
132KB

Download
memory/4356-24-0x00000000008C0000-0x00000000008E1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads