qakbot | 12e2a491c7329cc9131a1032580acab9a7a4b86e28797574ce104077b52dd880

General

Target

JaffaCakes118_2a4ab3f3fc2787102b85ad98ded61e67.dll
Size

1.6MB
MD5

2a4ab3f3fc2787102b85ad98ded61e67
SHA1

c4593d5e77931ff4f8c3af7c668bbdd88bec82b3
SHA256

12e2a491c7329cc9131a1032580acab9a7a4b86e28797574ce104077b52dd880
SHA512

32be3d1aaa18afeea5c266ab051bc28db3d77d8005a910667706c51b70f5e48c5946c9464c6d36dc64766343db65ac292c2c8249e2ca82236a23c8dd3c7a2b83
SSDEEP

24576:69mB+XxJ7zUqNS8K6Cx2ffNrC0O60+bPzTk1wK7TpKsd:6UBav7zbS8JCx2fftCv6JLwJ7FKsd

Score

10^/10

qakbot tr 1634541613 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Etakcenil = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Iyvsawowuguw = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
2624	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mseowicmxe	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mseowicmxe\8390612d = 6679223de31f3308a2fc79010f87d5c17fbea1954ef407c23bd7b371a2699c5c2fa3cd36b01422727d0e77a301fce0a3d1edd3a5bc73fa36826e48ff27b55bafd5a7238b6cb72982b9198049000e8884e15a083bd2afdb8935a50168f179c62e5547b3cfcbf391c45edfb8b378041034ffd15227a8275358e1d200691f15531c9c4d7d8333412e4f5574a91fffc4b5a4c8eb496e6ddba58cbf268ab48a84f298209b4d1f449ed31249e904efc9d7633def4ba7dc6c2b279e53bcdddf13f007f025cdb90e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mseowicmxe\396d2634 = 1da48eea70da973e3e8ec59891de50c1075344604b4ee9601745cb20a41f6a0d3a0aacfcc786f8e33798a63e16958d8e56fd05ef4d528ebc66829ae27bce25c0bb271843eec3f0bfb15b5cb2dd78bd752d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mseowicmxe\446569be = 34623941325f2051ed3679438e43c770c9617bf0b73dbedff314b0174f9d4f09f4958e8a254e1e5d3eaaa4c468dd1dfaa54b625f9e799e2eafa9b8342eba7b887c9f90ee289f3bc6da9bca295c1c56e2fce2ee606ecb1c06d4875825b8fa885773fd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mseowicmxe\c946de95 = eb6a2e0707f5592ef333b7a03a443e575f86f9af90088ca8e47d38e7091dfbfad5560ff2863b01f96ff98f330152ea	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mseowicmxe\b60fb163 = 67d1f46eaa93a71739f9e870e091440e63c6bf66649a3a937a43cab5bae76ff5dd791ba746b40f313ac5478d063c77104df7eac7b7e5e0bd498842f9fc3332ce5075db4e290d22e277211eae55a13bdf05aa334fb82acf197b5e1dba1320ff0877463a1f8ea54610	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mseowicmxe\81d14151 = 2ff46b3233c5f557bf82b489c3ec8843a0a8729b45595d7a75b45335f5baca661ab263572598ebf85c0c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mseowicmxe\fcd90edb = 33f6e21b169bc14602dc11e9f595a3cc95790d3ea7f117522b0b77d68274f2f8a7ab36f99a192c2c4c38977e50dd78f17ab81c25c67059f39053cb9676d7855cee03ef6b7db8a9a2319a0f5da113	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mseowicmxe\3b2c0648 = c710f186b3b583c3e07fb56d0b4ff6e0ee9310c8cc2e10e9c418008af7024f38ea78fe34da27ae67cf41579626a50916bab9760353f5ed711a401e722c889d396afcda4af527ce784846bd1dbfa408683b690448f5ab4424caf5a15ab510842664a41e6d081b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mseowicmxe\b60fb163 = 67d1e36eaa93925beb739c3863f88ad390efbdc6f94dc224ff16f0870fd08908cc30efec428f117ee365a67c31aa26b9b91dfadd90b28a792c2659588f799b0520b56ed3d2be5aaf3be1768d5517f7d2415dea5cc2fc05491a9052aca03e15cd3a2f68fb636eb0b39177f89e98e698926ba1e1774aa67df2d750c8eb6b	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3352	rundll32.exe
3352	rundll32.exe
2624	regsvr32.exe
2624	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3352	rundll32.exe
2624	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 3352	4048	rundll32.exe	83
PID 4048 wrote to memory of 3352	4048	rundll32.exe	83
PID 4048 wrote to memory of 3352	4048	rundll32.exe	83
PID 3352 wrote to memory of 1600	3352	rundll32.exe	86
PID 3352 wrote to memory of 1600	3352	rundll32.exe	86
PID 3352 wrote to memory of 1600	3352	rundll32.exe	86
PID 3352 wrote to memory of 1600	3352	rundll32.exe	86
PID 3352 wrote to memory of 1600	3352	rundll32.exe	86
PID 1600 wrote to memory of 2780	1600	explorer.exe	87
PID 1600 wrote to memory of 2780	1600	explorer.exe	87
PID 1600 wrote to memory of 2780	1600	explorer.exe	87
PID 2924 wrote to memory of 2624	2924	regsvr32.exe	104
PID 2924 wrote to memory of 2624	2924	regsvr32.exe	104
PID 2924 wrote to memory of 2624	2924	regsvr32.exe	104
PID 2624 wrote to memory of 3192	2624	regsvr32.exe	105
PID 2624 wrote to memory of 3192	2624	regsvr32.exe	105
PID 2624 wrote to memory of 3192	2624	regsvr32.exe	105
PID 2624 wrote to memory of 3192	2624	regsvr32.exe	105
PID 2624 wrote to memory of 3192	2624	regsvr32.exe	105
PID 3192 wrote to memory of 2640	3192	explorer.exe	106
PID 3192 wrote to memory of 2640	3192	explorer.exe	106
PID 3192 wrote to memory of 868	3192	explorer.exe	108
PID 3192 wrote to memory of 868	3192	explorer.exe	108

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a4ab3f3fc2787102b85ad98ded61e67.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a4ab3f3fc2787102b85ad98ded61e67.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ptudjadk /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a4ab3f3fc2787102b85ad98ded61e67.dll\"" /SC ONCE /Z /ST 15:07 /ET 15:19
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2780

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a4ab3f3fc2787102b85ad98ded61e67.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a4ab3f3fc2787102b85ad98ded61e67.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Etakcenil" /d "0"
      4⤵
      Windows security bypass
      PID:2640
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Iyvsawowuguw" /d "0"
      4⤵
      Windows security bypass
      PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a4ab3f3fc2787102b85ad98ded61e67.dll

Filesize
1.6MB

MD5
2a4ab3f3fc2787102b85ad98ded61e67

SHA1
c4593d5e77931ff4f8c3af7c668bbdd88bec82b3

SHA256
12e2a491c7329cc9131a1032580acab9a7a4b86e28797574ce104077b52dd880

SHA512
32be3d1aaa18afeea5c266ab051bc28db3d77d8005a910667706c51b70f5e48c5946c9464c6d36dc64766343db65ac292c2c8249e2ca82236a23c8dd3c7a2b83

Download Submit
memory/1600-10-0x0000000000F70000-0x0000000000F91000-memory.dmp

Filesize
132KB

Download
memory/1600-14-0x0000000000F70000-0x0000000000F91000-memory.dmp

Filesize
132KB

Download
memory/1600-11-0x0000000000F70000-0x0000000000F91000-memory.dmp

Filesize
132KB

Download
memory/1600-6-0x0000000000F70000-0x0000000000F91000-memory.dmp

Filesize
132KB

Download
memory/1600-12-0x0000000000F70000-0x0000000000F91000-memory.dmp

Filesize
132KB

Download
memory/2624-18-0x0000000073390000-0x000000007353B000-memory.dmp

Filesize
1.7MB

Download
memory/2624-19-0x0000000073390000-0x000000007353B000-memory.dmp

Filesize
1.7MB

Download
memory/2624-22-0x0000000073390000-0x000000007353B000-memory.dmp

Filesize
1.7MB

Download
memory/3192-24-0x0000000000E00000-0x0000000000E21000-memory.dmp

Filesize
132KB

Download
memory/3192-26-0x0000000000E00000-0x0000000000E21000-memory.dmp

Filesize
132KB

Download
memory/3192-25-0x0000000000E00000-0x0000000000E21000-memory.dmp

Filesize
132KB

Download
memory/3352-7-0x0000000074B30000-0x0000000074CDB000-memory.dmp

Filesize
1.7MB

Download
memory/3352-5-0x0000000074B30000-0x0000000074CDB000-memory.dmp

Filesize
1.7MB

Download
memory/3352-4-0x0000000074B30000-0x0000000074CDB000-memory.dmp

Filesize
1.7MB

Download
memory/3352-2-0x0000000074B30000-0x0000000074CDB000-memory.dmp

Filesize
1.7MB

Download
memory/3352-1-0x0000000074CC0000-0x0000000074CC6000-memory.dmp

Filesize
24KB

Download
memory/3352-0-0x0000000074B30000-0x0000000074CDB000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads