qakbot | 615e6d39f293de56a632047eea507a7a05793285caf018e1b7fc1d6ce490bb1a

General

Target

JaffaCakes118_2b136149c73629d88dc48e8537ca03c5.dll
Size

1.2MB
MD5

2b136149c73629d88dc48e8537ca03c5
SHA1

06cef49494f0d239f76f5aa011b9a08db6a41578
SHA256

615e6d39f293de56a632047eea507a7a05793285caf018e1b7fc1d6ce490bb1a
SHA512

79cf5b8ef4c2601db94b033492ef8dd0a670ae94220df908a13c5f2f0f2a8d08ec4d643545388fb43ee2f5e256483453afe294bfb446ab1f48861069bade9e9d
SSDEEP

24576:m/o9iBRudBYZb/WqWletdadgndrqnq/wKkVW:YRuEbeqWYMqnFY2IW

Score

10^/10

qakbot tr 1634905513 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634905513

C2

27.5.5.31:2222

136.143.11.232:443

68.186.192.69:443

117.198.157.160:443

108.4.67.252:443

207.246.112.221:995

105.198.236.99:995

37.208.181.198:61200

115.99.227.13:995

140.82.49.12:443

188.50.34.167:995

216.201.162.158:443

103.142.10.177:443

197.89.21.241:443

73.25.109.183:2222

81.250.153.227:2222

2.222.167.138:443

78.191.24.189:995

87.242.20.233:2222

89.101.97.139:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Keosckyipwi = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Mkyksu = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
4980	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uxrlgvugsdlve	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uxrlgvugsdlve\ef6b5b48 = 196c09604d5e12efd1e4c585f1078f587c6266a8ce9c990d71f486bb83bcd8e344569ff9a8562b2f83bfe2b4e120873f26b24538ace4dc1a1bde1ae693e79770fa2fac7dd94f89b7bf27d96cd19bcc3adca7c3acc23f2e15fba5f62c990e749365bc84edeb5af324713abe66	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uxrlgvugsdlve\1d018395 = 43f4f47b572fe8ccd8a7ff4cfb826d5150cbfa45e0b70caecefb10d6cb685f377785114ff143e9c9a6009fdbb4006a4d294a6e882a6c38e07e896c57e4d410a920512eaf3c9c33241d53d493e3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uxrlgvugsdlve\6248ec63 = d50683da93d1dfe592762a5f19e6c88f0b3e9c57e00bd5b2d29386921c7f1825a11b0cf501793ff076c7307f44daf008eacaa159e49093942f54d28ade2b37c20346694dcf878df3791a205c82f5fae08c6055326cb0b34996e455fb034d5de68253b2eed910e524e90c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uxrlgvugsdlve\6248ec63 = d50694da93d1ea5be3df062cb3534eccb645efa7e4e6b3082ab0fc467a41314a2d65c042643e49fc7d587117912d422bf7c5645726ddd09755fac3b02cce9cecd3cf93def3b877346297ba508752e4e06eb52b5234	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uxrlgvugsdlve\57d73c2d = c63a4b7056e7253c6001d8beff5ffcb9bba0356b44c79b4e1f80bf281d0e5d5f34b852b467bdf4a04dcddffcc5e1c2f2a33f06d5951cb0da228f44d8ae1b2cc5560a5e7305881286252a5bc102f8796d7b5bb2c169d764ce8fc860f0ab4678c42b88d9a1910d3f9dfc6934bdeeb15e2d1a85d0559b30b5ff53bd0e989b578d153f7422b402d1611d80811c301c439026e19a6f6e8c750edd3ac6e2a70a129cab488c7abe83ad7123af0fc792b5fe9d0d4dc4465e3bf8337705696e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uxrlgvugsdlve\55961c51 = 67a876cd4a0a4dd857ba484d08b2bea3089f06e72323e3b9cfceb3f9a67bde9155fc187669ceb4743caf408e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uxrlgvugsdlve\ed2a7b34 = 1af95656f5ff5d1359d85da38ce92a7ae168921060cb43e71016283cddcd43b33debe1f6243ce6e942a70358fe11b27703e66fd345e12211ea2bb49c6d851f25b318b656f0008ae8945a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uxrlgvugsdlve\902234be = f6b92385ed199d59c7cb374de561b5aac4e3913abfbf5236c8ccdd7f8a1e71ad0fcfcaf555b4fbedc431ac0eccc1425d0d7765a2fb35f173b1ec18293453799beb24c1bd1aa85c151931f4d22921bff95646dde9784a448b046baaa1fb87c95e23ce90fe52d548e6b0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uxrlgvugsdlve\289e53db = d7fef202ba3f9d7b4df53d9ca1bb5e311c4680e1745422d4645233fdfbbbfabd5f1e857f8467c70f9561cecc1110e32ccb97b624ab2a52562708a369bff0e56b06bb39e1dc5f73f50f9f8e88129c8f255063fc97b76b58c7c979d65fcc09e5d59b66bf0ba30d72a3	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2448	rundll32.exe
2448	rundll32.exe
4980	regsvr32.exe
4980	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2448	rundll32.exe
4980	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 2448	3852	rundll32.exe	82
PID 3852 wrote to memory of 2448	3852	rundll32.exe	82
PID 3852 wrote to memory of 2448	3852	rundll32.exe	82
PID 2448 wrote to memory of 2080	2448	rundll32.exe	88
PID 2448 wrote to memory of 2080	2448	rundll32.exe	88
PID 2448 wrote to memory of 2080	2448	rundll32.exe	88
PID 2448 wrote to memory of 2080	2448	rundll32.exe	88
PID 2448 wrote to memory of 2080	2448	rundll32.exe	88
PID 2080 wrote to memory of 3344	2080	explorer.exe	89
PID 2080 wrote to memory of 3344	2080	explorer.exe	89
PID 2080 wrote to memory of 3344	2080	explorer.exe	89
PID 656 wrote to memory of 4980	656	regsvr32.exe	96
PID 656 wrote to memory of 4980	656	regsvr32.exe	96
PID 656 wrote to memory of 4980	656	regsvr32.exe	96
PID 4980 wrote to memory of 3252	4980	regsvr32.exe	97
PID 4980 wrote to memory of 3252	4980	regsvr32.exe	97
PID 4980 wrote to memory of 3252	4980	regsvr32.exe	97
PID 4980 wrote to memory of 3252	4980	regsvr32.exe	97
PID 4980 wrote to memory of 3252	4980	regsvr32.exe	97
PID 3252 wrote to memory of 228	3252	explorer.exe	98
PID 3252 wrote to memory of 228	3252	explorer.exe	98
PID 3252 wrote to memory of 4988	3252	explorer.exe	100
PID 3252 wrote to memory of 4988	3252	explorer.exe	100

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b136149c73629d88dc48e8537ca03c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b136149c73629d88dc48e8537ca03c5.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rqfvzbfxzk /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b136149c73629d88dc48e8537ca03c5.dll\"" /SC ONCE /Z /ST 15:24 /ET 15:36
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3344

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b136149c73629d88dc48e8537ca03c5.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:656
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b136149c73629d88dc48e8537ca03c5.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Keosckyipwi" /d "0"
      4⤵
      Windows security bypass
      PID:228
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Mkyksu" /d "0"
      4⤵
      Windows security bypass
      PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b136149c73629d88dc48e8537ca03c5.dll

Filesize
1.2MB

MD5
2b136149c73629d88dc48e8537ca03c5

SHA1
06cef49494f0d239f76f5aa011b9a08db6a41578

SHA256
615e6d39f293de56a632047eea507a7a05793285caf018e1b7fc1d6ce490bb1a

SHA512
79cf5b8ef4c2601db94b033492ef8dd0a670ae94220df908a13c5f2f0f2a8d08ec4d643545388fb43ee2f5e256483453afe294bfb446ab1f48861069bade9e9d

Download Submit
memory/2080-10-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Filesize
132KB

Download
memory/2080-6-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Filesize
132KB

Download
memory/2080-11-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Filesize
132KB

Download
memory/2080-12-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Filesize
132KB

Download
memory/2080-14-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Filesize
132KB

Download
memory/2448-7-0x0000000074890000-0x00000000749C6000-memory.dmp

Filesize
1.2MB

Download
memory/2448-0-0x0000000074890000-0x00000000749C6000-memory.dmp

Filesize
1.2MB

Download
memory/2448-5-0x0000000074890000-0x00000000749C6000-memory.dmp

Filesize
1.2MB

Download
memory/2448-4-0x00000000749B6000-0x00000000749BC000-memory.dmp

Filesize
24KB

Download
memory/2448-2-0x0000000074890000-0x00000000749C6000-memory.dmp

Filesize
1.2MB

Download
memory/3252-25-0x0000000000430000-0x0000000000451000-memory.dmp

Filesize
132KB

Download
memory/3252-26-0x0000000000430000-0x0000000000451000-memory.dmp

Filesize
132KB

Download
memory/3252-27-0x0000000000430000-0x0000000000451000-memory.dmp

Filesize
132KB

Download
memory/4980-18-0x0000000074800000-0x0000000074936000-memory.dmp

Filesize
1.2MB

Download
memory/4980-23-0x0000000074800000-0x0000000074936000-memory.dmp

Filesize
1.2MB

Download
memory/4980-21-0x0000000074800000-0x0000000074936000-memory.dmp

Filesize
1.2MB

Download
memory/4980-19-0x0000000074800000-0x0000000074936000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads