qakbot | 800b4347ed6b61a032693968743c4338c01e8ecc363843d4c50487fe3867bbd8

General

Target

JaffaCakes118_2e7546c1ed16e6ca256c9b20c07ddcd3.dll
Size

890KB
MD5

2e7546c1ed16e6ca256c9b20c07ddcd3
SHA1

11f597381fad059b8802af99bbc170c27a976a3a
SHA256

800b4347ed6b61a032693968743c4338c01e8ecc363843d4c50487fe3867bbd8
SHA512

3292f89e4ff952a72695870f8813cc01e40e550080cbce8ae9c36aae00aff797064d11872c05b6c84093cf6b2150827761317f8d3cc1dca3f671c00b2c483cd4
SSDEEP

24576:mvmCkM3miQH9ZfSCFEzIuViMKvb/o2ggJcWMeQRqgc:mvm+3m1jSCFoKvjjXJcl9qgc

Score

10^/10

qakbot biden54 1634810637 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden54

Campaign

1634810637

C2

136.143.11.232:443

63.143.92.99:995

182.176.180.73:443

136.232.34.70:443

123.252.190.14:443

216.201.162.158:443

37.208.181.198:61200

140.82.49.12:443

197.89.144.102:443

89.137.52.44:443

109.12.111.14:443

78.191.24.189:995

105.198.236.99:995

196.207.140.40:995

41.235.69.115:443

2.222.167.138:443

117.198.156.56:443

24.231.209.2:6881

27.223.92.142:995

96.246.158.154:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Fcameqgj = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Cucybiy = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
1632	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aykphizrwskrtk	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aykphizrwskrtk\c43a61c9 = bb55c03f6d5fb05c96df4c3174a9d5bfa89b235dcb5609f2dfc3a7b631adbc6da61a22d14924f10151b48f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aykphizrwskrtk\f1a5b187 = 3ba0017a9f115367b5924f73e121ebfd0a72f85888a4905ba2c53677c084e915f4bb9e1bf175980a67e4db07644b9b608040ef87f54576fbbcafbad58e9a389d37646deb80c1291fcef8ee3b1c2418141d83847e7095350242e26122b677d0a0cceb5cdbee1e4df37b0eeedf72c53acbec79202e7306e609b6cbc8e82f3e35c85d6d854ba22f91727c5a7287ae	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aykphizrwskrtk\f3e491fb = 012a293334dda469d55c3fd823bf3ac0d1d34f0e7a75cc4bb276d81156ffac7f784c0eae879853	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aykphizrwskrtk\4b58f69e = 0cebe298a36d557c3de30f3251a99b1c9320ff1cfd7905dc8d7a5f17f8d78ed8245ad0e47aff389243c34133dc970876e3cfc693b10e1c0b3bddaaf1868de680a9b856467308750ae4ab	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aykphizrwskrtk\4919d6e2 = 944b343d60146349d35e0aa134ea943e2035582ba6331b8e9e5c43b8c97e337eab08e458	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aykphizrwskrtk\bb730e3f = 23c726e6180ba1981d0b8445a1fc2a38f77df142cbc219162a2f6ca5e508dbab981f219fb1e0a458c9466f48d18b50bdaf0942b31654ac75df7d50ff0b8116b610020f3c41c05aae73eaefa0935355333f2b43526284e2e6b6a03f0893e0d88d0cb28e3df7ce70b2008451f241	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aykphizrwskrtk\c43a61c9 = bb55d73f6d5f855621e2efa3e87177811b6df1647f8a3900c7001e37e6561a1f97d2f5c52a44bd6f7d774372ed476073fa287aad9f3458b76b5ff8a5361397a8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aykphizrwskrtk\3650b914 = 5370ae1a8629d9c3854f417458e7cb861000e57d52fd86018275bcbd0e08e27753819a2551a15e34d0aef2d29fb743843270bf7c52d43eb3b88e47be4807252de14bd23a7d39f8b764917d7451eca4bca7c9dbbdb1f36707	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aykphizrwskrtk\8eecde71 = 362d4785adf642a3a9f4ada284664d15ee80ede499548d090494b7af9a79138a588ef70a6f34d6ce8f34f50f110f3c3bd21e1ea71ad476dd57d6bb	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4236	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4268	rundll32.exe
4268	rundll32.exe
1632	regsvr32.exe
1632	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4268	rundll32.exe
1632	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 4268	3096	rundll32.exe	83
PID 3096 wrote to memory of 4268	3096	rundll32.exe	83
PID 3096 wrote to memory of 4268	3096	rundll32.exe	83
PID 4268 wrote to memory of 2788	4268	rundll32.exe	93
PID 4268 wrote to memory of 2788	4268	rundll32.exe	93
PID 4268 wrote to memory of 2788	4268	rundll32.exe	93
PID 4268 wrote to memory of 2788	4268	rundll32.exe	93
PID 4268 wrote to memory of 2788	4268	rundll32.exe	93
PID 2788 wrote to memory of 4236	2788	explorer.exe	97
PID 2788 wrote to memory of 4236	2788	explorer.exe	97
PID 2788 wrote to memory of 4236	2788	explorer.exe	97
PID 1876 wrote to memory of 1632	1876	regsvr32.exe	105
PID 1876 wrote to memory of 1632	1876	regsvr32.exe	105
PID 1876 wrote to memory of 1632	1876	regsvr32.exe	105
PID 1632 wrote to memory of 4420	1632	regsvr32.exe	106
PID 1632 wrote to memory of 4420	1632	regsvr32.exe	106
PID 1632 wrote to memory of 4420	1632	regsvr32.exe	106
PID 1632 wrote to memory of 4420	1632	regsvr32.exe	106
PID 1632 wrote to memory of 4420	1632	regsvr32.exe	106
PID 4420 wrote to memory of 3948	4420	explorer.exe	107
PID 4420 wrote to memory of 3948	4420	explorer.exe	107
PID 4420 wrote to memory of 728	4420	explorer.exe	109
PID 4420 wrote to memory of 728	4420	explorer.exe	109

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2e7546c1ed16e6ca256c9b20c07ddcd3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2e7546c1ed16e6ca256c9b20c07ddcd3.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yscltnbxw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2e7546c1ed16e6ca256c9b20c07ddcd3.dll\"" /SC ONCE /Z /ST 16:37 /ET 16:49
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4236

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2e7546c1ed16e6ca256c9b20c07ddcd3.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2e7546c1ed16e6ca256c9b20c07ddcd3.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Fcameqgj" /d "0"
      4⤵
      Windows security bypass
      PID:3948
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Cucybiy" /d "0"
      4⤵
      Windows security bypass
      PID:728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2e7546c1ed16e6ca256c9b20c07ddcd3.dll

Filesize
890KB

MD5
2e7546c1ed16e6ca256c9b20c07ddcd3

SHA1
11f597381fad059b8802af99bbc170c27a976a3a

SHA256
800b4347ed6b61a032693968743c4338c01e8ecc363843d4c50487fe3867bbd8

SHA512
3292f89e4ff952a72695870f8813cc01e40e550080cbce8ae9c36aae00aff797064d11872c05b6c84093cf6b2150827761317f8d3cc1dca3f671c00b2c483cd4

Download Submit
memory/1632-20-0x0000000074DB0000-0x0000000074EA3000-memory.dmp

Filesize
972KB

Download
memory/1632-18-0x0000000074DB0000-0x0000000074EA3000-memory.dmp

Filesize
972KB

Download
memory/1632-17-0x0000000074DB0000-0x0000000074EA3000-memory.dmp

Filesize
972KB

Download
memory/2788-5-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2788-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2788-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2788-9-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2788-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4268-6-0x0000000074E40000-0x0000000074F33000-memory.dmp

Filesize
972KB

Download
memory/4268-1-0x0000000074F1F000-0x0000000074F25000-memory.dmp

Filesize
24KB

Download
memory/4268-3-0x0000000074E40000-0x0000000074F33000-memory.dmp

Filesize
972KB

Download
memory/4268-2-0x0000000074E40000-0x0000000074F33000-memory.dmp

Filesize
972KB

Download
memory/4268-0-0x0000000074E40000-0x0000000074F33000-memory.dmp

Filesize
972KB

Download
memory/4420-22-0x0000000001450000-0x0000000001471000-memory.dmp

Filesize
132KB

Download
memory/4420-23-0x0000000001450000-0x0000000001471000-memory.dmp

Filesize
132KB

Download
memory/4420-24-0x0000000001450000-0x0000000001471000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads