qakbot | a002168733fcbcbb1b5d1ce932668d52238f20c186e0d1192b7c56f09c582240

General

Target

JaffaCakes118_2c714ed80a5a35bbbd7fe6565fcdb13c.dll
Size

572KB
MD5

2c714ed80a5a35bbbd7fe6565fcdb13c
SHA1

c71788eee393c9c35671b6bf414424fd6172cb12
SHA256

a002168733fcbcbb1b5d1ce932668d52238f20c186e0d1192b7c56f09c582240
SHA512

a737192e768d8191d393aaeea9af744ffe14e10acb53895178cf3795d2b7b0b63a02f100dcc58d63a248cc10039c18a65a1bfe1c15640f7189bff7a46cb3e41d
SSDEEP

6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eH5:VvAfLfaEkAz52

Score

10^/10

qakbot obama114 1634112211 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

C2

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Rzsgeou = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Qikdnhn = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
3708	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oapixyfunyog	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oapixyfunyog\6212b787 = 0c76fee89a9d92442041d33b49cc255a58b77e4db979e545c7a5d414f27f6917180880f593cebcfa710a95fa98c4babafa376de36404de1de4fab832e07b33f6f3a6a9a3567288e0d84faa729a5bcb80a3aad76d8b133ea656a0e81c37a9ae7306f6817670a500b4ee29a552000a828aa9026f9712ff00fe6e7c96800e353c4b8884f6c99860d11dddb8c9f923f8d02f02c31a430eea60c56ac6ff	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oapixyfunyog\d8eff09e = 527eb31fd01d5d6f586ff745e3b98e7b72c2aafa5b96046deacbfc46e01808eaaa764d18863344d2a9cfe77d16db93758448ab9b7f0403d4b961e30c8ca55a98cdc901269bbd17ddb482d3b0ee49465d8661fadf9eb9cf19bb6296f9e655	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oapixyfunyog\a5e7bf14 = 85e31e166a67b4ad921a46ddb3423981cd8377f33168928280ed46d5ceabf2f331	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oapixyfunyog\daaed0e2 = 93bbda6c3cc9c740ea0db6775f86890c1437d8d9840d17a2a3a846b65c3a4519bbe0ebbe05fc7f8d7dff3d87e1f350d7b75175fec9934f2e0d5ef6ca0dc286043ba22d132a714321a7da1b93b508b392925dac518de92599492227e259d42caabdd6069e31c1e442d37c08c8fcb455	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oapixyfunyog\578d67c9 = 093b6d2de5bd74afe21daa6450af0cf47dbcdb5b622c060d473b09a989036119aafb90e3ebaca4fef7a1b44d682f78bb2c2c65563acc681533fe2044707b6949d2451beeac7c8a677586d3d7cf8c078c9f0eb0a328b6bd6af7a0434e87bdb3ce01d848ae8cde6d799f0b1db39eff1ab2c97c1bb2399838b125e150f8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oapixyfunyog\578d67c9 = 093b7a2de5bd414bac81bc2682a610d620f28308c95e96af084349dbc494a7911d39816deffb827b7301ee7a6fa23d35b8a9209e3eeb91b6726e520f3cfd7ce59816b05c78752119d9417f32abd217266cde51075e7b917b746aff39f479486055825be78b3755	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oapixyfunyog\605397fb = 5d3f44fd39fa83f6e115d531740ba17c3a7973b84e25d237e706adae742b2ba45a10c3ac1fada8719806e93fcd0a9b7f378cc8946fe78c4e518f041b0f67cd11b6b1fa3eb2260ae1a4f0d6b5373c474c5c35e503a51ddc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oapixyfunyog\1d5bd871 = e2f95df593482a40cb98da0aa662b4c11808936931ef21ff595ac4c0159c1c7ca609e24b2becf38ee1de198b523272d83f5e37b022eaa12edd245e4e1c4c9386b9bf68d04f61b900ba816511b1cf73bcb03df5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oapixyfunyog\28c4083f = fc7c9e9c75df065ddec09d454208	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3508	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3760	rundll32.exe
3760	rundll32.exe
3708	regsvr32.exe
3708	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3760	rundll32.exe
3708	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 3760	964	rundll32.exe	85
PID 964 wrote to memory of 3760	964	rundll32.exe	85
PID 964 wrote to memory of 3760	964	rundll32.exe	85
PID 3760 wrote to memory of 960	3760	rundll32.exe	86
PID 3760 wrote to memory of 960	3760	rundll32.exe	86
PID 3760 wrote to memory of 960	3760	rundll32.exe	86
PID 3760 wrote to memory of 960	3760	rundll32.exe	86
PID 3760 wrote to memory of 960	3760	rundll32.exe	86
PID 960 wrote to memory of 3508	960	explorer.exe	87
PID 960 wrote to memory of 3508	960	explorer.exe	87
PID 960 wrote to memory of 3508	960	explorer.exe	87
PID 4404 wrote to memory of 3708	4404	regsvr32.exe	107
PID 4404 wrote to memory of 3708	4404	regsvr32.exe	107
PID 4404 wrote to memory of 3708	4404	regsvr32.exe	107
PID 3708 wrote to memory of 1528	3708	regsvr32.exe	108
PID 3708 wrote to memory of 1528	3708	regsvr32.exe	108
PID 3708 wrote to memory of 1528	3708	regsvr32.exe	108
PID 3708 wrote to memory of 1528	3708	regsvr32.exe	108
PID 3708 wrote to memory of 1528	3708	regsvr32.exe	108
PID 1528 wrote to memory of 912	1528	explorer.exe	109
PID 1528 wrote to memory of 912	1528	explorer.exe	109
PID 1528 wrote to memory of 2880	1528	explorer.exe	111
PID 1528 wrote to memory of 2880	1528	explorer.exe	111

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2c714ed80a5a35bbbd7fe6565fcdb13c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2c714ed80a5a35bbbd7fe6565fcdb13c.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cyidbtrs /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2c714ed80a5a35bbbd7fe6565fcdb13c.dll\"" /SC ONCE /Z /ST 15:53 /ET 16:05
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3508

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2c714ed80a5a35bbbd7fe6565fcdb13c.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2c714ed80a5a35bbbd7fe6565fcdb13c.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Rzsgeou" /d "0"
      4⤵
      Windows security bypass
      PID:912
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Qikdnhn" /d "0"
      4⤵
      Windows security bypass
      PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2c714ed80a5a35bbbd7fe6565fcdb13c.dll

Filesize
572KB

MD5
2c714ed80a5a35bbbd7fe6565fcdb13c

SHA1
c71788eee393c9c35671b6bf414424fd6172cb12

SHA256
a002168733fcbcbb1b5d1ce932668d52238f20c186e0d1192b7c56f09c582240

SHA512
a737192e768d8191d393aaeea9af744ffe14e10acb53895178cf3795d2b7b0b63a02f100dcc58d63a248cc10039c18a65a1bfe1c15640f7189bff7a46cb3e41d

Download Submit
memory/960-11-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Filesize
132KB

Download
memory/960-3-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Filesize
132KB

Download
memory/960-9-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Filesize
132KB

Download
memory/960-10-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Filesize
132KB

Download
memory/960-13-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Filesize
132KB

Download
memory/1528-22-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Filesize
132KB

Download
memory/1528-21-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Filesize
132KB

Download
memory/1528-20-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Filesize
132KB

Download
memory/3708-18-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/3760-6-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/3760-1-0x00000000021F0000-0x0000000002225000-memory.dmp

Filesize
212KB

Download
memory/3760-2-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/3760-0-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/3760-5-0x00000000021F0000-0x0000000002225000-memory.dmp

Filesize
212KB

Download
memory/3760-4-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads