qakbot | 8cc967b39adfd056e003d09e84c349ee6c68b299db34fe2d18f275a9c88f3bc8

General

Target

JaffaCakes118_489d678c3dbe9b1de4826590aeb8c0a6.dll
Size

1.6MB
MD5

489d678c3dbe9b1de4826590aeb8c0a6
SHA1

fe82d9026eb206afac699562500608a6a8173423
SHA256

8cc967b39adfd056e003d09e84c349ee6c68b299db34fe2d18f275a9c88f3bc8
SHA512

721e5ea69327f0d6578954ff5ed40f3ad5bb24d548677959f27133453814127b891dfef8c2b30e5c65bca357408f6806e709a24976303885b33a5aa4f5fd84f3
SSDEEP

24576:F9mB+XxJ7zUqNS8KqCx2ffNrC0O60+bPzTk1wK7TpKsZ:FUBav7zbS8pCx2fftCv6JLwJ7FKsZ

Score

10^/10

qakbot tr 1634541613 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Sajdixudtaxl = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Koqca = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
4316	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uoymxmaxk	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uoymxmaxk\2f63689 = 5bb47bd6e341f45f59ab462ebc61f605114d70f089c159250f102d4d03a3fa1ce9198de1fd1f7d22884599f096d2a8d330565ba1033844d2641a0e1846b646ca83eb1999caa24003955ced142136d14e8aba1aa442fcc93ea4f42871aa84ef184c41aac79c9359026933d524af6558ea9f4190bba8b4f5f248dcab7ba21dd737885f350fa3a9b0d66c3f0de8188a2307cce924a0906bbce359e8565204de0c185592def6e99165cda4c35a46	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uoymxmaxk\b716f5 = 48e6e055f8b2a48cdcd1d56f167a8b9c7b79c93685a2713ac550c70e1fb79267a09107cd87744911704d82863a8b9329c9fe9d466adbaf90018018a1d54f938944cc50fd18916bb2447300ebc46f13edc1e25b8ac0aaba56c1eb6ad9ccd2e9df05dca02a54076fae72b5503bc3b59255	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uoymxmaxk\7dbf597f = e3680cca37dd64dc09f5ef05cf3d63a248acf6b84245ac294751d6b500ea1c97b7142155e072f0a662c61387877ccb9ca9436ddd83f0d90ebd4e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uoymxmaxk\3769e6c7 = 37972656df0f2380f11e3e9b9d2b78e10e1fcfb9526ad6413eea8499464f967eb1e6423726e962e2a3c0076f705b1b3a4e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uoymxmaxk\b80b7190 = 4f6308836d83e250be4fe2e188a5bfedf0155c75b2934d2fd79dd0ab5529f69915241df651c36a3d410144fe7ba03d860c1ee1f7afe4c054f6d808a13ce05a3af0e9e8e8fb6c8dfa28a1301e63d7c78cde4cbe79201a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uoymxmaxk\c5033e1a = 9027de4b452f23175b042d50be35d7596bdc5739f8a48bc8965e73f92cd21d16f76457c9df778ec7267198fca87ed01a078868	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uoymxmaxk\ba4a51ec = 46c4b4b7d782d88b515c7e3f4fcc148c2959c992fe8d7dda36c67a8e3a02e45769acb78a660bd4e6370f2262acd1a3d4bc40f776821e0e2f50d0d83858291a4403c63e16c8110676b5a7011878a093a008d48b66076b3401ef3a78a9ac70f9b7ab8ffe271177ad0f7e094d9a66c2be8c57	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uoymxmaxk\48208931 = b4131bbf777017d147f2929f5bc3f346791328720ca686e388d83fd5a3733041d84366a0270c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uoymxmaxk\3769e6c7 = 37973156df0f16f96fbb4ac4643045078076e845725480ca466b86d747387107397eff008f9ed7ea49852fde8b8584dcc2955259647ed4666d8c61dfb37ef419c05a09fa5a90	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2432	rundll32.exe
2432	rundll32.exe
4316	regsvr32.exe
4316	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2432	rundll32.exe
4316	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 2432	3364	rundll32.exe	83
PID 3364 wrote to memory of 2432	3364	rundll32.exe	83
PID 3364 wrote to memory of 2432	3364	rundll32.exe	83
PID 2432 wrote to memory of 4432	2432	rundll32.exe	84
PID 2432 wrote to memory of 4432	2432	rundll32.exe	84
PID 2432 wrote to memory of 4432	2432	rundll32.exe	84
PID 2432 wrote to memory of 4432	2432	rundll32.exe	84
PID 2432 wrote to memory of 4432	2432	rundll32.exe	84
PID 4432 wrote to memory of 4544	4432	explorer.exe	85
PID 4432 wrote to memory of 4544	4432	explorer.exe	85
PID 4432 wrote to memory of 4544	4432	explorer.exe	85
PID 1568 wrote to memory of 4316	1568	regsvr32.exe	103
PID 1568 wrote to memory of 4316	1568	regsvr32.exe	103
PID 1568 wrote to memory of 4316	1568	regsvr32.exe	103
PID 4316 wrote to memory of 4444	4316	regsvr32.exe	104
PID 4316 wrote to memory of 4444	4316	regsvr32.exe	104
PID 4316 wrote to memory of 4444	4316	regsvr32.exe	104
PID 4316 wrote to memory of 4444	4316	regsvr32.exe	104
PID 4316 wrote to memory of 4444	4316	regsvr32.exe	104
PID 4444 wrote to memory of 4808	4444	explorer.exe	105
PID 4444 wrote to memory of 4808	4444	explorer.exe	105
PID 4444 wrote to memory of 4920	4444	explorer.exe	107
PID 4444 wrote to memory of 4920	4444	explorer.exe	107

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_489d678c3dbe9b1de4826590aeb8c0a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_489d678c3dbe9b1de4826590aeb8c0a6.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kenydwhpn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_489d678c3dbe9b1de4826590aeb8c0a6.dll\"" /SC ONCE /Z /ST 02:37 /ET 02:49
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4544

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_489d678c3dbe9b1de4826590aeb8c0a6.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_489d678c3dbe9b1de4826590aeb8c0a6.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Sajdixudtaxl" /d "0"
      4⤵
      Windows security bypass
      PID:4808
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Koqca" /d "0"
      4⤵
      Windows security bypass
      PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_489d678c3dbe9b1de4826590aeb8c0a6.dll

Filesize
1.6MB

MD5
489d678c3dbe9b1de4826590aeb8c0a6

SHA1
fe82d9026eb206afac699562500608a6a8173423

SHA256
8cc967b39adfd056e003d09e84c349ee6c68b299db34fe2d18f275a9c88f3bc8

SHA512
721e5ea69327f0d6578954ff5ed40f3ad5bb24d548677959f27133453814127b891dfef8c2b30e5c65bca357408f6806e709a24976303885b33a5aa4f5fd84f3

Download Submit
memory/2432-4-0x0000000074D50000-0x0000000074EFB000-memory.dmp

Filesize
1.7MB

Download
memory/2432-2-0x0000000074D50000-0x0000000074EFB000-memory.dmp

Filesize
1.7MB

Download
memory/2432-1-0x0000000074EE0000-0x0000000074EE6000-memory.dmp

Filesize
24KB

Download
memory/2432-5-0x0000000074D50000-0x0000000074EFB000-memory.dmp

Filesize
1.7MB

Download
memory/2432-7-0x0000000074D50000-0x0000000074EFB000-memory.dmp

Filesize
1.7MB

Download
memory/2432-0-0x0000000074D50000-0x0000000074EFB000-memory.dmp

Filesize
1.7MB

Download
memory/4316-18-0x00000000735B0000-0x000000007375B000-memory.dmp

Filesize
1.7MB

Download
memory/4316-19-0x00000000735B0000-0x000000007375B000-memory.dmp

Filesize
1.7MB

Download
memory/4316-22-0x00000000735B0000-0x000000007375B000-memory.dmp

Filesize
1.7MB

Download
memory/4432-11-0x00000000006F0000-0x0000000000711000-memory.dmp

Filesize
132KB

Download
memory/4432-14-0x00000000006F0000-0x0000000000711000-memory.dmp

Filesize
132KB

Download
memory/4432-12-0x00000000006F0000-0x0000000000711000-memory.dmp

Filesize
132KB

Download
memory/4432-10-0x00000000006F0000-0x0000000000711000-memory.dmp

Filesize
132KB

Download
memory/4432-6-0x00000000006F0000-0x0000000000711000-memory.dmp

Filesize
132KB

Download
memory/4444-24-0x00000000007A0000-0x00000000007C1000-memory.dmp

Filesize
132KB

Download
memory/4444-25-0x00000000007A0000-0x00000000007C1000-memory.dmp

Filesize
132KB

Download
memory/4444-26-0x00000000007A0000-0x00000000007C1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads