qakbot | 9b30eafba4d4e1c9491ed31dbe7f9de2acf4e217d8fa162d471993bb05ec14fe

General

Target

JaffaCakes118_6dd575fb4081e2946812ffa942557edc.dll
Size

1.2MB
MD5

6dd575fb4081e2946812ffa942557edc
SHA1

a93c65cdfe016795dd72a2d8bd8a2a3fb53a7729
SHA256

9b30eafba4d4e1c9491ed31dbe7f9de2acf4e217d8fa162d471993bb05ec14fe
SHA512

f9bae851d5c39123a9c351537b384084c7051409374b90fb57e5edd1d0ee4e60e17d2e0ffb4606304f323869d3eacfdee7b0a389bc25d69c29c8ba150e400d33
SSDEEP

24576:m/o9iBRudBYZb/WqWletdadgndrqnq/wKkVW:YRuEbeqWYMqnFY2IW

Score

10^/10

qakbot tr 1634905513 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634905513

C2

27.5.5.31:2222

136.143.11.232:443

68.186.192.69:443

117.198.157.160:443

108.4.67.252:443

207.246.112.221:995

105.198.236.99:995

37.208.181.198:61200

115.99.227.13:995

140.82.49.12:443

188.50.34.167:995

216.201.162.158:443

103.142.10.177:443

197.89.21.241:443

73.25.109.183:2222

81.250.153.227:2222

2.222.167.138:443

78.191.24.189:995

87.242.20.233:2222

89.101.97.139:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Ehulvv = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Hsbxt = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
2728	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eldivnevmgwefj\b160e781 = 5ffa2e23dd84acade137e3c118aad4feda086067547af544	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eldivnevmgwefj\cc68a80b = 2b17aeb206b1c827320866b4f3649b869ed4266a5e0b10395cb8138e237c0a2455d14b40d430131df7e31577978f129c08ee89bfa403b3e00ef918b158d306a9c21290ee6a691e63	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eldivnevmgwefj\74d4cf6e = 4ce094a4219df9b45ca947c136315e1a26c174d4f6d1896a501baf45532f3c9845f37fe4c930c7a16c7c7b79840bf1a80ee04d82d189540206d1292e38e86b85f0dcd3c888fbf11010daa2794a62b7d9503b0b6367e3292be51d1c94ba51ff35f7ac64fe357c90	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eldivnevmgwefj\414b1f20 = 7edb1e0865cb88e50e97c445951dd0d7b2d5bb16aa08b0f2bc3b76f361f9e3a57535e00e88275812f613898ef805a40e465c7b2a804f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eldivnevmgwefj	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eldivnevmgwefj\3e0270d6 = 37c3cd8096d0d1953f8cb27387e8882c181c921a593e338e4d1be370bc7746f55071e29ee733528727fe209552e1e86b5d721d91c20dd9e1067101a60ea8535efe15e8d8199b888e75f5253918515d7b55b6e8a623982b98273e62a58062	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eldivnevmgwefj\b9da098 = deb3900352b04296721fdf4e95baa64eb663532ed78f70bf7ba9cebbf3b2a974daf1653279b533e340cb317f24d4bb5758e9f75ea6b34e6825932dad28f5fb966a52e906982d7e78b91007ab7dae639f42ccb1d3d92318f2941ec2216ed20136fd4f499e201ec22c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eldivnevmgwefj\9dc80e4 = fc3b311cf05e7af530a08cc7dcae31dab023e90718e0ecda9deb2b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eldivnevmgwefj\b321c7fd = 4066d2b3e1ab9dad9b727aa134981c6f112f915a6b9ee54f941d032b0be29bbb6ee024c1500fdbe4470335cea17d342d215e591adca2c156db3bbe65f33a8633be392c91ed7ef16134	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eldivnevmgwefj\3e0270d6 = 37c3da8096d0e42fdbdef3856c9125c9066413fe09ce58c6a9eb51ef9b4d84238f484c78b2a0c02303e54d25d7eff936a4fbe435ffa2fced71d0413365b550ede531b8ebeea016d969007a6a98c4d93f0a9e44de7fba7a8d433b722e7dac2a91735644a3970e828de906c32834d24d2f696b3b	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2096	rundll32.exe
2096	rundll32.exe
2728	regsvr32.exe
2728	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2096	rundll32.exe
2728	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 2096	5064	rundll32.exe	83
PID 5064 wrote to memory of 2096	5064	rundll32.exe	83
PID 5064 wrote to memory of 2096	5064	rundll32.exe	83
PID 2096 wrote to memory of 3308	2096	rundll32.exe	91
PID 2096 wrote to memory of 3308	2096	rundll32.exe	91
PID 2096 wrote to memory of 3308	2096	rundll32.exe	91
PID 2096 wrote to memory of 3308	2096	rundll32.exe	91
PID 2096 wrote to memory of 3308	2096	rundll32.exe	91
PID 3308 wrote to memory of 2280	3308	explorer.exe	92
PID 3308 wrote to memory of 2280	3308	explorer.exe	92
PID 3308 wrote to memory of 2280	3308	explorer.exe	92
PID 2660 wrote to memory of 2728	2660	regsvr32.exe	103
PID 2660 wrote to memory of 2728	2660	regsvr32.exe	103
PID 2660 wrote to memory of 2728	2660	regsvr32.exe	103
PID 2728 wrote to memory of 2044	2728	regsvr32.exe	104
PID 2728 wrote to memory of 2044	2728	regsvr32.exe	104
PID 2728 wrote to memory of 2044	2728	regsvr32.exe	104
PID 2728 wrote to memory of 2044	2728	regsvr32.exe	104
PID 2728 wrote to memory of 2044	2728	regsvr32.exe	104
PID 2044 wrote to memory of 4136	2044	explorer.exe	105
PID 2044 wrote to memory of 4136	2044	explorer.exe	105
PID 2044 wrote to memory of 1652	2044	explorer.exe	107
PID 2044 wrote to memory of 1652	2044	explorer.exe	107

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dd575fb4081e2946812ffa942557edc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dd575fb4081e2946812ffa942557edc.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ywylgdvn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dd575fb4081e2946812ffa942557edc.dll\"" /SC ONCE /Z /ST 16:39 /ET 16:51
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2280

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dd575fb4081e2946812ffa942557edc.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dd575fb4081e2946812ffa942557edc.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ehulvv" /d "0"
      4⤵
      Windows security bypass
      PID:4136
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Hsbxt" /d "0"
      4⤵
      Windows security bypass
      PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dd575fb4081e2946812ffa942557edc.dll

Filesize
1.2MB

MD5
6dd575fb4081e2946812ffa942557edc

SHA1
a93c65cdfe016795dd72a2d8bd8a2a3fb53a7729

SHA256
9b30eafba4d4e1c9491ed31dbe7f9de2acf4e217d8fa162d471993bb05ec14fe

SHA512
f9bae851d5c39123a9c351537b384084c7051409374b90fb57e5edd1d0ee4e60e17d2e0ffb4606304f323869d3eacfdee7b0a389bc25d69c29c8ba150e400d33

Download Submit
memory/2044-23-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Filesize
132KB

Download
memory/2044-24-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Filesize
132KB

Download
memory/2044-22-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Filesize
132KB

Download
memory/2096-0-0x0000000075110000-0x0000000075246000-memory.dmp

Filesize
1.2MB

Download
memory/2096-4-0x0000000075110000-0x0000000075246000-memory.dmp

Filesize
1.2MB

Download
memory/2096-6-0x0000000075110000-0x0000000075246000-memory.dmp

Filesize
1.2MB

Download
memory/2096-3-0x0000000075236000-0x000000007523C000-memory.dmp

Filesize
24KB

Download
memory/2728-20-0x0000000075080000-0x00000000751B6000-memory.dmp

Filesize
1.2MB

Download
memory/2728-17-0x0000000075080000-0x00000000751B6000-memory.dmp

Filesize
1.2MB

Download
memory/2728-18-0x0000000075080000-0x00000000751B6000-memory.dmp

Filesize
1.2MB

Download
memory/3308-13-0x0000000001010000-0x0000000001031000-memory.dmp

Filesize
132KB

Download
memory/3308-10-0x0000000001010000-0x0000000001031000-memory.dmp

Filesize
132KB

Download
memory/3308-11-0x0000000001010000-0x0000000001031000-memory.dmp

Filesize
132KB

Download
memory/3308-9-0x0000000001010000-0x0000000001031000-memory.dmp

Filesize
132KB

Download
memory/3308-5-0x0000000001010000-0x0000000001031000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads