qakbot | c5148afaf55c8b27a41a5971b6e439c8076b57f84c518f31bfec4171cd112a13

General

Target

JaffaCakes118_898ba3b11fb261c893990e9a178d05ff.dll
Size

534KB
MD5

898ba3b11fb261c893990e9a178d05ff
SHA1

9db70b8ed8e080050943dd92e6a90959e77abe1e
SHA256

c5148afaf55c8b27a41a5971b6e439c8076b57f84c518f31bfec4171cd112a13
SHA512

6ec3a441202e233c7cfc563c54023a24e83b55941db46abfd12d614ba5f3fb2fcd4a79515b1b876f10de13935543f421d36bd028c4a18370d7799d266ba76bf5
SSDEEP

3072:vxAqb35qSyYNYuFwXBBWYn0WWeP24iABEabz1fz+Bnp1WC3polyaSXO3etYkpBsk:yqb35qjY7wXrNJicLfz+hqv4BtYyjD

Score

10^/10

qakbot biden54 1634802135 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden54

Campaign

1634802135

C2

81.250.153.227:2222

120.150.218.241:995

76.25.142.196:443

63.143.92.99:995

89.101.97.139:443

136.143.11.232:443

81.213.59.22:443

136.232.34.70:443

140.82.49.12:443

37.208.181.198:61200

78.191.24.189:995

216.201.162.158:443

197.89.144.102:443

89.137.52.44:443

182.176.180.73:443

173.21.10.71:2222

117.198.156.56:443

196.207.140.40:995

103.142.10.177:443

24.231.209.2:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Ojhrjyazi = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Nxvuazvqepae = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
4500	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktordsylfhow\fc754bd7 = 64bf7b5cb94053ed02141f383bc437fb00a02e27465183a1e6194a35c681db3be89a1232d330889599bcee1c177b67c8de22a049ce112aa3daf21e3ac0e24a67	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktordsylfhow\c9ea9b99 = 73e68ed0f3548373afda36d51d5a4a36e6d59634e821951b343edb60e6f122d6156384c6bea353394c5293e43a7b22eb61a4959628afaabe3399fb5c3513d090abc3c6c9147825aaa259d1d259ead3162b4c0b8ed3425a9aa28ee4e3e166a9d1cde8294a74517d79e28e06fe344a35751443f3c7e604b27383	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktordsylfhow\cbabbbe5 = 50fe5b472d1ab4a13a2834d62efec0bff37a5897c63fdd7de7cd1da1b8bac3834e633cace3b1b048aacbbf5416fdf3a58e82b4db6d708bb5c79f98c487c6f8b45b906758bab6241e52e7e8ebbd5c1e03f0a4ec79cbcec3d573	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktordsylfhow\7156fcfc = 6803c2b2cfd05c75c39ee109f8cb953d9758db14b07b06c3976d964a2234a053eb0d75f9537d3c8ab7afcfa3777f0c32a49e28be6c50bbbeb4b22520ee3f8340db172b67aae99cd40f65c818c0fd6aab8e3737	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktordsylfhow	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktordsylfhow\7317dc80 = 8dbb245420fc3bd8cb2d48173da7cd616c503bff1c3eb64edb06543897b8a8b3ff5af032e3e8627c5695717ec059bfcddb11a95cac5e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktordsylfhow\e1f930a = a34b88a45aa2f02292dc4c3e54dce3c0271bf5b6f4f9165c437e5ad15af162556910ef716ed726fc2107c045d38e87aea11194f063d32bab8bbe00e1db689ecc6cafd9fd210ef5d23046b7af822d3d50d6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktordsylfhow\b6a3f46f = c704bca87e0e204ac3f43c9def4b87ed062edf23c7f62eac9cf13fd750e239f940e11fd2f2186e66909c2e2edf2499a8eeebec25b8ba2891d5c583dc17137778e2e29136d2f633bb387bc69d8c8f77b150da0c907db840642a38	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktordsylfhow\833c2421 = caedc0822a7e53eac36cdc972ade73841a38a2cf53ee4e1ec4cdf9483b1fc04e3f5feb81f3211fb1d8faf74c01c991f0f1858b93345b61a525b8af088f0db947296b9c5e11d8879951f941f75916483c38f73f958d5736808a0820	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ktordsylfhow\fc754bd7 = 64bf6c5cb94066b8361db6ea0f946867ff34c25f00e743b2ce80c53e51c139fe35eabb832c696d58f39f1f4aaa4f59287e260441ec236c08dff1b5f4a0d51b43a2238e20cdc10e35a0fbfe109fda9489ffec0f9b16	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3412	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4896	rundll32.exe
4896	rundll32.exe
4500	regsvr32.exe
4500	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4896	rundll32.exe
4500	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 4896	3976	rundll32.exe	83
PID 3976 wrote to memory of 4896	3976	rundll32.exe	83
PID 3976 wrote to memory of 4896	3976	rundll32.exe	83
PID 4896 wrote to memory of 4236	4896	rundll32.exe	84
PID 4896 wrote to memory of 4236	4896	rundll32.exe	84
PID 4896 wrote to memory of 4236	4896	rundll32.exe	84
PID 4896 wrote to memory of 4236	4896	rundll32.exe	84
PID 4896 wrote to memory of 4236	4896	rundll32.exe	84
PID 4236 wrote to memory of 3412	4236	explorer.exe	85
PID 4236 wrote to memory of 3412	4236	explorer.exe	85
PID 4236 wrote to memory of 3412	4236	explorer.exe	85
PID 2020 wrote to memory of 4500	2020	regsvr32.exe	103
PID 2020 wrote to memory of 4500	2020	regsvr32.exe	103
PID 2020 wrote to memory of 4500	2020	regsvr32.exe	103
PID 4500 wrote to memory of 4672	4500	regsvr32.exe	104
PID 4500 wrote to memory of 4672	4500	regsvr32.exe	104
PID 4500 wrote to memory of 4672	4500	regsvr32.exe	104
PID 4500 wrote to memory of 4672	4500	regsvr32.exe	104
PID 4500 wrote to memory of 4672	4500	regsvr32.exe	104
PID 4672 wrote to memory of 2360	4672	explorer.exe	105
PID 4672 wrote to memory of 2360	4672	explorer.exe	105
PID 4672 wrote to memory of 2444	4672	explorer.exe	107
PID 4672 wrote to memory of 2444	4672	explorer.exe	107

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_898ba3b11fb261c893990e9a178d05ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_898ba3b11fb261c893990e9a178d05ff.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn iavleked /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_898ba3b11fb261c893990e9a178d05ff.dll\"" /SC ONCE /Z /ST 03:50 /ET 04:02
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3412

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_898ba3b11fb261c893990e9a178d05ff.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_898ba3b11fb261c893990e9a178d05ff.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ojhrjyazi" /d "0"
      4⤵
      Windows security bypass
      PID:2360
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Nxvuazvqepae" /d "0"
      4⤵
      Windows security bypass
      PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_898ba3b11fb261c893990e9a178d05ff.dll

Filesize
534KB

MD5
898ba3b11fb261c893990e9a178d05ff

SHA1
9db70b8ed8e080050943dd92e6a90959e77abe1e

SHA256
c5148afaf55c8b27a41a5971b6e439c8076b57f84c518f31bfec4171cd112a13

SHA512
6ec3a441202e233c7cfc563c54023a24e83b55941db46abfd12d614ba5f3fb2fcd4a79515b1b876f10de13935543f421d36bd028c4a18370d7799d266ba76bf5

Download Submit
memory/4236-8-0x0000000000710000-0x0000000000731000-memory.dmp

Filesize
132KB

Download
memory/4236-4-0x0000000000710000-0x0000000000731000-memory.dmp

Filesize
132KB

Download
memory/4236-7-0x0000000000710000-0x0000000000731000-memory.dmp

Filesize
132KB

Download
memory/4236-0-0x0000000000710000-0x0000000000731000-memory.dmp

Filesize
132KB

Download
memory/4236-5-0x0000000000710000-0x0000000000731000-memory.dmp

Filesize
132KB

Download
memory/4236-6-0x0000000000710000-0x0000000000731000-memory.dmp

Filesize
132KB

Download
memory/4500-13-0x0000000010000000-0x0000000014595000-memory.dmp

Filesize
69.6MB

Download
memory/4672-15-0x0000000000180000-0x00000000001A1000-memory.dmp

Filesize
132KB

Download
memory/4672-17-0x0000000000180000-0x00000000001A1000-memory.dmp

Filesize
132KB

Download
memory/4672-18-0x0000000000180000-0x00000000001A1000-memory.dmp

Filesize
132KB

Download
memory/4672-16-0x0000000000180000-0x00000000001A1000-memory.dmp

Filesize
132KB

Download
memory/4896-1-0x0000000010000000-0x0000000014595000-memory.dmp

Filesize
69.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads