qakbot | ca8a7e342ecedc4b135787dbd7057501d751d548368d25ad97f70dae1172c3a6

General

Target

JaffaCakes118_cd89b03a01826aee4607a19a73f7530a.dll
Size

1.2MB
MD5

cd89b03a01826aee4607a19a73f7530a
SHA1

68d4595274b8e87d0875b6c38df8d71771ff92e4
SHA256

ca8a7e342ecedc4b135787dbd7057501d751d548368d25ad97f70dae1172c3a6
SHA512

51cc182b76d38d7895146cb77ffdee0cdfad4183c32b87c253d0f41dff550e8d2a3df717deb5c8f99ce785dedd80018dfc9c88360d622fc1c6b549fe2a31d631
SSDEEP

24576:szVwOlR/8qI8ixvTMH2AVpIP97+xgbZTekrX:szVjR/zI8ixMHzS97+xgbZTfrX

Score

10^/10

qakbot biden53 1634717752 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden53

Campaign

1634717752

C2

103.142.10.177:443

24.152.219.253:995

181.118.183.94:443

129.208.147.188:995

24.119.214.7:443

38.70.253.226:2222

103.143.8.71:443

77.57.204.78:443

65.100.174.110:995

220.255.25.28:2222

91.178.126.51:995

37.210.155.239:995

81.241.252.59:2078

93.48.58.123:2222

65.100.174.110:443

76.25.142.196:443

24.231.209.2:2222

140.82.49.12:443

146.66.238.74:443

39.49.4.147:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Ioawwi = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Zeuboj = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
1100	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqweaeofwoi\f1fc51f5 = 032f051f71f7c9464dd82c702c824a924311d1c5eb44e011bb235c0b06a56e38b65ef1fe419f10a8e4214a248a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqweaeofwoi\c622a1c7 = d6ae2a6d14a244fe345fab188ca692da51656079aa01a9fc9e17338f68617c481ff7a5259d28dfe0b24c21e64951ea33807d0b76df6a195efc09c58a42bcc718c2a778e1a41aa8a6abd50d9e6cca7e99ce6d821f0b1d50f317ba52d96247b554050c67a9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqweaeofwoi\7e9ec6a2 = fbbdf96775d35a4e680308c627319859aa410b14aa242222d60508f232ec4b042d17267461e4ca74bc8216f855c4e45b5276410bfb7efd169487471eaf41a632fa948f569f37aaa73cd018ab1eae27db946163aa95	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqweaeofwoi\8eb53e03 = 519caab3df4d9aaf1721d05e20d4f75d7ff97e3b1826d5bab05ac3e75f838ec79cf4707944c6d8f33b8fdf4446f6ae615c6fa69d559aa4dc36e8b8d39825d7bd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqweaeofwoi\f1fc51f5 = 032f121f71f7fcb85c0e1404eac64aa92937a6ce661af1c7de269a593d1a0f97a2869e8c97a52fa12073ad679106e9b96bc159fe36a6b7df73aed298460fa6105ecc	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqweaeofwoi	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqweaeofwoi\c46381bb = e1ceee1800cd15fbf2f7dc1116d7c76ad72d5c866afba5a919026a2a403b7edb2b637bb3d7dad506bb3fc33c0b5a13c55e8a54462b3aa36aa6828edd63c91f35f7a75f1053639202a59e10c69342ffe81c61882ca9f8b9b537f6b47187f06a6b6a59fd4cb52a67104510c541c8a8868f955b2a3667b9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqweaeofwoi\3968928 = 0c5bf5bbac3886b2855a7f926ec1ec82b9e7b52084266af6386d96e6f4d63cd9c613842c2d0573db8a68f606e55b1195b3d27f71	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqweaeofwoi\bb2aee4d = 46766f33505200a2e66defc8417d9971e280e871dd777c3bcac8a91b4d935c65	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qqweaeofwoi\7cdfe6de = e72a56d9d2f91de54b23200f6e8d9c9fff0240b57c93179f11cb4adfb80878ef7c90b2c14ee8a3b868eef2d35557642d328ea2e3b6d5ceb02d4c2684febc46fc4809e9b3654cfe1ce7cb0819a52b4f	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4632	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1568	rundll32.exe
1568	rundll32.exe
1100	regsvr32.exe
1100	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1568	rundll32.exe
1100	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 1568	2788	rundll32.exe	83
PID 2788 wrote to memory of 1568	2788	rundll32.exe	83
PID 2788 wrote to memory of 1568	2788	rundll32.exe	83
PID 1568 wrote to memory of 4940	1568	rundll32.exe	95
PID 1568 wrote to memory of 4940	1568	rundll32.exe	95
PID 1568 wrote to memory of 4940	1568	rundll32.exe	95
PID 1568 wrote to memory of 4940	1568	rundll32.exe	95
PID 1568 wrote to memory of 4940	1568	rundll32.exe	95
PID 4940 wrote to memory of 4632	4940	explorer.exe	96
PID 4940 wrote to memory of 4632	4940	explorer.exe	96
PID 4940 wrote to memory of 4632	4940	explorer.exe	96
PID 1160 wrote to memory of 1100	1160	regsvr32.exe	102
PID 1160 wrote to memory of 1100	1160	regsvr32.exe	102
PID 1160 wrote to memory of 1100	1160	regsvr32.exe	102
PID 1100 wrote to memory of 1496	1100	regsvr32.exe	103
PID 1100 wrote to memory of 1496	1100	regsvr32.exe	103
PID 1100 wrote to memory of 1496	1100	regsvr32.exe	103
PID 1100 wrote to memory of 1496	1100	regsvr32.exe	103
PID 1100 wrote to memory of 1496	1100	regsvr32.exe	103
PID 1496 wrote to memory of 1180	1496	explorer.exe	104
PID 1496 wrote to memory of 1180	1496	explorer.exe	104
PID 1496 wrote to memory of 2480	1496	explorer.exe	106
PID 1496 wrote to memory of 2480	1496	explorer.exe	106

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd89b03a01826aee4607a19a73f7530a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd89b03a01826aee4607a19a73f7530a.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn nvrsayq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd89b03a01826aee4607a19a73f7530a.dll\"" /SC ONCE /Z /ST 17:10 /ET 17:22
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4632

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd89b03a01826aee4607a19a73f7530a.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd89b03a01826aee4607a19a73f7530a.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ioawwi" /d "0"
      4⤵
      Windows security bypass
      PID:1180
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Zeuboj" /d "0"
      4⤵
      Windows security bypass
      PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd89b03a01826aee4607a19a73f7530a.dll

Filesize
1.2MB

MD5
cd89b03a01826aee4607a19a73f7530a

SHA1
68d4595274b8e87d0875b6c38df8d71771ff92e4

SHA256
ca8a7e342ecedc4b135787dbd7057501d751d548368d25ad97f70dae1172c3a6

SHA512
51cc182b76d38d7895146cb77ffdee0cdfad4183c32b87c253d0f41dff550e8d2a3df717deb5c8f99ce785dedd80018dfc9c88360d622fc1c6b549fe2a31d631

Download Submit
memory/1100-18-0x0000000073D30000-0x0000000073E6E000-memory.dmp

Filesize
1.2MB

Download
memory/1100-20-0x0000000073D30000-0x0000000073E6E000-memory.dmp

Filesize
1.2MB

Download
memory/1100-17-0x0000000073D30000-0x0000000073E6E000-memory.dmp

Filesize
1.2MB

Download
memory/1496-24-0x0000000001010000-0x0000000001031000-memory.dmp

Filesize
132KB

Download
memory/1496-23-0x0000000001010000-0x0000000001031000-memory.dmp

Filesize
132KB

Download
memory/1496-22-0x0000000001010000-0x0000000001031000-memory.dmp

Filesize
132KB

Download
memory/1568-2-0x0000000075460000-0x000000007559E000-memory.dmp

Filesize
1.2MB

Download
memory/1568-0-0x0000000075460000-0x000000007559E000-memory.dmp

Filesize
1.2MB

Download
memory/1568-4-0x0000000075460000-0x000000007559E000-memory.dmp

Filesize
1.2MB

Download
memory/1568-1-0x000000007558D000-0x0000000075593000-memory.dmp

Filesize
24KB

Download
memory/1568-6-0x0000000075460000-0x000000007559E000-memory.dmp

Filesize
1.2MB

Download
memory/4940-5-0x0000000000830000-0x0000000000851000-memory.dmp

Filesize
132KB

Download
memory/4940-13-0x0000000000830000-0x0000000000851000-memory.dmp

Filesize
132KB

Download
memory/4940-10-0x0000000000830000-0x0000000000851000-memory.dmp

Filesize
132KB

Download
memory/4940-11-0x0000000000830000-0x0000000000851000-memory.dmp

Filesize
132KB

Download
memory/4940-9-0x0000000000830000-0x0000000000851000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads