qakbot | 33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80

General

Target

JaffaCakes118_f717e2f6f48ae6ee4875ef740cd4067e.dll
Size

741KB
MD5

f717e2f6f48ae6ee4875ef740cd4067e
SHA1

cef662e43bded5848e499b5f3b506bb3829948ff
SHA256

33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80
SHA512

387c67166b12bb0dfa49234ffa29dda1ad08d1aefe6d67ea6cfddc184f841ed2523d8994209262af92680d7357bb1d5eca787174556184549c70efa765767990
SSDEEP

12288:PdifdQ3K/AEB30roh0CdSIbKtAJbJ3DcALweuxt2DfJupI3QoUmSyjbfm2OiAxPX:PdiC3pW0rNWBDc1FnmU9xkT

Score

10^/10

qakbot tr 1634541613 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Ylwyeo = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Mekacoxbgni = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
468	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aoaaomuwqokv\872edc48 = ebecc174541d28c11b7958a34341074f3260b423c14d8ebd13cdd96369c2ffb802a53eedba98fec2e68a17f7166cf227a24aaeae0cfb6b1123f0ce4e3e2dde0d7cee27b473c66f898de1167c85c12901f3dd758543e7fbc8921b852285624598626f1698c30f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aoaaomuwqokv\fa2693c2 = 6554c36947ebf127be5f4fc0fb6469186e0aa659063de1f590f385bfac126349f9500fbfc80ea4bdd6d322a74f03b057e6c6058f857b6c27498d517a92c8be7665d2d90ae44eda061c7000ceed93873dd1c397b3a58c4240b1eec2af81ee187366817bc7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aoaaomuwqokv\cfb9438c = d13b56a8a60c2657288221021f14d0e4d862bcd3e2b3a1ae67aa881a612a9457716b369ced016243d1f1e35b7bf79bde2472d44a7e0525bdc3aa154137271bb890221a4dd8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aoaaomuwqokv\b0f02c7a = 7217ed37d733635bef54bd34ab64cfdb96444ea4e75dee2207ebd3f214234b919ed27914e433786f1f82a459a97c49c4682bb4066a8fb9a895eae2bb143ba5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aoaaomuwqokv\3dd39b51 = 4fd85b137325af1207a4331532ed8d47a12d59f2f125af5e5250f4232b83	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aoaaomuwqokv	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aoaaomuwqokv\b0f02c7a = 7217fa37d733564167008d1f1432a2e041f70843e5be15350d383ef61472929e8f2034aaf176d9d88700	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aoaaomuwqokv\856ffc34 = b988de7a97d826d77c6755d7d528a3b5fda1298de6328099d1bb7cc33fb889946b9e637ac5d025025641df52c5f2024863204a30a9ac71966204e7da23564fd647b596acca5b816f0eec16c8b753c0244554dc757352e75d55f4e0218e4d07db534c95c40bec3ba0e865ab31a0631657b9b3a33bf7f07881f9ce4ab5536df4075a928edeb7ee2476ddc24d2b3be06848e9e96eff3a47623ca0ed71	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aoaaomuwqokv\3f92bb2d = 5f8806a42eefa189df19f771770d8a1fbf78b1e485473e96547db5488800da792bfa482342e274624e5d4ae153ec366b5386e76836f325cbdea5383c351a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aoaaomuwqokv\429af4a7 = dfbc79c0d4839a4874d4a9d17849145010d8f8acaf8c66e43a0d4f63fa3a6f6cec7f23173a541bd5f732b84823c1b3372faeba96dd64dbc40a00ea1d62a0d9ae36a1e6622a08c521779eefd93f982b1f72c22cde42974a774310	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4248	rundll32.exe
4248	rundll32.exe
468	regsvr32.exe
468	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4248	rundll32.exe
468	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 4248	3024	rundll32.exe	83
PID 3024 wrote to memory of 4248	3024	rundll32.exe	83
PID 3024 wrote to memory of 4248	3024	rundll32.exe	83
PID 4248 wrote to memory of 1100	4248	rundll32.exe	87
PID 4248 wrote to memory of 1100	4248	rundll32.exe	87
PID 4248 wrote to memory of 1100	4248	rundll32.exe	87
PID 4248 wrote to memory of 1100	4248	rundll32.exe	87
PID 4248 wrote to memory of 1100	4248	rundll32.exe	87
PID 1100 wrote to memory of 2952	1100	explorer.exe	91
PID 1100 wrote to memory of 2952	1100	explorer.exe	91
PID 1100 wrote to memory of 2952	1100	explorer.exe	91
PID 5080 wrote to memory of 468	5080	regsvr32.exe	104
PID 5080 wrote to memory of 468	5080	regsvr32.exe	104
PID 5080 wrote to memory of 468	5080	regsvr32.exe	104
PID 468 wrote to memory of 4852	468	regsvr32.exe	105
PID 468 wrote to memory of 4852	468	regsvr32.exe	105
PID 468 wrote to memory of 4852	468	regsvr32.exe	105
PID 468 wrote to memory of 4852	468	regsvr32.exe	105
PID 468 wrote to memory of 4852	468	regsvr32.exe	105
PID 4852 wrote to memory of 208	4852	explorer.exe	106
PID 4852 wrote to memory of 208	4852	explorer.exe	106
PID 4852 wrote to memory of 228	4852	explorer.exe	108
PID 4852 wrote to memory of 228	4852	explorer.exe	108

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f717e2f6f48ae6ee4875ef740cd4067e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f717e2f6f48ae6ee4875ef740cd4067e.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ryslwzqni /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f717e2f6f48ae6ee4875ef740cd4067e.dll\"" /SC ONCE /Z /ST 04:35 /ET 04:47
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2952

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f717e2f6f48ae6ee4875ef740cd4067e.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f717e2f6f48ae6ee4875ef740cd4067e.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Mekacoxbgni" /d "0"
      4⤵
      Windows security bypass
      PID:208
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ylwyeo" /d "0"
      4⤵
      Windows security bypass
      PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f717e2f6f48ae6ee4875ef740cd4067e.dll

Filesize
741KB

MD5
f717e2f6f48ae6ee4875ef740cd4067e

SHA1
cef662e43bded5848e499b5f3b506bb3829948ff

SHA256
33a3d0898f75bf922cd4d502d5dcedb41768e9fd4cec5302c3524321689aaf80

SHA512
387c67166b12bb0dfa49234ffa29dda1ad08d1aefe6d67ea6cfddc184f841ed2523d8994209262af92680d7357bb1d5eca787174556184549c70efa765767990

Download Submit
memory/468-23-0x0000000075310000-0x00000000753E5000-memory.dmp

Filesize
852KB

Download
memory/468-22-0x0000000075310000-0x00000000753E5000-memory.dmp

Filesize
852KB

Download
memory/468-19-0x0000000075310000-0x00000000753E5000-memory.dmp

Filesize
852KB

Download
memory/468-18-0x0000000075310000-0x00000000753E5000-memory.dmp

Filesize
852KB

Download
memory/1100-6-0x00000000003D0000-0x00000000003F1000-memory.dmp

Filesize
132KB

Download
memory/1100-10-0x00000000003D0000-0x00000000003F1000-memory.dmp

Filesize
132KB

Download
memory/1100-12-0x00000000003D0000-0x00000000003F1000-memory.dmp

Filesize
132KB

Download
memory/1100-11-0x00000000003D0000-0x00000000003F1000-memory.dmp

Filesize
132KB

Download
memory/1100-14-0x00000000003D0000-0x00000000003F1000-memory.dmp

Filesize
132KB

Download
memory/4248-5-0x00000000753A0000-0x0000000075475000-memory.dmp

Filesize
852KB

Download
memory/4248-0-0x00000000753A0000-0x0000000075475000-memory.dmp

Filesize
852KB

Download
memory/4248-7-0x00000000753A0000-0x0000000075475000-memory.dmp

Filesize
852KB

Download
memory/4248-3-0x00000000753A0000-0x0000000075475000-memory.dmp

Filesize
852KB

Download
memory/4248-2-0x00000000753A0000-0x0000000075475000-memory.dmp

Filesize
852KB

Download
memory/4248-1-0x0000000075458000-0x000000007545E000-memory.dmp

Filesize
24KB

Download
memory/4852-25-0x0000000001470000-0x0000000001491000-memory.dmp

Filesize
132KB

Download
memory/4852-27-0x0000000001470000-0x0000000001491000-memory.dmp

Filesize
132KB

Download
memory/4852-26-0x0000000001470000-0x0000000001491000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads