qakbot | 74591f116111efabaef947629c7fa4c9714c23b28188849dd23df7b91a466f5f

General

Target

8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe
Size

4.0MB
MD5

8dcfe2433938d7b05bc84fdfdce7fc4f
SHA1

eb1b86755634f85e7f0141436441ff1b0ceee9be
SHA256

74591f116111efabaef947629c7fa4c9714c23b28188849dd23df7b91a466f5f
SHA512

7b5923c646dc662ac96c43a3f19f5cb6682874bd27172b1bae02627bd4e23ff67a331562f541e92f33c5791d2b54c4225d18eee2455ef28fcd9ddddc8ba28164
SSDEEP

6144:EId1grY0tn9cV1pZzcF0t+gydsdHWflS9klcRfw63wTcbgE:EId5N7zHV762RIk

Score

10^/10

qakbot abc012 1601625483 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc012

Campaign

1601625483

C2

207.255.161.8:993

103.206.112.234:443

94.49.70.137:995

98.26.50.62:995

98.38.47.1:443

78.97.110.47:443

24.43.22.220:993

46.209.102.43:995

69.11.247.242:443

66.208.105.6:443

199.247.22.145:443

217.162.149.212:443

45.32.155.12:443

5.12.218.57:2222

190.85.91.154:443

103.76.160.110:443

77.27.174.49:995

172.78.30.215:443

71.187.170.235:443

89.42.142.35:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation 8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3440 PING.EXE

pid	process
3440	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe

pid	process
2568	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe
2568	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe
4796	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe
4796	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe
4796	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe
4796	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 2568 wrote to memory of 4796	2568	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe
PID 2568 wrote to memory of 4796	2568	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe
PID 2568 wrote to memory of 4796	2568	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe
PID 2568 wrote to memory of 4068	2568	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe	cmd.exe
PID 2568 wrote to memory of 4068	2568	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe	cmd.exe
PID 2568 wrote to memory of 4068	2568	8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe	cmd.exe
PID 4068 wrote to memory of 3440	4068	cmd.exe	PING.EXE
PID 4068 wrote to memory of 3440	4068	cmd.exe	PING.EXE
PID 4068 wrote to memory of 3440	4068	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2568

C:\Users\Admin\AppData\Local\Temp\8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:4796

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\8dcfe2433938d7b05bc84fdfdce7fc4f_JaffaCakes118.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4068

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:3440

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2568-1-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2568-0-0x00000000024D0000-0x000000000254C000-memory.dmp

Filesize
496KB

Download
memory/2568-2-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/2568-5-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2568-9-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2568-8-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/4796-4-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/4796-7-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads