qakbot | 9b0c1d6622d0c53de27fb7ed63968ee13c641039c9d0c0edfa6943f86d144f28

General

Target

19b8d26a254caac2ba263796f422ad18_JaffaCakes118.dll
Size

436KB
MD5

19b8d26a254caac2ba263796f422ad18
SHA1

c8d1951615c1db33a03d581607ed31ea71344340
SHA256

9b0c1d6622d0c53de27fb7ed63968ee13c641039c9d0c0edfa6943f86d144f28
SHA512

a6032d302412438541aa8eaad738a66f9e7313640619a4c12ed8ef12b6612e427a68e996362e8c2a1fcdedd1cb587a63faa9a87e851bc1944ca707ced7fb48c5
SSDEEP

12288:8vT1+i+eRbPqeSIvNMenaJ8/ECkSNDopGI5coPYbO:8v3F+ex1MrKECBf3oPYbO

Score

10^/10

qakbot tr 1632817399 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1632817399

C2

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

181.118.183.94:443

120.150.218.241:995

185.250.148.74:443

95.77.223.148:443

75.66.88.33:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Mtvpwym = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Mmyweifeqemd = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4856 regsvr32.exe

pid	process
4856	regsvr32.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Niioege\a3abd953 = 63525e1a9af7938b66237c08970c8e51fc58f3dc28d1308b0923e0986a8068199b41244e729f39310080532373252539636a638468a134d99e744fa9fec1d18655d62e4c6fdaf6a23e57d8214c9840d9c16554c5ccdadf96fb86c0917c5a407993de18ec03e532dfc8a9e47af0e35279a8bb5fa70b6d8dc0f6eb219d9be31f318fe9f5068f06be6ae1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Niioege\645ed1c0 = ad8a68ff414991d0012b3cda084d9ec2db782b387985449b0a051bdc8c410a82a5371e95ab11a79a81b63c39a835dc2d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Niioege\e97d66eb = 900332d619dbbe1d82b9f6a91a562be3cdca27ffb5c8955e133eac81beef5c19	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Niioege	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Niioege\9634091d = e92de189c1a2e70306643aa8a28689	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Niioege\a1eaf92f = aba7e0d1dd0d5d1cfe25c96a4a31bf8b246cc58e5aae44eca37b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Niioege\19569e4a = 9b9225c5012dc1ce0938cbe41b41b0c96640b240fc0958f1f2fe57ea7e133444bc3cde4a72875e92f7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Niioege\dce2b6a5 = 3ccb7125810b93e6e81c7fac7dffa5a5579833afda9a3c35	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Niioege\1b17be36 = 45fc3c9762729742eb2a6a9e4073d2264ce20cb5e386c917913c4602a2a79b5244096a4f74	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Niioege\9634091d = e92df689c1a2d24ca6dbbbce70a9e1c735dd6834be75bef96747cc626a28d4c019aae1c7	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3524 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3464 rundll32.exe
3464 rundll32.exe
4856 regsvr32.exe
4856 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

3464 rundll32.exe
4856 regsvr32.exe

pid	process
3524	schtasks.exe

pid	process
3464	rundll32.exe
3464	rundll32.exe
4856	regsvr32.exe
4856	regsvr32.exe

pid	process
3464	rundll32.exe
4856	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1272 wrote to memory of 3464	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 3464	1272	rundll32.exe	rundll32.exe
PID 1272 wrote to memory of 3464	1272	rundll32.exe	rundll32.exe
PID 3464 wrote to memory of 1736	3464	rundll32.exe	explorer.exe
PID 3464 wrote to memory of 1736	3464	rundll32.exe	explorer.exe
PID 3464 wrote to memory of 1736	3464	rundll32.exe	explorer.exe
PID 3464 wrote to memory of 1736	3464	rundll32.exe	explorer.exe
PID 3464 wrote to memory of 1736	3464	rundll32.exe	explorer.exe
PID 1736 wrote to memory of 3524	1736	explorer.exe	schtasks.exe
PID 1736 wrote to memory of 3524	1736	explorer.exe	schtasks.exe
PID 1736 wrote to memory of 3524	1736	explorer.exe	schtasks.exe
PID 1240 wrote to memory of 4856	1240	regsvr32.exe	regsvr32.exe
PID 1240 wrote to memory of 4856	1240	regsvr32.exe	regsvr32.exe
PID 1240 wrote to memory of 4856	1240	regsvr32.exe	regsvr32.exe
PID 4856 wrote to memory of 1500	4856	regsvr32.exe	explorer.exe
PID 4856 wrote to memory of 1500	4856	regsvr32.exe	explorer.exe
PID 4856 wrote to memory of 1500	4856	regsvr32.exe	explorer.exe
PID 4856 wrote to memory of 1500	4856	regsvr32.exe	explorer.exe
PID 4856 wrote to memory of 1500	4856	regsvr32.exe	explorer.exe
PID 1500 wrote to memory of 3384	1500	explorer.exe	reg.exe
PID 1500 wrote to memory of 3384	1500	explorer.exe	reg.exe
PID 1500 wrote to memory of 4964	1500	explorer.exe	reg.exe
PID 1500 wrote to memory of 4964	1500	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\19b8d26a254caac2ba263796f422ad18_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\19b8d26a254caac2ba263796f422ad18_JaffaCakes118.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3464

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lrrmzpi /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\19b8d26a254caac2ba263796f422ad18_JaffaCakes118.dll\"" /SC ONCE /Z /ST 10:04 /ET 10:16
4⤵
- Scheduled Task/Job: Scheduled Task
PID:3524

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\19b8d26a254caac2ba263796f422ad18_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\19b8d26a254caac2ba263796f422ad18_JaffaCakes118.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4856

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Mmyweifeqemd" /d "0"
4⤵
- Windows security bypass
PID:3384

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Mtvpwym" /d "0"
4⤵
- Windows security bypass
PID:4964

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\19b8d26a254caac2ba263796f422ad18_JaffaCakes118.dll
Filesize
436KB

MD5
19b8d26a254caac2ba263796f422ad18

SHA1
c8d1951615c1db33a03d581607ed31ea71344340

SHA256
9b0c1d6622d0c53de27fb7ed63968ee13c641039c9d0c0edfa6943f86d144f28

SHA512
a6032d302412438541aa8eaad738a66f9e7313640619a4c12ed8ef12b6612e427a68e996362e8c2a1fcdedd1cb587a63faa9a87e851bc1944ca707ced7fb48c5

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1500-26-0x0000000000940000-0x0000000000961000-memory.dmp

Filesize
132KB

Download
memory/1500-25-0x0000000000940000-0x0000000000961000-memory.dmp

Filesize
132KB

Download
memory/1500-24-0x0000000000940000-0x0000000000961000-memory.dmp

Filesize
132KB

Download
memory/1736-10-0x0000000000660000-0x0000000000681000-memory.dmp

Filesize
132KB

Download
memory/1736-11-0x0000000000660000-0x0000000000681000-memory.dmp

Filesize
132KB

Download
memory/1736-12-0x0000000000660000-0x0000000000681000-memory.dmp

Filesize
132KB

Download
memory/1736-14-0x0000000000660000-0x0000000000681000-memory.dmp

Filesize
132KB

Download
memory/1736-6-0x0000000000660000-0x0000000000681000-memory.dmp

Filesize
132KB

Download
memory/3464-0-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download
memory/3464-7-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download
memory/3464-4-0x000000001006B000-0x0000000010071000-memory.dmp

Filesize
24KB

Download
memory/3464-5-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download
memory/3464-1-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download
memory/4856-18-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download
memory/4856-19-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download
memory/4856-22-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads