qakbot | a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4

Analysis

max time kernel
145s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/03/2024, 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f00035c9fb5b740abaee795979b82ed_JaffaCakes118.dll
Size

833KB
MD5

5f00035c9fb5b740abaee795979b82ed
SHA1

6c980a4d7cc1461645acd4c763a86b9c4e896707
SHA256

a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4
SHA512

92f917f67ae59140909c9e6f42821c6b6396ad10e8a51b3bdfcdb86051d0967c95fe5886ae67be6cfbeef970ea8a75e6ec3f5aa56661334e6de843ed353dd46f
SSDEEP

24576:nU/lh7rH/i9rz+hwKzyUj/JGzwMgtx1EWsrbw4iaZ4gRrb0:nU9h7e9rz+t/JGz5g3uWsrbw4iaqgRro

Score

10^/10

qakbot tr 1633597626 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

Campaign

1633597626

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Reayghtiyw = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Eeryaibk = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
332	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2640	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ceauayk\67a93314 = 113a56fe1005763a79bb83253b72b719d6d429125b688ef23beb698e2360dad664c65b6969f5a30e8af5e59de669fb24f80c48b601d083ad66a1798143a6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ceauayk\5236e35a = 5601899c1eec9c29623cc68a71edcec8e9e157c0de78fcbd5a294f9e1c2b7636b49e8ac14af4037d2fbd1fd7e9e7cf5af07b303c743ae5be509c506c39ce0eb0d67238ba02142014d2cb24c411c2e910f4981eec98f7d1c93ae25cf2247fea26ea0bb3f4b48d9cbc8d7b53bb2eeaf3f2c731c0a56d034cb48ee35d9c58840c9614d84fc85e88c3433efd41d25cf5bf056c53d9edde6cd6ad4106839d02453d0515b1854748858c1226e313aeed4a80cd94714f2a0d03b558bb53229fc733bfa27885	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ceauayk\5077c326 = 5f3a7a6dac0da6e428d05cc0f756ad6f2ffd953ca2e00d7b9f77e7b5a7c611e58b06d8d06763e8dc590d34c50acba5f27cbbca3892fc47a0d2231741ea70dd7f8d15d5354707dd4c558c0e2271467b3e2697b417c74e790c695039b32cd807	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ceauayk\2d7f8cac = 92072e4455f3f96d429a218f097e5ca609f720f30d84c443ff9cbb3fe7f9e69884550526b5e9366449d7f73111bba2852f953a32de837691dd77170bdad5612617d65612a7f7321b2c406dd5a9c18984782dd807f8e025f1a5b4af894a6a833f1a2c79b619d4824fd3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ceauayk\ea8a843f = 6c6e8a7e7200f3ae3840af3f2fac255f019d56a94d95ff059ee48bd2e18ce62047	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ceauayk\18e05ce2 = 4ee60e07026d1c7e87bbcb7778ae1a1fd2022d4fc9d2195c	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ceauayk	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ceauayk\e8cba443 = 60447b00bc91fdcac2ae8e072022060b20473fa7cc78a0b80610	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ceauayk\95c3ebc9 = bc256246e581e86619847e49e1e50ea6c93df0c02bd7b65a2fce548f53f88dfc00d3dc836fb2a8b13efdfce46c79623d78360922	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ceauayk\67a93314 = 113a41fe1005437a608a23dd2558a676b5a950b102340cb77c0f2267e9846160a12417bd996958a3294b4820dc256ac8c6050a045aae8b5380ae9d912586c0973a6ab5cf8bc28e8303a20989676b57ce2575e7	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2288	rundll32.exe
332	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2288	rundll32.exe
332	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2288	2260	rundll32.exe	28
PID 2260 wrote to memory of 2288	2260	rundll32.exe	28
PID 2260 wrote to memory of 2288	2260	rundll32.exe	28
PID 2260 wrote to memory of 2288	2260	rundll32.exe	28
PID 2260 wrote to memory of 2288	2260	rundll32.exe	28
PID 2260 wrote to memory of 2288	2260	rundll32.exe	28
PID 2260 wrote to memory of 2288	2260	rundll32.exe	28
PID 2288 wrote to memory of 3064	2288	rundll32.exe	29
PID 2288 wrote to memory of 3064	2288	rundll32.exe	29
PID 2288 wrote to memory of 3064	2288	rundll32.exe	29
PID 2288 wrote to memory of 3064	2288	rundll32.exe	29
PID 2288 wrote to memory of 3064	2288	rundll32.exe	29
PID 2288 wrote to memory of 3064	2288	rundll32.exe	29
PID 3064 wrote to memory of 2640	3064	explorer.exe	30
PID 3064 wrote to memory of 2640	3064	explorer.exe	30
PID 3064 wrote to memory of 2640	3064	explorer.exe	30
PID 3064 wrote to memory of 2640	3064	explorer.exe	30
PID 732 wrote to memory of 308	732	taskeng.exe	35
PID 732 wrote to memory of 308	732	taskeng.exe	35
PID 732 wrote to memory of 308	732	taskeng.exe	35
PID 732 wrote to memory of 308	732	taskeng.exe	35
PID 732 wrote to memory of 308	732	taskeng.exe	35
PID 308 wrote to memory of 332	308	regsvr32.exe	36
PID 308 wrote to memory of 332	308	regsvr32.exe	36
PID 308 wrote to memory of 332	308	regsvr32.exe	36
PID 308 wrote to memory of 332	308	regsvr32.exe	36
PID 308 wrote to memory of 332	308	regsvr32.exe	36
PID 308 wrote to memory of 332	308	regsvr32.exe	36
PID 308 wrote to memory of 332	308	regsvr32.exe	36
PID 332 wrote to memory of 2492	332	regsvr32.exe	37
PID 332 wrote to memory of 2492	332	regsvr32.exe	37
PID 332 wrote to memory of 2492	332	regsvr32.exe	37
PID 332 wrote to memory of 2492	332	regsvr32.exe	37
PID 332 wrote to memory of 2492	332	regsvr32.exe	37
PID 332 wrote to memory of 2492	332	regsvr32.exe	37
PID 2492 wrote to memory of 2004	2492	explorer.exe	38
PID 2492 wrote to memory of 2004	2492	explorer.exe	38
PID 2492 wrote to memory of 2004	2492	explorer.exe	38
PID 2492 wrote to memory of 2004	2492	explorer.exe	38
PID 2492 wrote to memory of 1732	2492	explorer.exe	40
PID 2492 wrote to memory of 1732	2492	explorer.exe	40
PID 2492 wrote to memory of 1732	2492	explorer.exe	40
PID 2492 wrote to memory of 1732	2492	explorer.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f00035c9fb5b740abaee795979b82ed_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f00035c9fb5b740abaee795979b82ed_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zbvhuya /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\5f00035c9fb5b740abaee795979b82ed_JaffaCakes118.dll\"" /SC ONCE /Z /ST 21:51 /ET 22:03
      4⤵
      Creates scheduled task(s)
      PID:2640

C:\Windows\system32\taskeng.exe
taskeng.exe {C7545F2A-4EBF-49FD-B65D-D3F628951338} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\5f00035c9fb5b740abaee795979b82ed_JaffaCakes118.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:308
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\5f00035c9fb5b740abaee795979b82ed_JaffaCakes118.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:332
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2492
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Reayghtiyw" /d "0"
        5⤵
        Windows security bypass
        
        PID:2004
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Eeryaibk" /d "0"
        5⤵
        Windows security bypass
        
        PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5f00035c9fb5b740abaee795979b82ed_JaffaCakes118.dll

Filesize
833KB

MD5
5f00035c9fb5b740abaee795979b82ed

SHA1
6c980a4d7cc1461645acd4c763a86b9c4e896707

SHA256
a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4

SHA512
92f917f67ae59140909c9e6f42821c6b6396ad10e8a51b3bdfcdb86051d0967c95fe5886ae67be6cfbeef970ea8a75e6ec3f5aa56661334e6de843ed353dd46f

Download Submit
memory/332-26-0x0000000074700000-0x0000000074871000-memory.dmp

Filesize
1.4MB

Download
memory/332-21-0x0000000074700000-0x0000000074871000-memory.dmp

Filesize
1.4MB

Download
memory/332-20-0x0000000074700000-0x0000000074871000-memory.dmp

Filesize
1.4MB

Download
memory/2288-6-0x0000000075180000-0x00000000752F1000-memory.dmp

Filesize
1.4MB

Download
memory/2288-0-0x0000000075180000-0x00000000752F1000-memory.dmp

Filesize
1.4MB

Download
memory/2288-1-0x0000000075180000-0x00000000752F1000-memory.dmp

Filesize
1.4MB

Download
memory/2288-3-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2492-25-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2492-32-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2492-30-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2492-29-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2492-28-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/3064-13-0x00000000000E0000-0x0000000000101000-memory.dmp

Filesize
132KB

Download
memory/3064-4-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/3064-15-0x00000000000E0000-0x0000000000101000-memory.dmp

Filesize
132KB

Download
memory/3064-7-0x00000000000E0000-0x0000000000101000-memory.dmp

Filesize
132KB

Download
memory/3064-12-0x00000000000E0000-0x0000000000101000-memory.dmp

Filesize
132KB

Download
memory/3064-11-0x00000000000E0000-0x0000000000101000-memory.dmp

Filesize
132KB

Download