qakbot | 4eebacf9b5e2267f88df9011b3f6027116a2b765a4eb34bade925892705a9dab

Analysis

max time kernel
139s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-03-2024 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

591c417ad8fe1811a1716c513ce86500_JaffaCakes118.dll
Size

572KB
MD5

591c417ad8fe1811a1716c513ce86500
SHA1

d2ce8d500ba3b56a2dd020c7d48e2a253c0993bc
SHA256

4eebacf9b5e2267f88df9011b3f6027116a2b765a4eb34bade925892705a9dab
SHA512

56c252c7d8e8d4e49b4d7731e6219fbebe91626294f59d4e1c1101145cafc8e152dcdd275add832e7e298688bde79698b0981cccce946708f7ca2a20b8a93016
SSDEEP

6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eHu:VvAfLfaEkAz5J

Score

10^/10

qakbot obama114 1634112211 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Oqfnydo = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Zeakv = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid	Process
1068	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exe

pid	Process
2616	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qyywktbq\f560dd8b = f5a5faaee66470a3d3162751567d9ec1eae3277186c730d20b1f58aa181ef9f1fb71fbee20bae5edfad7418e6cce27385beab1a34ec85eec0a40f4907b1c15840d3b4c47a77c6cd27dca1dbc965d1df75ea95a6a73c45fed05a52e073bb43a36d4bd6e08	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qyywktbq\88689201 = 56c74fb3777558638c9c3539a746920ce90ef40587b3c1e906b8372d81fe3f5ea9aaf204b5a8daac10d22f1340de955b9b5c809519f9dafed7296481523a45329f06006600298e7b4b2bd3dbe2bf179992e2ec1e4fb88b3bdcaf9a5149bf144878969fe76782cdf5f2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qyywktbq\30d4f564 = d6aa7ce675cf63b9db6171990eaa	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qyywktbq\54b252a = 44e443f5e37c57da64601f14d15e90ca	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qyywktbq\7a024adc = 9db0362a67c66a38975c34653271eaadefa5cf0685ad3af9de5be951ce5cabf6e8317a6fe9f24f5f482ae563b2476badaeac7dfbc87f71c41a440f5cc75a08168a177edf79592048e56f1ee66d7eb275ea379bffe5d1795cfa032478a15c206280dea90af7af1fc1ac785a9ffa43d9ee5b76f49213e7	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qyywktbq	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qyywktbq\7a024adc = 9db0212a67c65f3cc2d6ecc534c3a751435edd57822a68aca526386eb110ceac78110e50f80d1a2f8bb63ae0828e2ad19b2bf5a6404a47c7c9a4027faf9fccce37021cd9fb8194ed10aaa31af9cea44a2b67f29cd27759fc22d4cd85395d9ff0e4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qyywktbq\4f9d9a92 = 20717271c152b3cdace06745df5dbbfa681acbbdef1aa4d25d381250353aa36eb5e34a75f5ecbfb9870e60968f3a9bc9b3e9ed309d0127ded8983bd8b4a018d62d30c3d3bf08920437b38915f64a243ac2a7205d5bfc0df5658a2f7260406fd9f6787efdfb451b90ddd4ce93a8ca672cffbe216c7fb8562e873daf5a60dbc83f70e5b7948cf9f0bcc42735cf6247f8b845c3ef2c01343f15bad019faa44c799ee0f0547dfb310cea691d392fe0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qyywktbq\4ddcbaee = 8fd28b2726c10c1fba0ee1d84b1ed0c0c152edf6726e5eb95bd5cb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qyywktbq\f721fdf7 = a1aa2490c3bafff194da94c4f742d84383df61a8b2548a7f903ed171b7a844fe8ea8f9f65b071cb89499a1f34b3b485a6602beb215f1901fd6a9a532913875108ab7abd940b6aab0236a49a09f384086645bb7d2aeb317c4ce4970d3c9	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid	Process
2748	rundll32.exe
1068	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid	Process
2748	rundll32.exe
1068	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	Process	procid_target
PID 1532 wrote to memory of 2748	1532	rundll32.exe	28
PID 1532 wrote to memory of 2748	1532	rundll32.exe	28
PID 1532 wrote to memory of 2748	1532	rundll32.exe	28
PID 1532 wrote to memory of 2748	1532	rundll32.exe	28
PID 1532 wrote to memory of 2748	1532	rundll32.exe	28
PID 1532 wrote to memory of 2748	1532	rundll32.exe	28
PID 1532 wrote to memory of 2748	1532	rundll32.exe	28
PID 2748 wrote to memory of 2900	2748	rundll32.exe	29
PID 2748 wrote to memory of 2900	2748	rundll32.exe	29
PID 2748 wrote to memory of 2900	2748	rundll32.exe	29
PID 2748 wrote to memory of 2900	2748	rundll32.exe	29
PID 2748 wrote to memory of 2900	2748	rundll32.exe	29
PID 2748 wrote to memory of 2900	2748	rundll32.exe	29
PID 2900 wrote to memory of 2616	2900	explorer.exe	30
PID 2900 wrote to memory of 2616	2900	explorer.exe	30
PID 2900 wrote to memory of 2616	2900	explorer.exe	30
PID 2900 wrote to memory of 2616	2900	explorer.exe	30
PID 572 wrote to memory of 1712	572	taskeng.exe	35
PID 572 wrote to memory of 1712	572	taskeng.exe	35
PID 572 wrote to memory of 1712	572	taskeng.exe	35
PID 572 wrote to memory of 1712	572	taskeng.exe	35
PID 572 wrote to memory of 1712	572	taskeng.exe	35
PID 1712 wrote to memory of 1068	1712	regsvr32.exe	36
PID 1712 wrote to memory of 1068	1712	regsvr32.exe	36
PID 1712 wrote to memory of 1068	1712	regsvr32.exe	36
PID 1712 wrote to memory of 1068	1712	regsvr32.exe	36
PID 1712 wrote to memory of 1068	1712	regsvr32.exe	36
PID 1712 wrote to memory of 1068	1712	regsvr32.exe	36
PID 1712 wrote to memory of 1068	1712	regsvr32.exe	36
PID 1068 wrote to memory of 1184	1068	regsvr32.exe	37
PID 1068 wrote to memory of 1184	1068	regsvr32.exe	37
PID 1068 wrote to memory of 1184	1068	regsvr32.exe	37
PID 1068 wrote to memory of 1184	1068	regsvr32.exe	37
PID 1068 wrote to memory of 1184	1068	regsvr32.exe	37
PID 1068 wrote to memory of 1184	1068	regsvr32.exe	37
PID 1184 wrote to memory of 940	1184	explorer.exe	38
PID 1184 wrote to memory of 940	1184	explorer.exe	38
PID 1184 wrote to memory of 940	1184	explorer.exe	38
PID 1184 wrote to memory of 940	1184	explorer.exe	38
PID 1184 wrote to memory of 616	1184	explorer.exe	40
PID 1184 wrote to memory of 616	1184	explorer.exe	40
PID 1184 wrote to memory of 616	1184	explorer.exe	40
PID 1184 wrote to memory of 616	1184	explorer.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\591c417ad8fe1811a1716c513ce86500_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\591c417ad8fe1811a1716c513ce86500_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn euokwbhv /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\591c417ad8fe1811a1716c513ce86500_JaffaCakes118.dll\"" /SC ONCE /Z /ST 17:11 /ET 17:23
      4⤵
      Creates scheduled task(s)
      PID:2616

C:\Windows\system32\taskeng.exe
taskeng.exe {0DB00EF9-66B1-48E5-8FAB-AD597B484FED} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:572
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\591c417ad8fe1811a1716c513ce86500_JaffaCakes118.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\591c417ad8fe1811a1716c513ce86500_JaffaCakes118.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1184
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Oqfnydo" /d "0"
        5⤵
        Windows security bypass
        
        PID:940
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Zeakv" /d "0"
        5⤵
        Windows security bypass
        
        PID:616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\591c417ad8fe1811a1716c513ce86500_JaffaCakes118.dll

Filesize
572KB

MD5
591c417ad8fe1811a1716c513ce86500

SHA1
d2ce8d500ba3b56a2dd020c7d48e2a253c0993bc

SHA256
4eebacf9b5e2267f88df9011b3f6027116a2b765a4eb34bade925892705a9dab

SHA512
56c252c7d8e8d4e49b4d7731e6219fbebe91626294f59d4e1c1101145cafc8e152dcdd275add832e7e298688bde79698b0981cccce946708f7ca2a20b8a93016

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1068-23-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1068-22-0x0000000000200000-0x0000000000235000-memory.dmp

Filesize
212KB

Download
memory/1068-21-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1068-27-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1184-29-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1184-26-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1184-33-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1184-31-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1184-30-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2748-4-0x0000000000390000-0x00000000003C5000-memory.dmp

Filesize
212KB

Download
memory/2748-9-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2748-0-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2748-5-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2748-3-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2748-2-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2748-1-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2900-6-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/2900-16-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2900-14-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2900-13-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2900-12-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2900-8-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download