qakbot | dadaccf2c61cf016af68f9337498b27f1f0a827c1d9a62183d5defb4d88714b3

Analysis

max time kernel
137s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01/04/2024, 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

711f5f3963d842fece4327bd15364182_JaffaCakes118.dll
Size

572KB
MD5

711f5f3963d842fece4327bd15364182
SHA1

08e210d7d393bc8f20d36e20a4586b9e721bd0c9
SHA256

dadaccf2c61cf016af68f9337498b27f1f0a827c1d9a62183d5defb4d88714b3
SHA512

db0eb12f4dd0db65a06055cde2fa2bfae55118505814b9fa4947d4cb19d8327b51ee24bf0e6279e07e0d57bbc03b95e0e89ad9b793c29e862b17fb2254f9aa48
SSDEEP

6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eHx:VvAfLfaEkAz5i

Score

10^/10

qakbot obama114 1634112211 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Doecyduqao = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Aexfhwao = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
2964	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3056	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Eoxuidgyiydh\d98c8c5 = ea870eb00ad258845b2393c4dd0c7e2f2ea26a61bc371eebbba858df974f0017667845666ab78c89dd4ad233de301ef8119fd1846caf3617340eea01754459aaf3a8641fe968e0635d10d6e0f6aa4f5e3c99d5d786941896413b32	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Eoxuidgyiydh\b524afa0 = f978499d4df76938691d36644a165a7ef5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Eoxuidgyiydh\80bb7fee = d015c333e6107d895f6e269e9e9c2c53422e19df0d7b89283267452729b302601444068468351041be8db1fffef20d4b36b8708d5be57a5dd7967ac413390ee864b67acc98bca34ec659704d7639c0c4571c385e6f8539012f3bb25a8370383777532831adf7d01a69addfd9765358	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Eoxuidgyiydh\fff21018 = 510262cd30a116f6ec13e6d6fa162bc625a13d597685438f8595ddfe2fcd6d51f211997534d112795268389d35a70ece34f5c4e45d29d9651f12e11680b9660f8d4524718f7b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Eoxuidgyiydh	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Eoxuidgyiydh\ca6dc056 = f347993d354d349f01ed23baaf043a9cd922b6d5107d4e2b15b45c8e25e90883c05d7bbd382e7a1cf86ce6bc02124d44b2cf13bf3470a66e5bfb8712816d591da82d2917e7d26bfcdc08105e835b38611dc4eb14ae6c2462f4dc2ccf298fde90c5ad43bef384b01e18180cc299dac11bea0430ba4ea08ad434a29237f82386f173cca82ba9ef6484c7a2ca5902	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Eoxuidgyiydh\c82ce02a = d9f4a3c88280c9c3d33409d21afea78c729d55485d258633e0bf1a5b8f38c85c2f7d143c24c9ca60748a9f0a57acfc7f0f57b3f3e574515e96c55ba2a26d974325214333d2c4eae2233c17c9032b03ed38122b536e4cd80a358cbd3a7b688acc6b0bb5aa3bf456d730b868	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Eoxuidgyiydh\7090874f = a7ac107e1e46d46d3f9c40ebfb0e0efae226e82e3a8925afdad6d06f67043885e1d3ae1de6cd022f350af34a0ffe092fdbd7773eea9a2883b8f5f8e6116fee69b94ba7b6a2d49ce2c63d96c3503d6f7175503467751e99fc8e6dbbab94c68cf631240cd0bbe78e664303b5af41104b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Eoxuidgyiydh\72d1a733 = b201b24c36a93e8c7be7d598609c113a798af02dcf3cdfeda17bdc54f332d20644a553670bf0f8a7469cbdbf389e03a6aae42c9db70a5084a11aa9f1d78b9c40b9eb71eff870582012d3606eab86554f4abe7b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Eoxuidgyiydh\fff21018 = 510275cd30a123d0f44004dde643f44d1eeba68ae30db6609029c67e0f852890ce1e69132d0b0d5861bccebc174712e186	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1752	rundll32.exe
2964	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1752	rundll32.exe
2964	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1752	1804	rundll32.exe	28
PID 1804 wrote to memory of 1752	1804	rundll32.exe	28
PID 1804 wrote to memory of 1752	1804	rundll32.exe	28
PID 1804 wrote to memory of 1752	1804	rundll32.exe	28
PID 1804 wrote to memory of 1752	1804	rundll32.exe	28
PID 1804 wrote to memory of 1752	1804	rundll32.exe	28
PID 1804 wrote to memory of 1752	1804	rundll32.exe	28
PID 1752 wrote to memory of 2268	1752	rundll32.exe	29
PID 1752 wrote to memory of 2268	1752	rundll32.exe	29
PID 1752 wrote to memory of 2268	1752	rundll32.exe	29
PID 1752 wrote to memory of 2268	1752	rundll32.exe	29
PID 1752 wrote to memory of 2268	1752	rundll32.exe	29
PID 1752 wrote to memory of 2268	1752	rundll32.exe	29
PID 2268 wrote to memory of 3056	2268	explorer.exe	30
PID 2268 wrote to memory of 3056	2268	explorer.exe	30
PID 2268 wrote to memory of 3056	2268	explorer.exe	30
PID 2268 wrote to memory of 3056	2268	explorer.exe	30
PID 2832 wrote to memory of 2940	2832	taskeng.exe	35
PID 2832 wrote to memory of 2940	2832	taskeng.exe	35
PID 2832 wrote to memory of 2940	2832	taskeng.exe	35
PID 2832 wrote to memory of 2940	2832	taskeng.exe	35
PID 2832 wrote to memory of 2940	2832	taskeng.exe	35
PID 2940 wrote to memory of 2964	2940	regsvr32.exe	36
PID 2940 wrote to memory of 2964	2940	regsvr32.exe	36
PID 2940 wrote to memory of 2964	2940	regsvr32.exe	36
PID 2940 wrote to memory of 2964	2940	regsvr32.exe	36
PID 2940 wrote to memory of 2964	2940	regsvr32.exe	36
PID 2940 wrote to memory of 2964	2940	regsvr32.exe	36
PID 2940 wrote to memory of 2964	2940	regsvr32.exe	36
PID 2964 wrote to memory of 1676	2964	regsvr32.exe	37
PID 2964 wrote to memory of 1676	2964	regsvr32.exe	37
PID 2964 wrote to memory of 1676	2964	regsvr32.exe	37
PID 2964 wrote to memory of 1676	2964	regsvr32.exe	37
PID 2964 wrote to memory of 1676	2964	regsvr32.exe	37
PID 2964 wrote to memory of 1676	2964	regsvr32.exe	37
PID 1676 wrote to memory of 1876	1676	explorer.exe	38
PID 1676 wrote to memory of 1876	1676	explorer.exe	38
PID 1676 wrote to memory of 1876	1676	explorer.exe	38
PID 1676 wrote to memory of 1876	1676	explorer.exe	38
PID 1676 wrote to memory of 768	1676	explorer.exe	40
PID 1676 wrote to memory of 768	1676	explorer.exe	40
PID 1676 wrote to memory of 768	1676	explorer.exe	40
PID 1676 wrote to memory of 768	1676	explorer.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\711f5f3963d842fece4327bd15364182_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\711f5f3963d842fece4327bd15364182_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fnazxzbvgd /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\711f5f3963d842fece4327bd15364182_JaffaCakes118.dll\"" /SC ONCE /Z /ST 11:48 /ET 12:00
      4⤵
      Creates scheduled task(s)
      PID:3056

C:\Windows\system32\taskeng.exe
taskeng.exe {259397C1-9AEE-4475-9D96-059FB04A7E6E} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\711f5f3963d842fece4327bd15364182_JaffaCakes118.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\711f5f3963d842fece4327bd15364182_JaffaCakes118.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1676
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Doecyduqao" /d "0"
        5⤵
        Windows security bypass
        
        PID:1876
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Aexfhwao" /d "0"
        5⤵
        Windows security bypass
        
        PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\711f5f3963d842fece4327bd15364182_JaffaCakes118.dll

Filesize
572KB

MD5
711f5f3963d842fece4327bd15364182

SHA1
08e210d7d393bc8f20d36e20a4586b9e721bd0c9

SHA256
dadaccf2c61cf016af68f9337498b27f1f0a827c1d9a62183d5defb4d88714b3

SHA512
db0eb12f4dd0db65a06055cde2fa2bfae55118505814b9fa4947d4cb19d8327b51ee24bf0e6279e07e0d57bbc03b95e0e89ad9b793c29e862b17fb2254f9aa48

Download Submit
memory/1676-23-0x0000000000110000-0x0000000000131000-memory.dmp

Filesize
132KB

Download
memory/1676-31-0x0000000000110000-0x0000000000131000-memory.dmp

Filesize
132KB

Download
memory/1676-29-0x0000000000110000-0x0000000000131000-memory.dmp

Filesize
132KB

Download
memory/1676-28-0x0000000000110000-0x0000000000131000-memory.dmp

Filesize
132KB

Download
memory/1676-27-0x0000000000110000-0x0000000000131000-memory.dmp

Filesize
132KB

Download
memory/1752-1-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1752-2-0x0000000000150000-0x0000000000185000-memory.dmp

Filesize
212KB

Download
memory/1752-3-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1752-0-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/1752-6-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2268-5-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2268-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2268-10-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2268-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2268-9-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2268-4-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2964-19-0x0000000000120000-0x0000000000155000-memory.dmp

Filesize
212KB

Download
memory/2964-20-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2964-18-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2964-25-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download