qakbot | 488aff5976e8fee5f941b9ad61214565723c5f7b324b5d26a978abd336d321da

Analysis

max time kernel
139s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02-04-2024 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89141c9ffcbb60880e8187aef83c935d_JaffaCakes118.dll
Size

689KB
MD5

89141c9ffcbb60880e8187aef83c935d
SHA1

d8f5e0e230889afdce67de83caf12122187887f2
SHA256

488aff5976e8fee5f941b9ad61214565723c5f7b324b5d26a978abd336d321da
SHA512

74f06f57bb72cb342ee6c8539bc3bf64e705f1157f6c7267925faec92db730ebbfc96abe4c9d5a0c9589c3a4d1761eaca049c36a9e2d003efee39f45f3b569ab
SSDEEP

12288:1rI0bPKn8p/S0jXgfFWVkMXl2xAgwFX2dpG83tNzZ0XssC82H6/vLy2MA:VI0bP1XWMXsAZX6tcTLFM

Score

10^/10

qakbot obama117 1634545803 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama117

Campaign

1634545803

176.45.53.222:443

220.255.25.28:2222

91.178.126.51:995

2.222.167.138:443

65.100.174.110:995

105.198.236.99:995

115.96.64.9:995

196.207.140.40:995

24.231.209.2:2222

146.66.238.74:443

103.82.211.39:995

65.100.174.110:443

103.142.10.177:443

140.82.49.12:443

78.105.213.151:995

41.86.42.158:995

89.101.97.139:443

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Ayeeypu = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Lolsehg = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid	Process
1440	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exe

pid	Process
2556	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zytowmnusnn\4533e1f0 = 743ee0ddb1a4ae8a34f4322a3ef053be2ce977afbb9826106091	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zytowmnusnn\fd8f8695 = fb28c1fcffd295b33f934ef5bf544b956043702dfb4cf7e5ead7fe5e4fce66381b6be92d18110ff58ad5844dd23f5f8642deeb6c02f8943cc1dd41cd73c6fbca0b9d61387178bcb599c646e8f1503fa8106bdbcc3cbf220271b7f70ba0cdc908a71b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zytowmnusnn\8087c91f = fe809f63bc5bfbc73e5be72395b5c6dcce203b74e730e32e74949cc42adcc28734511f82a030de96490e0d65684df751f500d9048070d743aec58e7c83d234	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zytowmnusnn\383bae7a = b6afe134492f4eb756d4dd19d3978d30b666171dd2c8ed7cd064c21909058ca6a92c18d7bbbcb61db77c473de0d8c672cbb2efac53f7a863e32292dafaf82fe52e37ce5c6bf6e76305c765bf234b3a8b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zytowmnusnn\ffcea6e9 = 71f5118c2ec2c6d1da2d119ef90ad372bfc95bf8708c1431a1a7a7c7a44e804242278ac77119a0ebccf753cabe16c2368256e873c73244e888859c7e09102febd76eaafad9d0398497692641116be51531c4b25374483a6025d6	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zytowmnusnn	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zytowmnusnn\4772c18c = 25355cdff2406690fb25e8b6e0be80446b73021c8f60486e7f6a0f5bf14ad84bd5eed69aecfac3e846705845a2ae4b10160c4c14e18341009ac9a72022dea9f7e1f02f20d258039e57836a9d5b0fc262c65f04d362b33d6085ba28c294899c7b08cdf7e55ff69eb851abecd66a6d4aa32829a7eac42abc71932fc9c98fd69f2c1a228042fa5c7cad3448cec80a74fe	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zytowmnusnn\da47e34 = 16b74b882f86438925336b29a36585c35e3142f68f6af3fdb074c8897cca144e8342978eb2c9f1ecef7b167e085c6a78b5537be92ea7e0aa15e45be6c1ecc44609da6efb880527d1c4168c3dfbcda52cd3873629641a49605256b6760773ff1446e7db0e3d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zytowmnusnn\72ed11c2 = 029909cf6e45fd07c43748e482b62e6ca51457c589478457b3cb47c231b797275ed7819f6e95717122d72496fa9bbbe2e342824696e68321571ab08b8b2fbb71aab7837080004074bcdfa0abfaa7d62dfad7fc8941c7e2cacf037bc31ab40c7f59392c70274f640506f76f48cbac4357	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zytowmnusnn\72ed11c2 = 02991ecf6e45c87d7b4bbd8daf62ee7874f540c12059587b6d2a75261432947b423d136621efa6d245849d647b293485d1b3e5d7493e829295567349482f5f1d6f07a480ff7cb54df6c69c3f952f6bac1d60d809cd6e467423183b	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid	Process
1204	rundll32.exe
1440	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid	Process
1204	rundll32.exe
1440	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	Process	procid_target
PID 2368 wrote to memory of 1204	2368	rundll32.exe	28
PID 2368 wrote to memory of 1204	2368	rundll32.exe	28
PID 2368 wrote to memory of 1204	2368	rundll32.exe	28
PID 2368 wrote to memory of 1204	2368	rundll32.exe	28
PID 2368 wrote to memory of 1204	2368	rundll32.exe	28
PID 2368 wrote to memory of 1204	2368	rundll32.exe	28
PID 2368 wrote to memory of 1204	2368	rundll32.exe	28
PID 1204 wrote to memory of 3012	1204	rundll32.exe	29
PID 1204 wrote to memory of 3012	1204	rundll32.exe	29
PID 1204 wrote to memory of 3012	1204	rundll32.exe	29
PID 1204 wrote to memory of 3012	1204	rundll32.exe	29
PID 1204 wrote to memory of 3012	1204	rundll32.exe	29
PID 1204 wrote to memory of 3012	1204	rundll32.exe	29
PID 3012 wrote to memory of 2556	3012	explorer.exe	30
PID 3012 wrote to memory of 2556	3012	explorer.exe	30
PID 3012 wrote to memory of 2556	3012	explorer.exe	30
PID 3012 wrote to memory of 2556	3012	explorer.exe	30
PID 1060 wrote to memory of 2912	1060	taskeng.exe	35
PID 1060 wrote to memory of 2912	1060	taskeng.exe	35
PID 1060 wrote to memory of 2912	1060	taskeng.exe	35
PID 1060 wrote to memory of 2912	1060	taskeng.exe	35
PID 1060 wrote to memory of 2912	1060	taskeng.exe	35
PID 2912 wrote to memory of 1440	2912	regsvr32.exe	36
PID 2912 wrote to memory of 1440	2912	regsvr32.exe	36
PID 2912 wrote to memory of 1440	2912	regsvr32.exe	36
PID 2912 wrote to memory of 1440	2912	regsvr32.exe	36
PID 2912 wrote to memory of 1440	2912	regsvr32.exe	36
PID 2912 wrote to memory of 1440	2912	regsvr32.exe	36
PID 2912 wrote to memory of 1440	2912	regsvr32.exe	36
PID 1440 wrote to memory of 1544	1440	regsvr32.exe	37
PID 1440 wrote to memory of 1544	1440	regsvr32.exe	37
PID 1440 wrote to memory of 1544	1440	regsvr32.exe	37
PID 1440 wrote to memory of 1544	1440	regsvr32.exe	37
PID 1440 wrote to memory of 1544	1440	regsvr32.exe	37
PID 1440 wrote to memory of 1544	1440	regsvr32.exe	37
PID 1544 wrote to memory of 2112	1544	explorer.exe	38
PID 1544 wrote to memory of 2112	1544	explorer.exe	38
PID 1544 wrote to memory of 2112	1544	explorer.exe	38
PID 1544 wrote to memory of 2112	1544	explorer.exe	38
PID 1544 wrote to memory of 2272	1544	explorer.exe	40
PID 1544 wrote to memory of 2272	1544	explorer.exe	40
PID 1544 wrote to memory of 2272	1544	explorer.exe	40
PID 1544 wrote to memory of 2272	1544	explorer.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\89141c9ffcbb60880e8187aef83c935d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\89141c9ffcbb60880e8187aef83c935d_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn uelnaved /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\89141c9ffcbb60880e8187aef83c935d_JaffaCakes118.dll\"" /SC ONCE /Z /ST 09:40 /ET 09:52
      4⤵
      Creates scheduled task(s)
      PID:2556

C:\Windows\system32\taskeng.exe
taskeng.exe {A7302DB8-F729-4676-8954-4D2092735EF2} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\89141c9ffcbb60880e8187aef83c935d_JaffaCakes118.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\89141c9ffcbb60880e8187aef83c935d_JaffaCakes118.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1544
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ayeeypu" /d "0"
        5⤵
        Windows security bypass
        
        PID:2112
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Lolsehg" /d "0"
        5⤵
        Windows security bypass
        
        PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\89141c9ffcbb60880e8187aef83c935d_JaffaCakes118.dll

Filesize
689KB

MD5
89141c9ffcbb60880e8187aef83c935d

SHA1
d8f5e0e230889afdce67de83caf12122187887f2

SHA256
488aff5976e8fee5f941b9ad61214565723c5f7b324b5d26a978abd336d321da

SHA512
74f06f57bb72cb342ee6c8539bc3bf64e705f1157f6c7267925faec92db730ebbfc96abe4c9d5a0c9589c3a4d1761eaca049c36a9e2d003efee39f45f3b569ab

Download Submit
memory/1204-8-0x0000000074F80000-0x000000007503D000-memory.dmp

Filesize
756KB

Download
memory/1204-4-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1204-1-0x0000000074F80000-0x000000007503D000-memory.dmp

Filesize
756KB

Download
memory/1204-0-0x0000000074F80000-0x000000007503D000-memory.dmp

Filesize
756KB

Download
memory/1440-28-0x0000000074530000-0x00000000745ED000-memory.dmp

Filesize
756KB

Download
memory/1440-24-0x0000000074530000-0x00000000745ED000-memory.dmp

Filesize
756KB

Download
memory/1440-23-0x0000000074530000-0x00000000745ED000-memory.dmp

Filesize
756KB

Download
memory/1440-20-0x0000000074530000-0x00000000745ED000-memory.dmp

Filesize
756KB

Download
memory/1440-21-0x0000000074530000-0x00000000745ED000-memory.dmp

Filesize
756KB

Download
memory/1544-32-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1544-27-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1544-30-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1544-31-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3012-5-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/3012-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3012-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3012-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3012-7-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3012-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download