qakbot | 6cd4744b21f0f2f3145ff26150d7c8db36da68a4cf5d7ba7346cd2a31569c871

Analysis

max time kernel
145s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-08-2024 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb3ed0fab377c48841597c09e0fec1f1_JaffaCakes118.dll
Size

506KB
MD5

cb3ed0fab377c48841597c09e0fec1f1
SHA1

6e74569cc356139e1892732fcc97a6ec94c6240e
SHA256

6cd4744b21f0f2f3145ff26150d7c8db36da68a4cf5d7ba7346cd2a31569c871
SHA512

ecb20de8b435db88f766dd03344ca96a06c7b60392deafdb21fa4e1b2f675a33ed7117294d74bf6395cb79157b438fca7ea53ad26d5cfdc578da59703d662079
SSDEEP

12288:4W7OY3YTn155L/9hFTMq2EKMAcuCSF7aqxETMNIp0Fh6zUV:4Wf3YTnJLBv2EKMAcOgqxETMNIpM6Y

Score

10^/10

qakbot obama108 1633342139 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama108

Campaign

1633342139

206.47.134.234:2222

73.230.205.91:443

190.198.206.189:2222

103.246.130.2:20

103.246.130.122:20

81.250.153.227:2222

167.248.100.227:443

37.210.152.224:995

96.57.188.174:2078

2.99.100.134:2222

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

136.232.34.70:443

68.186.192.69:443

167.248.111.245:443

81.241.252.59:2078

94.200.181.154:443

96.46.103.226:443

187.116.124.82:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Ctflrvup = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Uxhoagv = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
988	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Igokagiwp\f01b8bdb = 1bf242521709fb6dafdd3edab59a49e199bfc91c318e12accd491ca159902ee60906f3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Igokagiwp\c5845b95 = b79b10341d0a58896886bfa10f7cdb28d216f9e365349009030bbec910381a6dc8d9161d515d84293c66f26d0d1ead59d3042b92e76cf98b36614e2471be64e1992f01c8a76ac9232be6cdb664a178a702e797726b1d3a3683fc0fc916e767ce723685f1b68dc8a9f087d837dfb09c75e3496900c56ca91d55fca1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Igokagiwp\c7c57be9 = c19275412968a5aa18ce7db14b153f1dd2aefabc6243fa7295bed4cef10989	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Igokagiwp\7f791c8c = 2481273f1674c30e01087820fea307e6b8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Igokagiwp\2715306 = f50bd33cda929dd8ff767f25dcfd8aa37d4100f856417bb9b475da3f524ce4994cc817877c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Igokagiwp\7d383cf0 = 6f22aa0b490e4939850928b18ba65287068be58cf7ea	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Igokagiwp\f01b8bdb = 1bf255521709ce7e9d628bd982d71cc8a307224e81e5c015f6014241701cc193673cce4fc5cd17000fb0a233e4e6be4da5633b388e46f32e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Igokagiwp	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Igokagiwp\bacd3463 = e4df0bd37d90a17dc085a1bd0d76aa04b31c0c250528b54fcffbd26590ca047304c5333078c9f78be8e66e527ab705ea3d19844a02b4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Igokagiwp\8f52e42d = 747f60fa6a2757aa2c74121f2b2f2c4f757c33c8d16233d505f365aa20ede9f750c6fa8063e978fbbc0fea758c4d1168737c6bca17a85a5eae4fbff476104d9131ce242a260b163776e3a45047c147b8fbd6d1f57a70b018a178fbf41c64	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2348	rundll32.exe
988	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2348	rundll32.exe
988	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2348	2324	rundll32.exe	31
PID 2324 wrote to memory of 2348	2324	rundll32.exe	31
PID 2324 wrote to memory of 2348	2324	rundll32.exe	31
PID 2324 wrote to memory of 2348	2324	rundll32.exe	31
PID 2324 wrote to memory of 2348	2324	rundll32.exe	31
PID 2324 wrote to memory of 2348	2324	rundll32.exe	31
PID 2324 wrote to memory of 2348	2324	rundll32.exe	31
PID 2348 wrote to memory of 2408	2348	rundll32.exe	32
PID 2348 wrote to memory of 2408	2348	rundll32.exe	32
PID 2348 wrote to memory of 2408	2348	rundll32.exe	32
PID 2348 wrote to memory of 2408	2348	rundll32.exe	32
PID 2348 wrote to memory of 2408	2348	rundll32.exe	32
PID 2348 wrote to memory of 2408	2348	rundll32.exe	32
PID 2408 wrote to memory of 2776	2408	explorer.exe	33
PID 2408 wrote to memory of 2776	2408	explorer.exe	33
PID 2408 wrote to memory of 2776	2408	explorer.exe	33
PID 2408 wrote to memory of 2776	2408	explorer.exe	33
PID 1724 wrote to memory of 1064	1724	taskeng.exe	36
PID 1724 wrote to memory of 1064	1724	taskeng.exe	36
PID 1724 wrote to memory of 1064	1724	taskeng.exe	36
PID 1724 wrote to memory of 1064	1724	taskeng.exe	36
PID 1724 wrote to memory of 1064	1724	taskeng.exe	36
PID 1064 wrote to memory of 988	1064	regsvr32.exe	37
PID 1064 wrote to memory of 988	1064	regsvr32.exe	37
PID 1064 wrote to memory of 988	1064	regsvr32.exe	37
PID 1064 wrote to memory of 988	1064	regsvr32.exe	37
PID 1064 wrote to memory of 988	1064	regsvr32.exe	37
PID 1064 wrote to memory of 988	1064	regsvr32.exe	37
PID 1064 wrote to memory of 988	1064	regsvr32.exe	37
PID 988 wrote to memory of 2168	988	regsvr32.exe	38
PID 988 wrote to memory of 2168	988	regsvr32.exe	38
PID 988 wrote to memory of 2168	988	regsvr32.exe	38
PID 988 wrote to memory of 2168	988	regsvr32.exe	38
PID 988 wrote to memory of 2168	988	regsvr32.exe	38
PID 988 wrote to memory of 2168	988	regsvr32.exe	38
PID 2168 wrote to memory of 2588	2168	explorer.exe	39
PID 2168 wrote to memory of 2588	2168	explorer.exe	39
PID 2168 wrote to memory of 2588	2168	explorer.exe	39
PID 2168 wrote to memory of 2588	2168	explorer.exe	39
PID 2168 wrote to memory of 2420	2168	explorer.exe	41
PID 2168 wrote to memory of 2420	2168	explorer.exe	41
PID 2168 wrote to memory of 2420	2168	explorer.exe	41
PID 2168 wrote to memory of 2420	2168	explorer.exe	41

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb3ed0fab377c48841597c09e0fec1f1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb3ed0fab377c48841597c09e0fec1f1_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn olqaltnluw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\cb3ed0fab377c48841597c09e0fec1f1_JaffaCakes118.dll\"" /SC ONCE /Z /ST 16:50 /ET 17:02
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2776

C:\Windows\system32\taskeng.exe
taskeng.exe {F6F04963-8848-4DF3-8BEB-441A8967E354} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\cb3ed0fab377c48841597c09e0fec1f1_JaffaCakes118.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\cb3ed0fab377c48841597c09e0fec1f1_JaffaCakes118.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2168
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ctflrvup" /d "0"
        5⤵
        Windows security bypass
        
        PID:2588
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Uxhoagv" /d "0"
        5⤵
        Windows security bypass
        
        PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cb3ed0fab377c48841597c09e0fec1f1_JaffaCakes118.dll

Filesize
506KB

MD5
cb3ed0fab377c48841597c09e0fec1f1

SHA1
6e74569cc356139e1892732fcc97a6ec94c6240e

SHA256
6cd4744b21f0f2f3145ff26150d7c8db36da68a4cf5d7ba7346cd2a31569c871

SHA512
ecb20de8b435db88f766dd03344ca96a06c7b60392deafdb21fa4e1b2f675a33ed7117294d74bf6395cb79157b438fca7ea53ad26d5cfdc578da59703d662079

Download Submit
memory/988-22-0x0000000072ED0000-0x000000007385A000-memory.dmp

Filesize
9.5MB

Download
memory/988-21-0x0000000072ED0000-0x000000007385A000-memory.dmp

Filesize
9.5MB

Download
memory/988-26-0x0000000072ED0000-0x000000007385A000-memory.dmp

Filesize
9.5MB

Download
memory/2168-28-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2168-30-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2168-29-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2348-0-0x0000000073860000-0x00000000741EA000-memory.dmp

Filesize
9.5MB

Download
memory/2348-9-0x0000000073860000-0x00000000741EA000-memory.dmp

Filesize
9.5MB

Download
memory/2348-1-0x0000000073860000-0x00000000741EA000-memory.dmp

Filesize
9.5MB

Download
memory/2348-4-0x0000000073860000-0x00000000741EA000-memory.dmp

Filesize
9.5MB

Download
memory/2348-3-0x00000000738DF000-0x00000000738E5000-memory.dmp

Filesize
24KB

Download
memory/2408-7-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2408-16-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2408-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2408-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2408-14-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2408-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2408-5-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download