qakbot | 59b7483e0e252b0d5d3bc65cf1e11dc47033bcddda5c02a8b63105a001a338e7

Analysis

max time kernel
146s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f656d6ccef1f3f9499e9a07e22782271_JaffaCakes118.dll
Size

506KB
MD5

f656d6ccef1f3f9499e9a07e22782271
SHA1

46d6812d888fadf561def0f65c0a59bcf4bdd8f5
SHA256

59b7483e0e252b0d5d3bc65cf1e11dc47033bcddda5c02a8b63105a001a338e7
SHA512

46ce130f1b3f7624a0cc8df9d9f18e6c80a5154825cb075a2a9dd6b45320e87c8c553985278984487c817bb6a8ed36e50e1aef6bc8795cb25ed61d2d36eb1769
SSDEEP

12288:hW7OY3YTn155L/9hFTMq2EKMAcuCSF7aqxETMNIp0Fh6jUV:hWf3YTnJLBv2EKMAcOgqxETMNIpM6o

Score

10^/10

qakbot obama108 1633342139 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama108

Campaign

1633342139

206.47.134.234:2222

73.230.205.91:443

190.198.206.189:2222

103.246.130.2:20

103.246.130.122:20

81.250.153.227:2222

167.248.100.227:443

37.210.152.224:995

96.57.188.174:2078

2.99.100.134:2222

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

136.232.34.70:443

68.186.192.69:443

167.248.111.245:443

81.241.252.59:2078

94.200.181.154:443

96.46.103.226:443

187.116.124.82:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Wifbroy = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Pmkfj = "0"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid	Process
468	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rundll32.exeexplorer.exeschtasks.exeregsvr32.exeexplorer.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Crtqcijiuioed\5aecc36e = 4fcd6a9ff2419ae2ec1a0435efb67bb1a52bda79f0a4e6673f6e458888c841575cde08c977101220ba64755d475e3b7a021501c66eb9ee5537c64b799b5839a96a0cbafe3321586811968a1be844bba1d547dbad8b0df0a63e99	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Crtqcijiuioed\6f731320 = 1acf1947614cae0091cc207ece86568661d3ce4014b4ceaec49e60b3b63b03	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Crtqcijiuioed	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Crtqcijiuioed\27e48ce4 = 1fc56f042c1ad07c524501be83f27afdcce860b26fb785ce7f50770aa1681ed6ec623dd189	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Crtqcijiuioed\9f58eb81 = cdeae68a755b9fc5e50f03b8bbf34220f8cce03de5c54ed3ca399786	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Crtqcijiuioed\e250a40b = ad6c456bfb4d7be8094d8e97b616f1001943f4ae53d45e38bfdabb50520aa36a4992f84f01afa08ae6a53aec0b51d6a9fc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Crtqcijiuioed\9d19cbfd = 066573ec6074c851184a0963cb47e91e9e4f832c4d28d347dbfbbdc377cc5e9cbf646b86a9650bc398998d9d156460f71ecdbda08bf454db6d9c5519b44814799f5c118a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Crtqcijiuioed\103a7cd6 = 840a0d17e6ecec5b93da212fa6f1d2c2ff6dea62fa2df0416bbd4353139f287e9f6d1bb0ab032fb30935553fd823611fb4d38b24b4f750ad3061a777a3caa24d373db3d17989f9a22a33244f217ae11ecd68a8d4db397060a56009524437fe35bfb06906af	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Crtqcijiuioed\103a7cd6 = 840a1a17e6ecd94c808e36037e40fce7b474fa88c3d5742c8cac888b893fedcedddfdbc20f594d56e2b6e8b0251af56a48a4672d4f1abb0620c1d482690cc98e5ae6d1e48b4a48ce143617b3fed15475	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Crtqcijiuioed\25a5ac98 = 82dcc9131774a209281294f2ae5a8b5e92291cda4339a407aa731c0df30db3a1c97692ee9ea7aac616262e29072d366bef023a1f13116eb7a043afb7e8a228c53523996fcb7c009e8b627cc71abc84e4f741d6c9a459d42092f30b01658e53997f6562f96d285687f41763c654285c9f0fb2398b8237223cab87dd	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
2192	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid	Process
1752	rundll32.exe
468	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid	Process
1752	rundll32.exe
468	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	Process	procid_target
PID 1852 wrote to memory of 1752	1852	rundll32.exe	31
PID 1852 wrote to memory of 1752	1852	rundll32.exe	31
PID 1852 wrote to memory of 1752	1852	rundll32.exe	31
PID 1852 wrote to memory of 1752	1852	rundll32.exe	31
PID 1852 wrote to memory of 1752	1852	rundll32.exe	31
PID 1852 wrote to memory of 1752	1852	rundll32.exe	31
PID 1852 wrote to memory of 1752	1852	rundll32.exe	31
PID 1752 wrote to memory of 2248	1752	rundll32.exe	32
PID 1752 wrote to memory of 2248	1752	rundll32.exe	32
PID 1752 wrote to memory of 2248	1752	rundll32.exe	32
PID 1752 wrote to memory of 2248	1752	rundll32.exe	32
PID 1752 wrote to memory of 2248	1752	rundll32.exe	32
PID 1752 wrote to memory of 2248	1752	rundll32.exe	32
PID 2248 wrote to memory of 2192	2248	explorer.exe	33
PID 2248 wrote to memory of 2192	2248	explorer.exe	33
PID 2248 wrote to memory of 2192	2248	explorer.exe	33
PID 2248 wrote to memory of 2192	2248	explorer.exe	33
PID 2804 wrote to memory of 2892	2804	taskeng.exe	37
PID 2804 wrote to memory of 2892	2804	taskeng.exe	37
PID 2804 wrote to memory of 2892	2804	taskeng.exe	37
PID 2804 wrote to memory of 2892	2804	taskeng.exe	37
PID 2804 wrote to memory of 2892	2804	taskeng.exe	37
PID 2892 wrote to memory of 468	2892	regsvr32.exe	38
PID 2892 wrote to memory of 468	2892	regsvr32.exe	38
PID 2892 wrote to memory of 468	2892	regsvr32.exe	38
PID 2892 wrote to memory of 468	2892	regsvr32.exe	38
PID 2892 wrote to memory of 468	2892	regsvr32.exe	38
PID 2892 wrote to memory of 468	2892	regsvr32.exe	38
PID 2892 wrote to memory of 468	2892	regsvr32.exe	38
PID 468 wrote to memory of 3056	468	regsvr32.exe	39
PID 468 wrote to memory of 3056	468	regsvr32.exe	39
PID 468 wrote to memory of 3056	468	regsvr32.exe	39
PID 468 wrote to memory of 3056	468	regsvr32.exe	39
PID 468 wrote to memory of 3056	468	regsvr32.exe	39
PID 468 wrote to memory of 3056	468	regsvr32.exe	39
PID 3056 wrote to memory of 2452	3056	explorer.exe	40
PID 3056 wrote to memory of 2452	3056	explorer.exe	40
PID 3056 wrote to memory of 2452	3056	explorer.exe	40
PID 3056 wrote to memory of 2452	3056	explorer.exe	40
PID 3056 wrote to memory of 2280	3056	explorer.exe	42
PID 3056 wrote to memory of 2280	3056	explorer.exe	42
PID 3056 wrote to memory of 2280	3056	explorer.exe	42
PID 3056 wrote to memory of 2280	3056	explorer.exe	42

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f656d6ccef1f3f9499e9a07e22782271_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f656d6ccef1f3f9499e9a07e22782271_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dzckvqmpzu /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\f656d6ccef1f3f9499e9a07e22782271_JaffaCakes118.dll\"" /SC ONCE /Z /ST 15:49 /ET 16:01
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2192

C:\Windows\system32\taskeng.exe
taskeng.exe {DE5E16BF-5024-4E0E-B084-75D91C56CCCC} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\f656d6ccef1f3f9499e9a07e22782271_JaffaCakes118.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\f656d6ccef1f3f9499e9a07e22782271_JaffaCakes118.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Wifbroy" /d "0"
        5⤵
        Windows security bypass
        
        PID:2452
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Pmkfj" /d "0"
        5⤵
        Windows security bypass
        
        PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f656d6ccef1f3f9499e9a07e22782271_JaffaCakes118.dll

Filesize
506KB

MD5
f656d6ccef1f3f9499e9a07e22782271

SHA1
46d6812d888fadf561def0f65c0a59bcf4bdd8f5

SHA256
59b7483e0e252b0d5d3bc65cf1e11dc47033bcddda5c02a8b63105a001a338e7

SHA512
46ce130f1b3f7624a0cc8df9d9f18e6c80a5154825cb075a2a9dd6b45320e87c8c553985278984487c817bb6a8ed36e50e1aef6bc8795cb25ed61d2d36eb1769

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/468-24-0x0000000072310000-0x0000000072C9A000-memory.dmp

Filesize
9.5MB

Download
memory/468-20-0x0000000072310000-0x0000000072C9A000-memory.dmp

Filesize
9.5MB

Download
memory/468-19-0x0000000072310000-0x0000000072C9A000-memory.dmp

Filesize
9.5MB

Download
memory/1752-1-0x0000000072D1F000-0x0000000072D25000-memory.dmp

Filesize
24KB

Download
memory/1752-4-0x0000000072CA0000-0x000000007362A000-memory.dmp

Filesize
9.5MB

Download
memory/1752-2-0x0000000072CA0000-0x000000007362A000-memory.dmp

Filesize
9.5MB

Download
memory/1752-0-0x0000000072CA0000-0x000000007362A000-memory.dmp

Filesize
9.5MB

Download
memory/1752-7-0x0000000072CA0000-0x000000007362A000-memory.dmp

Filesize
9.5MB

Download
memory/2248-5-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2248-14-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2248-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2248-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2248-10-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2248-6-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3056-26-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3056-28-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3056-27-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download