qakbot | ab632f1bb9aac5d829ff542bcc95956ad53b85fbb30f3bf36b4e566861d37f61

Analysis

max time kernel
137s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3d2eb53616b824bd6c7633ba3b9e8dfa_JaffaCakes118.dll
Size 708KB
Sample241013-cdfmkstcma
SHA256 ab632f1bb9aac5d829ff542bcc95956ad53b85fbb30f3bf36b4e566861d37f61
MD5 3d2eb53616b824bd6c7633ba3b9e8dfa
SHA1 9c2cffec0459bf488d31c520503b849d601ff67d
SHA512 6cbfd118ad72fa3bfdbc562dea8b9c1a227f4c409308f65cf1ff25b285697ac2dcd91b1715f8dc48cb5bae8b592cbd13b87fb1c44654c9c4221829f7a7978151
SSDEEP 12288:ggbAcis08s7gQFMWC24/MFS+AWmdnWJIjJ5F3+DpEFs3H6v/+loTN0:gaDis0dFA24/MFSptIJKnx+NE23a3+lN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot obama106 1632905607 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama106

Campaign

1632905607

37.210.152.224:995
120.151.47.189:443
105.198.236.99:443
122.11.220.212:2222
199.27.127.129:443
41.251.41.14:995
216.201.162.158:443
124.123.42.115:2078
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
217.17.56.163:443
182.181.78.18:995
140.82.49.12:443
105.159.144.186:995
89.101.97.139:443
217.17.56.163:0
27.223.92.142:995
95.77.223.148:443
109.190.253.11:2222
81.250.153.227:2222
190.198.206.189:2222
81.241.252.59:2078
136.232.34.70:443
47.22.148.6:443
93.8.66.216:443
124.123.42.115:2222
217.17.56.163:2222
217.17.56.163:2078
217.17.56.163:465
41.228.22.180:443
76.25.142.196:443
71.74.12.34:443
71.80.168.245:443
75.188.35.168:443
173.21.10.71:2222
73.151.236.31:443
45.46.53.140:2222
67.165.206.193:993
38.10.201.211:443
72.252.201.69:443
71.60.246.5:443
92.148.59.207:2222
92.157.171.41:2222
24.139.72.117:443
186.18.205.199:995
24.229.150.54:995
47.40.196.233:2222
24.55.112.61:443
177.130.82.197:2222
109.12.111.14:443
68.204.7.158:443
186.87.135.68:995
80.6.192.58:443
103.148.120.144:443
75.66.88.33:443
173.25.166.81:443
187.156.138.172:443
82.77.137.101:995
173.234.155.233:443
2.178.108.147:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Bjlzqi = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Rwqzmwwii = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
1836	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\58c199c5 = 7924e84ea15f6e44ee549ed66268cfe032639b95b5efeae5e6585145bfff4e7480c22208568d405e87f38e5f2d0f058bf0b3ea6f1d721e27a3564e34f4066561613c9ac8e44fdd84795ba2fa39e2a174987f7105edc62867140d8f90381bf3b77260f382aadff63a6391c04917abf0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\9d75b12a = 00729db2667aa29dda92d10ed68b9ae96722f5b20704b223759b2c257a3a0b0a13d2d3e8f0b60841496b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\a8ea6164 = d950cc1667464c95de133f34a82884ff8f33f8e599aaead7edad2df3958a1baf0b1ae6471b7e24c64d3a853e6972bcd38e40ca3cb9fef3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\d7a30e92 = 2d12d93445637f05361554bc6cb008da2c272bf92f7dfa10ffd620829602596846fb06257965885b5802c76f2220908cc944f9df6f3e160fa911469fe36d4a31104f959cb6e62a64c77a134a2102c427347dd50e1e0be65284f88a8a98999a7ed051d48779abaa	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\d7a30e92 = 2d12ce3445634a755ddf8daff0cd16c5c712fb9ae2b55a4ec6cf8a156dab85b712ffcadc5e6016f52881ea6ffcfafb49077776b313a2bc74d66a251d0e9034118db30aa12ff2ec7be975f16502a5fd31932e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\e23cdedc = df7bfc0e9431dbd730408c60462db9d759b2c88bd297a400c9c5f8ed5661ecaff1065b8d6aac29296490451cd769480e6ee070801d7bb90cbd9adf913005f1477d716f9c050f5ae0cff265b2d596bab6fe1d9db13bb4039e4098468682df1ad27f5679ad8678237fa605b9cdaf0eba48ff9a4bb17f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\e07dfea0 = 36b4f4e50a05e611adc118abd4ec41d8ba83d5d6fec1313f82d201e39c30bf578becf0198924478ffab4505331875333f85c1840e5148854696fd14450e0ecc98b37e0b2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\25c9d64f = ff4d7a3bd50a48266b3fb37a13b004fe36727c34239d3434308a87	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\5a80b9b9 = 751f7ea2da7946283275fb34ef7793749a25cfaee0fc950229a5e662c09686f06550046b83eb4ef735d14f9f5c2fa6fed1b796387002f41c32aafa36c4cfdedb5a4401b5b7a85463d3afbf8977c08fa8f7a31a4f65c77a10	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3660	rundll32.exe
3660	rundll32.exe
1836	regsvr32.exe
1836	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3660	rundll32.exe
1836	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 3660	4392	rundll32.exe	83
PID 4392 wrote to memory of 3660	4392	rundll32.exe	83
PID 4392 wrote to memory of 3660	4392	rundll32.exe	83
PID 3660 wrote to memory of 720	3660	rundll32.exe	87
PID 3660 wrote to memory of 720	3660	rundll32.exe	87
PID 3660 wrote to memory of 720	3660	rundll32.exe	87
PID 3660 wrote to memory of 720	3660	rundll32.exe	87
PID 3660 wrote to memory of 720	3660	rundll32.exe	87
PID 720 wrote to memory of 1228	720	explorer.exe	88
PID 720 wrote to memory of 1228	720	explorer.exe	88
PID 720 wrote to memory of 1228	720	explorer.exe	88
PID 3292 wrote to memory of 1836	3292	regsvr32.exe	97
PID 3292 wrote to memory of 1836	3292	regsvr32.exe	97
PID 3292 wrote to memory of 1836	3292	regsvr32.exe	97
PID 1836 wrote to memory of 1848	1836	regsvr32.exe	98
PID 1836 wrote to memory of 1848	1836	regsvr32.exe	98
PID 1836 wrote to memory of 1848	1836	regsvr32.exe	98
PID 1836 wrote to memory of 1848	1836	regsvr32.exe	98
PID 1836 wrote to memory of 1848	1836	regsvr32.exe	98
PID 1848 wrote to memory of 1236	1848	explorer.exe	99
PID 1848 wrote to memory of 1236	1848	explorer.exe	99
PID 1848 wrote to memory of 2948	1848	explorer.exe	101
PID 1848 wrote to memory of 2948	1848	explorer.exe	101

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d2eb53616b824bd6c7633ba3b9e8dfa_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d2eb53616b824bd6c7633ba3b9e8dfa_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:720
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pvqjhsvuuz /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\3d2eb53616b824bd6c7633ba3b9e8dfa_JaffaCakes118.dll\"" /SC ONCE /Z /ST 01:59 /ET 02:11
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1228

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\3d2eb53616b824bd6c7633ba3b9e8dfa_JaffaCakes118.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\3d2eb53616b824bd6c7633ba3b9e8dfa_JaffaCakes118.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Bjlzqi" /d "0"
      4⤵
      Windows security bypass
      PID:1236
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Rwqzmwwii" /d "0"
      4⤵
      Windows security bypass
      PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3d2eb53616b824bd6c7633ba3b9e8dfa_JaffaCakes118.dll

Path C:\Users\Admin\AppData\Local\Temp\3d2eb53616b824bd6c7633ba3b9e8dfa_JaffaCakes118.dll
Size 708KB
SHA256 ab632f1bb9aac5d829ff542bcc95956ad53b85fbb30f3bf36b4e566861d37f61
MD5 3d2eb53616b824bd6c7633ba3b9e8dfa
SHA1 9c2cffec0459bf488d31c520503b849d601ff67d
SHA512 6cbfd118ad72fa3bfdbc562dea8b9c1a227f4c409308f65cf1ff25b285697ac2dcd91b1715f8dc48cb5bae8b592cbd13b87fb1c44654c9c4221829f7a7978151
SSDEEP 12288:ggbAcis08s7gQFMWC24/MFS+AWmdnWJIjJ5F3+DpEFs3H6v/+loTN0:gaDis0dFA24/MFSptIJKnx+NE23a3+lN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/720-14-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/720-10-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/720-11-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/720-12-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/720-6-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/1836-22-0x0000000074DF0000-0x0000000074EBA000-memory.dmp

Download

memory/1836-18-0x0000000074DF0000-0x0000000074EBA000-memory.dmp

Download

memory/1836-19-0x0000000074DF0000-0x0000000074EBA000-memory.dmp

Download

memory/1848-27-0x0000000001200000-0x0000000001221000-memory.dmp

Download

memory/1848-25-0x0000000001200000-0x0000000001221000-memory.dmp

Download

memory/1848-24-0x0000000001200000-0x0000000001221000-memory.dmp

Download

memory/3660-4-0x0000000074F31000-0x0000000074F37000-memory.dmp

Download

memory/3660-5-0x0000000074E80000-0x0000000074F4A000-memory.dmp

Download

memory/3660-0-0x0000000074E80000-0x0000000074F4A000-memory.dmp

Download

memory/3660-7-0x0000000074E80000-0x0000000074F4A000-memory.dmp

Download