qakbot | e60cc81f630400a2fda362feb1d54fbbb9974f73232139b0c7af38b70408b9e7

Analysis

max time kernel
139s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1b3aaa8206bb7fe453d79379d5b6ae72.dll
Size

689KB
MD5

1b3aaa8206bb7fe453d79379d5b6ae72
SHA1

96caed40aac51f3cb119a5edeb7a8b10c8b75a15
SHA256

e60cc81f630400a2fda362feb1d54fbbb9974f73232139b0c7af38b70408b9e7
SHA512

92b642b9b7d5de9eb608ef7fd3c6b0a0df360f0edef9f3f29eff60acc89973bc499cc6b1ef6802c8086bbe5b6496e12fa60b035ea36820c1c188cf4421c25f56
SSDEEP

12288:1rI0bPKn8p/S0jXgfFWVkMXl2xAgwFX2dpG83tNzZ0XssC82H6/vLy2MAc:VI0bP1XWMXsAZX6tcTLFM3

Score

10^/10

qakbot obama117 1634545803 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama117

Campaign

1634545803

176.45.53.222:443

220.255.25.28:2222

91.178.126.51:995

2.222.167.138:443

65.100.174.110:995

105.198.236.99:995

115.96.64.9:995

196.207.140.40:995

24.231.209.2:2222

146.66.238.74:443

103.82.211.39:995

65.100.174.110:443

103.142.10.177:443

140.82.49.12:443

78.105.213.151:995

41.86.42.158:995

89.101.97.139:443

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Puprhasywry = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Kbxmxczzpo = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
2532	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Dyedopdhznlb\9bf28238 = dd55af72fe7cfccc4787b34005e0092f7d6b7e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Dyedopdhznlb\234ee55d = 66e67d4663331c205f4f589c671e2fd540dff884e6c6227ec1a0b46bec93fe53c992b951853a112fe6bf5595f0a772f3e6c710804d518e5c5593312c9e8903	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Dyedopdhznlb\5e46aad7 = a9ef6fafc033d8e77ac211f36876d4f2285c4d847fa6d922253e43734c40635b89860a8f6dd783d8cb4f308c31b39d43fcb80501a2d89ea3bd55f4b8108714b3162c452498d0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Dyedopdhznlb\e6facdb2 = ba4ec0ed1e29504e94c9ec24bf77a6772740a3152b94c790921b934503c5989a2bb08a58f4e15efe9d1f2ab34e629e5b47a8b1991bf1588e003720f535917e95ba8676b24ea8e2482ec161c3ace6cc94643453b7de7815cdc0c12183b1a687240d38280b67c4d9290a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Dyedopdhznlb\210fc521 = dcec9cf6f9983ab1240c1d4020c06d7158253227801cdde6977fd2b9c6b10799b25b2597dc73b671c3ba2451eeb6ad2f5972	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dyedopdhznlb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Dyedopdhznlb\ac2c720a = c1025b83a1d1ff9e6d1cb375890ae9b9ede6e0f9cc178f321856b40e1134d477c9f5dd1a2f2ee209590631d36e79712fc10dc4524829d7a9c414a4bd96ed7f71077f743c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Dyedopdhznlb\99b3a244 = ad90179d43383cf9da0c27b659d13c0dcf9f3e3ea413e0d4c0f0b9ccac72bb15c8a9b7b1c6e561fa03764dbff32f13592a6a1de27bfb8bb858b8b44bb1151fb684f17ea6c4e92263068855fd4acc57d4ac6a5411281d02fd415b36b42b6224a53b023c8c2e1bbe532865c70562eda6b758bde7161624641f442e0cf7b3a9a1c270303232af5d9bfb96c8f9f104c12f8a73b3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Dyedopdhznlb\ac2c720a = c1024c83a1d1ca8b52781e9f4d77deba67eb4b99ee7dc61fa99debbb2c500ae8a9a742c7017d2303361fa1b776e48b640bca118707e0e703fd155c531cc4fb4396603be96addb9be6573fe3a6cae372ba1e3150e22bb9e7d00	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Dyedopdhznlb\d3651dfc = fd02b4583e2b1c30904b88c0dfb3554fbb80824d82e8fcf4f8a7e5d97cd153aa2f38ac476176ec2b09e0d2e1e517aa2716a5eb2196b4cf0de71226df71fc20f7fc6191e23b282ea5f58ed29c86259543bff95da9f91e77e13942c49809b1	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2816	rundll32.exe
2532	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2816	rundll32.exe
2532	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2816	2776	rundll32.exe	30
PID 2776 wrote to memory of 2816	2776	rundll32.exe	30
PID 2776 wrote to memory of 2816	2776	rundll32.exe	30
PID 2776 wrote to memory of 2816	2776	rundll32.exe	30
PID 2776 wrote to memory of 2816	2776	rundll32.exe	30
PID 2776 wrote to memory of 2816	2776	rundll32.exe	30
PID 2776 wrote to memory of 2816	2776	rundll32.exe	30
PID 2816 wrote to memory of 2556	2816	rundll32.exe	31
PID 2816 wrote to memory of 2556	2816	rundll32.exe	31
PID 2816 wrote to memory of 2556	2816	rundll32.exe	31
PID 2816 wrote to memory of 2556	2816	rundll32.exe	31
PID 2816 wrote to memory of 2556	2816	rundll32.exe	31
PID 2816 wrote to memory of 2556	2816	rundll32.exe	31
PID 2556 wrote to memory of 2856	2556	explorer.exe	32
PID 2556 wrote to memory of 2856	2556	explorer.exe	32
PID 2556 wrote to memory of 2856	2556	explorer.exe	32
PID 2556 wrote to memory of 2856	2556	explorer.exe	32
PID 2608 wrote to memory of 1588	2608	taskeng.exe	35
PID 2608 wrote to memory of 1588	2608	taskeng.exe	35
PID 2608 wrote to memory of 1588	2608	taskeng.exe	35
PID 2608 wrote to memory of 1588	2608	taskeng.exe	35
PID 2608 wrote to memory of 1588	2608	taskeng.exe	35
PID 1588 wrote to memory of 2532	1588	regsvr32.exe	36
PID 1588 wrote to memory of 2532	1588	regsvr32.exe	36
PID 1588 wrote to memory of 2532	1588	regsvr32.exe	36
PID 1588 wrote to memory of 2532	1588	regsvr32.exe	36
PID 1588 wrote to memory of 2532	1588	regsvr32.exe	36
PID 1588 wrote to memory of 2532	1588	regsvr32.exe	36
PID 1588 wrote to memory of 2532	1588	regsvr32.exe	36
PID 2532 wrote to memory of 2220	2532	regsvr32.exe	38
PID 2532 wrote to memory of 2220	2532	regsvr32.exe	38
PID 2532 wrote to memory of 2220	2532	regsvr32.exe	38
PID 2532 wrote to memory of 2220	2532	regsvr32.exe	38
PID 2532 wrote to memory of 2220	2532	regsvr32.exe	38
PID 2532 wrote to memory of 2220	2532	regsvr32.exe	38
PID 2220 wrote to memory of 2372	2220	explorer.exe	39
PID 2220 wrote to memory of 2372	2220	explorer.exe	39
PID 2220 wrote to memory of 2372	2220	explorer.exe	39
PID 2220 wrote to memory of 2372	2220	explorer.exe	39
PID 2220 wrote to memory of 2208	2220	explorer.exe	41
PID 2220 wrote to memory of 2208	2220	explorer.exe	41
PID 2220 wrote to memory of 2208	2220	explorer.exe	41
PID 2220 wrote to memory of 2208	2220	explorer.exe	41

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b3aaa8206bb7fe453d79379d5b6ae72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b3aaa8206bb7fe453d79379d5b6ae72.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn onunskzb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b3aaa8206bb7fe453d79379d5b6ae72.dll\"" /SC ONCE /Z /ST 12:28 /ET 12:40
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2856

C:\Windows\system32\taskeng.exe
taskeng.exe {1C01F28A-DC91-431B-8AF2-D0FDC28AF77E} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b3aaa8206bb7fe453d79379d5b6ae72.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b3aaa8206bb7fe453d79379d5b6ae72.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2220
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Puprhasywry" /d "0"
        5⤵
        Windows security bypass
        
        PID:2372
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Kbxmxczzpo" /d "0"
        5⤵
        Windows security bypass
        
        PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b3aaa8206bb7fe453d79379d5b6ae72.dll

Filesize
689KB

MD5
1b3aaa8206bb7fe453d79379d5b6ae72

SHA1
96caed40aac51f3cb119a5edeb7a8b10c8b75a15

SHA256
e60cc81f630400a2fda362feb1d54fbbb9974f73232139b0c7af38b70408b9e7

SHA512
92b642b9b7d5de9eb608ef7fd3c6b0a0df360f0edef9f3f29eff60acc89973bc499cc6b1ef6802c8086bbe5b6496e12fa60b035ea36820c1c188cf4421c25f56

Download Submit
memory/2220-28-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2220-29-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2220-27-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2532-25-0x0000000074070000-0x000000007412D000-memory.dmp

Filesize
756KB

Download
memory/2532-20-0x0000000074070000-0x000000007412D000-memory.dmp

Filesize
756KB

Download
memory/2532-21-0x0000000074070000-0x000000007412D000-memory.dmp

Filesize
756KB

Download
memory/2556-7-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2556-14-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2556-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2556-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2556-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2556-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2556-5-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2816-8-0x0000000074AC0000-0x0000000074B7D000-memory.dmp

Filesize
756KB

Download
memory/2816-0-0x0000000074AC0000-0x0000000074B7D000-memory.dmp

Filesize
756KB

Download
memory/2816-3-0x0000000074B6C000-0x0000000074B72000-memory.dmp

Filesize
24KB

Download
memory/2816-4-0x0000000074AC0000-0x0000000074B7D000-memory.dmp

Filesize
756KB

Download
memory/2816-1-0x0000000074AC0000-0x0000000074B7D000-memory.dmp

Filesize
756KB

Download