qakbot | 4eebacf9b5e2267f88df9011b3f6027116a2b765a4eb34bade925892705a9dab

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_591c417ad8fe1811a1716c513ce86500.dll
Size

572KB
MD5

591c417ad8fe1811a1716c513ce86500
SHA1

d2ce8d500ba3b56a2dd020c7d48e2a253c0993bc
SHA256

4eebacf9b5e2267f88df9011b3f6027116a2b765a4eb34bade925892705a9dab
SHA512

56c252c7d8e8d4e49b4d7731e6219fbebe91626294f59d4e1c1101145cafc8e152dcdd275add832e7e298688bde79698b0981cccce946708f7ca2a20b8a93016
SSDEEP

6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eHu:VvAfLfaEkAz5J

Score

10^/10

qakbot obama114 1634112211 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama114

Campaign

1634112211

111.125.245.116:443

124.123.42.115:2222

103.250.38.115:443

68.117.229.117:443

189.252.166.130:32101

89.137.52.44:443

208.78.220.143:443

77.31.162.93:443

83.110.201.195:443

94.200.181.154:443

103.82.211.39:995

216.201.162.158:443

78.179.137.102:995

24.231.209.2:2222

63.143.92.99:995

140.82.49.12:443

73.230.205.91:443

41.86.42.158:995

220.255.25.28:2222

200.232.214.222:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Fbywr = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Gxaswwe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
2144	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeibflmdufly	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeibflmdufly\5a769f00 = 0e491bd8a0c105a38b1877acea61a43cce9cb685a13ed097ef44c682411bc20b2cf8b66f94850d9596094d6ab7ddc09f2d95d7d4c1aed0a0626c4fd9fa91395761e79c4f5d27e47c64a2b32941034bb7a9880c17fa0264f1b1965a62cd76c50444d6482f8fb826	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeibflmdufly\253ff0f6 = 49d4bce4511df92d907be07eeda73ecf3212ff54dd4c4709f09cdd356285b65924df5fdf98038a3c611640a15a235e0a37317c31cfdf2ba3c5246984889e6dd78c1f1ceb40cd790d43f5f1961f8c0e8ea7d87f0f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeibflmdufly\e2caf865 = cf05a61c73ce74f35d582a5fa3dbe9cf5a5c045e95ce2182648563b063d7c6a219126833770832ae43ee5b48	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeibflmdufly\6fe94f4e = 6ba91f2f88aad158ef8c43c1af40489b3a418e30f4876f6eb750f3096eb15426d7b2a527bb86440b084e3b5eab7bf52d6e1005	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeibflmdufly\6fe94f4e = 6ba9082f88aae4f74bb5556e92f95d78716fe6b66c70c6dfd460297b821d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeibflmdufly\5837bf7c = f41b2b5e6ded7e2fd812cc4aa3eda2e0acb33264816c11c53e1c570581d9e7cccc7598238ebd95e3b4f01b3177d3f0ddc3542c01d7f110ce8efcdc426051df7bc310a9b4980eadc4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeibflmdufly\e08bd819 = cab35c7a951bc0cddc5003af726f5610	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeibflmdufly\9d839793 = 000ff9d34c2135fdc323568e52eab76f61e553782244e45fe3b52b98e087b4b707ff45393b44a399680f0c4f49fbfa35d059d95d0887d9b5f460406cce9aa160caddd11bcd34736a43e5c437ef4df8cec479a5bfa4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Oeibflmdufly\10a020b8 = 81cebf23523ae1a0e79053d190bd3c05bc86e305455129755014a8348aa3ef7a700ad4832780684491fbf778dd35d69e172a70ae66697436c0d9eb6c17a1d081108148e11a8e216f06e333105e01278348470d3f84b21e4aef11cebf7f	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2748	rundll32.exe
2144	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2748	rundll32.exe
2144	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2748	2736	rundll32.exe	31
PID 2736 wrote to memory of 2748	2736	rundll32.exe	31
PID 2736 wrote to memory of 2748	2736	rundll32.exe	31
PID 2736 wrote to memory of 2748	2736	rundll32.exe	31
PID 2736 wrote to memory of 2748	2736	rundll32.exe	31
PID 2736 wrote to memory of 2748	2736	rundll32.exe	31
PID 2736 wrote to memory of 2748	2736	rundll32.exe	31
PID 2748 wrote to memory of 2660	2748	rundll32.exe	32
PID 2748 wrote to memory of 2660	2748	rundll32.exe	32
PID 2748 wrote to memory of 2660	2748	rundll32.exe	32
PID 2748 wrote to memory of 2660	2748	rundll32.exe	32
PID 2748 wrote to memory of 2660	2748	rundll32.exe	32
PID 2748 wrote to memory of 2660	2748	rundll32.exe	32
PID 2660 wrote to memory of 2268	2660	explorer.exe	33
PID 2660 wrote to memory of 2268	2660	explorer.exe	33
PID 2660 wrote to memory of 2268	2660	explorer.exe	33
PID 2660 wrote to memory of 2268	2660	explorer.exe	33
PID 2008 wrote to memory of 712	2008	taskeng.exe	37
PID 2008 wrote to memory of 712	2008	taskeng.exe	37
PID 2008 wrote to memory of 712	2008	taskeng.exe	37
PID 2008 wrote to memory of 712	2008	taskeng.exe	37
PID 2008 wrote to memory of 712	2008	taskeng.exe	37
PID 712 wrote to memory of 2144	712	regsvr32.exe	38
PID 712 wrote to memory of 2144	712	regsvr32.exe	38
PID 712 wrote to memory of 2144	712	regsvr32.exe	38
PID 712 wrote to memory of 2144	712	regsvr32.exe	38
PID 712 wrote to memory of 2144	712	regsvr32.exe	38
PID 712 wrote to memory of 2144	712	regsvr32.exe	38
PID 712 wrote to memory of 2144	712	regsvr32.exe	38
PID 2144 wrote to memory of 2732	2144	regsvr32.exe	39
PID 2144 wrote to memory of 2732	2144	regsvr32.exe	39
PID 2144 wrote to memory of 2732	2144	regsvr32.exe	39
PID 2144 wrote to memory of 2732	2144	regsvr32.exe	39
PID 2144 wrote to memory of 2732	2144	regsvr32.exe	39
PID 2144 wrote to memory of 2732	2144	regsvr32.exe	39
PID 2732 wrote to memory of 1784	2732	explorer.exe	40
PID 2732 wrote to memory of 1784	2732	explorer.exe	40
PID 2732 wrote to memory of 1784	2732	explorer.exe	40
PID 2732 wrote to memory of 1784	2732	explorer.exe	40
PID 2732 wrote to memory of 1972	2732	explorer.exe	42
PID 2732 wrote to memory of 1972	2732	explorer.exe	42
PID 2732 wrote to memory of 1972	2732	explorer.exe	42
PID 2732 wrote to memory of 1972	2732	explorer.exe	42

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_591c417ad8fe1811a1716c513ce86500.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_591c417ad8fe1811a1716c513ce86500.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zgwysqta /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_591c417ad8fe1811a1716c513ce86500.dll\"" /SC ONCE /Z /ST 14:45 /ET 14:57
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2268

C:\Windows\system32\taskeng.exe
taskeng.exe {0AF2A062-BB15-4353-8A39-B49D153F478A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_591c417ad8fe1811a1716c513ce86500.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:712
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_591c417ad8fe1811a1716c513ce86500.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Fbywr" /d "0"
        5⤵
        Windows security bypass
        
        PID:1784
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Gxaswwe" /d "0"
        5⤵
        Windows security bypass
        
        PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_591c417ad8fe1811a1716c513ce86500.dll

Filesize
572KB

MD5
591c417ad8fe1811a1716c513ce86500

SHA1
d2ce8d500ba3b56a2dd020c7d48e2a253c0993bc

SHA256
4eebacf9b5e2267f88df9011b3f6027116a2b765a4eb34bade925892705a9dab

SHA512
56c252c7d8e8d4e49b4d7731e6219fbebe91626294f59d4e1c1101145cafc8e152dcdd275add832e7e298688bde79698b0981cccce946708f7ca2a20b8a93016

Download Submit
memory/2144-23-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2144-21-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2660-6-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2660-16-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2660-4-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/2660-15-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2660-12-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2660-14-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2660-13-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2732-26-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2732-27-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2732-25-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2748-8-0x0000000000230000-0x0000000000265000-memory.dmp

Filesize
212KB

Download
memory/2748-3-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/2748-2-0x0000000000230000-0x0000000000265000-memory.dmp

Filesize
212KB

Download
memory/2748-1-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2748-9-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/2748-7-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download
memory/2748-0-0x0000000010000000-0x0000000010093000-memory.dmp

Filesize
588KB

Download