qakbot | 615e6d39f293de56a632047eea507a7a05793285caf018e1b7fc1d6ce490bb1a

Analysis

max time kernel
148s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
06-01-2025 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_2b136149c73629d88dc48e8537ca03c5.dll
Size

1.2MB
MD5

2b136149c73629d88dc48e8537ca03c5
SHA1

06cef49494f0d239f76f5aa011b9a08db6a41578
SHA256

615e6d39f293de56a632047eea507a7a05793285caf018e1b7fc1d6ce490bb1a
SHA512

79cf5b8ef4c2601db94b033492ef8dd0a670ae94220df908a13c5f2f0f2a8d08ec4d643545388fb43ee2f5e256483453afe294bfb446ab1f48861069bade9e9d
SSDEEP

24576:m/o9iBRudBYZb/WqWletdadgndrqnq/wKkVW:YRuEbeqWYMqnFY2IW

Score

10^/10

qakbot tr 1634905513 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

Campaign

1634905513

27.5.5.31:2222

136.143.11.232:443

68.186.192.69:443

117.198.157.160:443

108.4.67.252:443

207.246.112.221:995

105.198.236.99:995

37.208.181.198:61200

115.99.227.13:995

140.82.49.12:443

188.50.34.167:995

216.201.162.158:443

103.142.10.177:443

197.89.21.241:443

73.25.109.183:2222

81.250.153.227:2222

2.222.167.138:443

78.191.24.189:995

87.242.20.233:2222

89.101.97.139:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Xdqiduu = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Fsguip = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
1636	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Cfjnoqboinmiz\39bb24e6 = e4a16a6e72fed56293a922eebb6521e33612c17f150dfbf74b90dde3f3aa2540cfeedc3c0f79036698caca9d485908d1d8956539751a5479c9b816e140eebc4ecad0d31dbefa996ece52695567dabe58e885b41603bc6fb508b389dd235fe8a67df629c7b9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Cfjnoqboinmiz\fe4e2c75 = 204ee95aab95a9355c22f22d3f2b434c4bc142503a60b9760da69573697fd7995fcb3ff6f6b86bd2882dd3131a3a17	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Cfjnoqboinmiz\c24f4a8 = ed23e4efb0705e8eafd0964183955c	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Cfjnoqboinmiz	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Cfjnoqboinmiz\44b36b6c = ec79ddcbbc03b53d6c094b9f571c4e8a838504156be903ce8b3a1827b894301f465170ff0161c2666d87e4acf61732cd31f9fd65f290675d271a52fdee2e67da61e8b804b6121bc09eb11ddcbd506d97cc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Cfjnoqboinmiz\fc0f0c09 = b11bbef355ba3b543485246aeb3fae46f3e47337d134bc8bcf2265552aed002c13b6a09e7e8487482c9fa96c52949397449da527ab80bfa1a896bcdc22e380c063860bab22371f05111046793b00981c6292a9076217	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Cfjnoqboinmiz\81074383 = e713697c374cb751a09ec1f5d823a45b6a592ef60b040ae933ed52559a83d3c53fa2bdc2e73d40f1952f8c9b204f6550	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Cfjnoqboinmiz\736d9b5e = 2c24d8d7b3229364a5383b2aa6b5b5532737a171f060fef7fe474619cba19d1f6cee452311f3d6abe85e935e9b4ad540c1280e4d5907039b9adc1d339744cfeb9b9d5c4c470f8065b05acfb1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Cfjnoqboinmiz\736d9b5e = 2c24cfd7b322a6b06afb344c8172cabc2409a33b45c9b8786c103b93de4b6578a4f5bc5629e64f25c0ded98924ff2258804083a5a49df2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Cfjnoqboinmiz\46f24b10 = 7befd3cdd8289eb2f33d6dc8848fc51717d0e2f3b59bb8b0f618a2b62ed45eb17f73d07b69b57d459e2263c80d32a62abef9083046dd9c7413cdf6233245f45eb56cc47fc5cf8a7ef60760352393db0054c57809e0de293b00e002bb7769e95175756d2bfe3345310fe910f28522ad59e18dd23798	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2408	rundll32.exe
1636	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2408	rundll32.exe
1636	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2408	1688	rundll32.exe	30
PID 1688 wrote to memory of 2408	1688	rundll32.exe	30
PID 1688 wrote to memory of 2408	1688	rundll32.exe	30
PID 1688 wrote to memory of 2408	1688	rundll32.exe	30
PID 1688 wrote to memory of 2408	1688	rundll32.exe	30
PID 1688 wrote to memory of 2408	1688	rundll32.exe	30
PID 1688 wrote to memory of 2408	1688	rundll32.exe	30
PID 2408 wrote to memory of 3040	2408	rundll32.exe	32
PID 2408 wrote to memory of 3040	2408	rundll32.exe	32
PID 2408 wrote to memory of 3040	2408	rundll32.exe	32
PID 2408 wrote to memory of 3040	2408	rundll32.exe	32
PID 2408 wrote to memory of 3040	2408	rundll32.exe	32
PID 2408 wrote to memory of 3040	2408	rundll32.exe	32
PID 3040 wrote to memory of 584	3040	explorer.exe	33
PID 3040 wrote to memory of 584	3040	explorer.exe	33
PID 3040 wrote to memory of 584	3040	explorer.exe	33
PID 3040 wrote to memory of 584	3040	explorer.exe	33
PID 2364 wrote to memory of 2020	2364	taskeng.exe	36
PID 2364 wrote to memory of 2020	2364	taskeng.exe	36
PID 2364 wrote to memory of 2020	2364	taskeng.exe	36
PID 2364 wrote to memory of 2020	2364	taskeng.exe	36
PID 2364 wrote to memory of 2020	2364	taskeng.exe	36
PID 2020 wrote to memory of 1636	2020	regsvr32.exe	37
PID 2020 wrote to memory of 1636	2020	regsvr32.exe	37
PID 2020 wrote to memory of 1636	2020	regsvr32.exe	37
PID 2020 wrote to memory of 1636	2020	regsvr32.exe	37
PID 2020 wrote to memory of 1636	2020	regsvr32.exe	37
PID 2020 wrote to memory of 1636	2020	regsvr32.exe	37
PID 2020 wrote to memory of 1636	2020	regsvr32.exe	37
PID 1636 wrote to memory of 2968	1636	regsvr32.exe	38
PID 1636 wrote to memory of 2968	1636	regsvr32.exe	38
PID 1636 wrote to memory of 2968	1636	regsvr32.exe	38
PID 1636 wrote to memory of 2968	1636	regsvr32.exe	38
PID 1636 wrote to memory of 2968	1636	regsvr32.exe	38
PID 1636 wrote to memory of 2968	1636	regsvr32.exe	38
PID 2968 wrote to memory of 612	2968	explorer.exe	39
PID 2968 wrote to memory of 612	2968	explorer.exe	39
PID 2968 wrote to memory of 612	2968	explorer.exe	39
PID 2968 wrote to memory of 612	2968	explorer.exe	39
PID 2968 wrote to memory of 2252	2968	explorer.exe	41
PID 2968 wrote to memory of 2252	2968	explorer.exe	41
PID 2968 wrote to memory of 2252	2968	explorer.exe	41
PID 2968 wrote to memory of 2252	2968	explorer.exe	41

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b136149c73629d88dc48e8537ca03c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b136149c73629d88dc48e8537ca03c5.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fzkxnrxmt /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b136149c73629d88dc48e8537ca03c5.dll\"" /SC ONCE /Z /ST 15:24 /ET 15:36
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:584

C:\Windows\system32\taskeng.exe
taskeng.exe {C841EC43-1D70-46D5-8C47-32465FDADF79} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b136149c73629d88dc48e8537ca03c5.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b136149c73629d88dc48e8537ca03c5.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Xdqiduu" /d "0"
        5⤵
        Windows security bypass
        
        PID:612
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Fsguip" /d "0"
        5⤵
        Windows security bypass
        
        PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b136149c73629d88dc48e8537ca03c5.dll

Filesize
1.2MB

MD5
2b136149c73629d88dc48e8537ca03c5

SHA1
06cef49494f0d239f76f5aa011b9a08db6a41578

SHA256
615e6d39f293de56a632047eea507a7a05793285caf018e1b7fc1d6ce490bb1a

SHA512
79cf5b8ef4c2601db94b033492ef8dd0a670ae94220df908a13c5f2f0f2a8d08ec4d643545388fb43ee2f5e256483453afe294bfb446ab1f48861069bade9e9d

Download Submit
memory/1636-20-0x0000000074440000-0x0000000074576000-memory.dmp

Filesize
1.2MB

Download
memory/1636-24-0x0000000074440000-0x0000000074576000-memory.dmp

Filesize
1.2MB

Download
memory/1636-21-0x0000000074440000-0x0000000074576000-memory.dmp

Filesize
1.2MB

Download
memory/2408-1-0x0000000074FE0000-0x0000000075116000-memory.dmp

Filesize
1.2MB

Download
memory/2408-4-0x0000000074FE0000-0x0000000075116000-memory.dmp

Filesize
1.2MB

Download
memory/2408-3-0x0000000075106000-0x000000007510C000-memory.dmp

Filesize
24KB

Download
memory/2408-0-0x0000000074FE0000-0x0000000075116000-memory.dmp

Filesize
1.2MB

Download
memory/2408-8-0x0000000074FE0000-0x0000000075116000-memory.dmp

Filesize
1.2MB

Download
memory/2968-28-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2968-27-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2968-26-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3040-5-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/3040-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3040-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3040-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3040-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3040-7-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download