qakbot | b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529

Analysis

max time kernel
133s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-01-2025 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_4f7a4448b2e7d0618b86ee1eb62469e9.dll
Size

1.6MB
MD5

4f7a4448b2e7d0618b86ee1eb62469e9
SHA1

c5854232e23a72caa5a719dfb1badb58a98cac3a
SHA256

b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529
SHA512

40ca8de592e8cb4ff50e3fd5a82dc1a6695cc137efee27883e20f560dd47ed0b59c2fdb7a5c6fe71f94088abce3c69760b17bba9f480aa3b5fac44bdba6d49fc
SSDEEP

24576:W9mB+XxJ7zUqNS8KqCx2ffNrC0O60+bPzTk1wK7TpKsV:WUBav7zbS8JCx2fftCv6JLwJ7FKsV

Score

10^/10

qakbot tr 1634541613 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

Campaign

1634541613

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Comjrb = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Aohvslv = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
108	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icaoyyxe\5f88129d = dadb281b9c20b77cc47a3c16036c51049fe8e5660fac5610755176	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icaoyyxe\6a17c2d3 = 0e3d1c45952dda58f460f84dfd533f2704f6d8687f23a3	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Icaoyyxe	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icaoyyxe\20c17d6b = 45e2c0d2aa7548244f2f962aa95288b0c0fa21d49778a3d97319dfa010da2b113380d944cb9b28f31e8e719a0b79d4f7c70802d680d6586d66cb1f71f6407d7eeca05f21a06a609da2ec636897add7af990ff5d88666f13122924c533d4af1a7b0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icaoyyxe\9a3c3a72 = 9bc4c66e8364f0b62c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icaoyyxe\987d1a0e = 2c2b1b128c17f484a38759d1dd6304a7764dd49a6a3d4ba31df53dcab973308d5aa73463c22a6c034ba2d6eceb4892a30236ccc853707401134b3de6fcf5d9d6b678b08d83d231d0daba64f0575ec0291d3f244551862513c2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icaoyyxe\155ead25 = 7417af2698bd96dbda512524294e6ffb2c5cee548999890abcd20ddfb90e2563a8d24f02d7000ddc1ab1111ec5d54650e7162340115eefd7906f32b197e76ee1311071ef114d080538ab372dccba18a824fa667d8bfaacfdc952faacb2b6fa0c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icaoyyxe\155ead25 = 7417b82698bda3f05f870705aaaab3f99171f909764a03b960ea41ad95ab37df8b2caa0c67d5c313427b9dbf1bd82663d1eb6710dbfffad9903c5a8d84d3a0d12968a78b893093b9ef511f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icaoyyxe\22805d17 = 7edc8b60c04de2b7b38f7dd1052892e9cb73a383d8da31497af1e9c1286d818dc5b487a7426756a1b7165a90f2aa77b8dc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Icaoyyxe\e73475f8 = 5a5bb6bc1cf42b1d0010ede0ac06a51b49dc0c818f19628db9d14eb990240fc65092a2070ff5e1488e9f68d12586013ca35471c90a	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2252	rundll32.exe
108	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2252	rundll32.exe
108	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2252	2236	rundll32.exe	30
PID 2236 wrote to memory of 2252	2236	rundll32.exe	30
PID 2236 wrote to memory of 2252	2236	rundll32.exe	30
PID 2236 wrote to memory of 2252	2236	rundll32.exe	30
PID 2236 wrote to memory of 2252	2236	rundll32.exe	30
PID 2236 wrote to memory of 2252	2236	rundll32.exe	30
PID 2236 wrote to memory of 2252	2236	rundll32.exe	30
PID 2252 wrote to memory of 2188	2252	rundll32.exe	32
PID 2252 wrote to memory of 2188	2252	rundll32.exe	32
PID 2252 wrote to memory of 2188	2252	rundll32.exe	32
PID 2252 wrote to memory of 2188	2252	rundll32.exe	32
PID 2252 wrote to memory of 2188	2252	rundll32.exe	32
PID 2252 wrote to memory of 2188	2252	rundll32.exe	32
PID 2188 wrote to memory of 2920	2188	explorer.exe	33
PID 2188 wrote to memory of 2920	2188	explorer.exe	33
PID 2188 wrote to memory of 2920	2188	explorer.exe	33
PID 2188 wrote to memory of 2920	2188	explorer.exe	33
PID 1184 wrote to memory of 760	1184	taskeng.exe	36
PID 1184 wrote to memory of 760	1184	taskeng.exe	36
PID 1184 wrote to memory of 760	1184	taskeng.exe	36
PID 1184 wrote to memory of 760	1184	taskeng.exe	36
PID 1184 wrote to memory of 760	1184	taskeng.exe	36
PID 760 wrote to memory of 108	760	regsvr32.exe	37
PID 760 wrote to memory of 108	760	regsvr32.exe	37
PID 760 wrote to memory of 108	760	regsvr32.exe	37
PID 760 wrote to memory of 108	760	regsvr32.exe	37
PID 760 wrote to memory of 108	760	regsvr32.exe	37
PID 760 wrote to memory of 108	760	regsvr32.exe	37
PID 760 wrote to memory of 108	760	regsvr32.exe	37
PID 108 wrote to memory of 1864	108	regsvr32.exe	38
PID 108 wrote to memory of 1864	108	regsvr32.exe	38
PID 108 wrote to memory of 1864	108	regsvr32.exe	38
PID 108 wrote to memory of 1864	108	regsvr32.exe	38
PID 108 wrote to memory of 1864	108	regsvr32.exe	38
PID 108 wrote to memory of 1864	108	regsvr32.exe	38
PID 1864 wrote to memory of 1816	1864	explorer.exe	39
PID 1864 wrote to memory of 1816	1864	explorer.exe	39
PID 1864 wrote to memory of 1816	1864	explorer.exe	39
PID 1864 wrote to memory of 1816	1864	explorer.exe	39
PID 1864 wrote to memory of 316	1864	explorer.exe	41
PID 1864 wrote to memory of 316	1864	explorer.exe	41
PID 1864 wrote to memory of 316	1864	explorer.exe	41
PID 1864 wrote to memory of 316	1864	explorer.exe	41

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f7a4448b2e7d0618b86ee1eb62469e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f7a4448b2e7d0618b86ee1eb62469e9.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lbnvplkz /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f7a4448b2e7d0618b86ee1eb62469e9.dll\"" /SC ONCE /Z /ST 05:14 /ET 05:26
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2920

C:\Windows\system32\taskeng.exe
taskeng.exe {30DB0066-4FEF-41A5-BB46-2C6E4A519506} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f7a4448b2e7d0618b86ee1eb62469e9.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f7a4448b2e7d0618b86ee1eb62469e9.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:108
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1864
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Comjrb" /d "0"
        5⤵
        Windows security bypass
        
        PID:1816
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Aohvslv" /d "0"
        5⤵
        Windows security bypass
        
        PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f7a4448b2e7d0618b86ee1eb62469e9.dll

Filesize
1.6MB

MD5
4f7a4448b2e7d0618b86ee1eb62469e9

SHA1
c5854232e23a72caa5a719dfb1badb58a98cac3a

SHA256
b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529

SHA512
40ca8de592e8cb4ff50e3fd5a82dc1a6695cc137efee27883e20f560dd47ed0b59c2fdb7a5c6fe71f94088abce3c69760b17bba9f480aa3b5fac44bdba6d49fc

Download Submit
memory/108-25-0x0000000073AB0000-0x0000000073C5B000-memory.dmp

Filesize
1.7MB

Download
memory/108-22-0x0000000073AB0000-0x0000000073C5B000-memory.dmp

Filesize
1.7MB

Download
memory/108-21-0x0000000073AB0000-0x0000000073C5B000-memory.dmp

Filesize
1.7MB

Download
memory/1864-27-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1864-30-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1864-28-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2188-5-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2188-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2188-14-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2188-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2188-16-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2188-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2188-7-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2252-9-0x0000000074360000-0x000000007450B000-memory.dmp

Filesize
1.7MB

Download
memory/2252-3-0x00000000744F0000-0x00000000744F6000-memory.dmp

Filesize
24KB

Download
memory/2252-0-0x0000000074360000-0x000000007450B000-memory.dmp

Filesize
1.7MB

Download
memory/2252-4-0x0000000074360000-0x000000007450B000-memory.dmp

Filesize
1.7MB

Download
memory/2252-1-0x0000000074360000-0x000000007450B000-memory.dmp

Filesize
1.7MB

Download