qakbot | 1a87b081250e0711d4a92c9dd271accdfcb58052cca6aa23f3fa16d0f48cfe05

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-01-2025 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_558c04ad5a274f9003c4bcbb32265e92.dll
Size

890KB
MD5

558c04ad5a274f9003c4bcbb32265e92
SHA1

842bca681ab760700cdbc94db50ac654adde6b1d
SHA256

1a87b081250e0711d4a92c9dd271accdfcb58052cca6aa23f3fa16d0f48cfe05
SHA512

976c868e0b8c9d781092bbba8cbec22e329f14d92fc66315a3e2e00ab1247345e26a903fdb92ac666300869b8ad113b0b750454b34a2d743f4da8c0c8574d168
SSDEEP

24576:uvmCkd3miQH9ZfSCFEzouViMKvb/o2ggJcWWeQRqg:uvmf3m1jSCFQKvjjXJcD9qg

Score

10^/10

qakbot biden54 1634810637 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden54

Campaign

1634810637

136.143.11.232:443

63.143.92.99:995

182.176.180.73:443

136.232.34.70:443

123.252.190.14:443

216.201.162.158:443

37.208.181.198:61200

140.82.49.12:443

197.89.144.102:443

89.137.52.44:443

109.12.111.14:443

78.191.24.189:995

105.198.236.99:995

196.207.140.40:995

41.235.69.115:443

2.222.167.138:443

117.198.156.56:443

24.231.209.2:6881

27.223.92.142:995

96.246.158.154:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Cciqu = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Perluzlb = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
1744	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azbuviyifw\df9b6307 = 3e7394303a7154cf1c4b11c3640d57f4ecf776	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azbuviyifw\52b8d42c = 40f3cbee7c755661d42bd14d35238b32347abca0bdb5accbfbd1c1868b29b0081f6eeae071ffdba016da06f521ec8b40a9c46f598acc0f3726a2584f4727ec3b7e4535edd2c91e21a861a2f8cba04503128cfd3895ceb18261e610fbb131a0fd119747b840a710c37fbe29154cff23507fa4c1e6c9f4e8ba7eb4b8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azbuviyifw\52b8d42c = 40f3dcee7c7563f370e04315c45fc5a8aef4b1f545738e172c48d1d1886b3d1f550e07314a67bc28c00f0db5dd17da5fee513fc3c3b41628820219c727b4e1462adba4b3500c119e9441d87ede26f2ac85900ef8c7c8e837ac823b66fe5683e9ba3076aa7eb7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azbuviyifw\67270462 = 979bf09f05000968a7e3dec81a60145d4d63afba58ea657cbc773ce133958574dcbe10c164733663def6f9c67b1fd0d7fd17d8d8f793d5cc8e04ae1aa6b6cd28c0be2a9914601bcb277872e3c4fda12b20ede311535d19ebb79d6a338bfb4ec077f7ed7a7c70e0269f617ab51d1f9e614363bea9d5906774a70da033ae98cc4d31e1996b4570ba9b1cc19b5eed3e46665df8c3688f81609cfcc61dd3303a58c3ca76	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azbuviyifw\6566241e = d72369e2d220e22de6f3ca6d81019a58ea3e8b5e9e4e1bf7ed5fe9362106ab	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azbuviyifw\186e6b94 = 8a2a23767ef84fd587a120fa713d8f04a0edef43a6fdd3011350ea9ffd4afabc051e12967fec71d6231113	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Azbuviyifw	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azbuviyifw\ddda437b = 00e574bcd679b58a0c0c85fbb68cd8a9f241e0234deeb1816c8553eba1cf6028	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azbuviyifw\a0d20cf1 = 9f029477adfef26f680375a6d63b89278b374fd17a75e0a51461a4f81632ee136d689b02f775901622220e9789fcf0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Azbuviyifw\2df1bbda = 299d69a23ec14dcc2c808d85f57a9cdba7648740a246a0e1b4a0ccf195669cfed143153cc42caa2aa0c073112db5f8f4de74f9b561c78465f04128	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2056	rundll32.exe
1744	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2056	rundll32.exe
1744	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2056	2376	rundll32.exe	30
PID 2376 wrote to memory of 2056	2376	rundll32.exe	30
PID 2376 wrote to memory of 2056	2376	rundll32.exe	30
PID 2376 wrote to memory of 2056	2376	rundll32.exe	30
PID 2376 wrote to memory of 2056	2376	rundll32.exe	30
PID 2376 wrote to memory of 2056	2376	rundll32.exe	30
PID 2376 wrote to memory of 2056	2376	rundll32.exe	30
PID 2056 wrote to memory of 2548	2056	rundll32.exe	32
PID 2056 wrote to memory of 2548	2056	rundll32.exe	32
PID 2056 wrote to memory of 2548	2056	rundll32.exe	32
PID 2056 wrote to memory of 2548	2056	rundll32.exe	32
PID 2056 wrote to memory of 2548	2056	rundll32.exe	32
PID 2056 wrote to memory of 2548	2056	rundll32.exe	32
PID 2548 wrote to memory of 2128	2548	explorer.exe	33
PID 2548 wrote to memory of 2128	2548	explorer.exe	33
PID 2548 wrote to memory of 2128	2548	explorer.exe	33
PID 2548 wrote to memory of 2128	2548	explorer.exe	33
PID 2896 wrote to memory of 1244	2896	taskeng.exe	36
PID 2896 wrote to memory of 1244	2896	taskeng.exe	36
PID 2896 wrote to memory of 1244	2896	taskeng.exe	36
PID 2896 wrote to memory of 1244	2896	taskeng.exe	36
PID 2896 wrote to memory of 1244	2896	taskeng.exe	36
PID 1244 wrote to memory of 1744	1244	regsvr32.exe	37
PID 1244 wrote to memory of 1744	1244	regsvr32.exe	37
PID 1244 wrote to memory of 1744	1244	regsvr32.exe	37
PID 1244 wrote to memory of 1744	1244	regsvr32.exe	37
PID 1244 wrote to memory of 1744	1244	regsvr32.exe	37
PID 1244 wrote to memory of 1744	1244	regsvr32.exe	37
PID 1244 wrote to memory of 1744	1244	regsvr32.exe	37
PID 1744 wrote to memory of 2384	1744	regsvr32.exe	38
PID 1744 wrote to memory of 2384	1744	regsvr32.exe	38
PID 1744 wrote to memory of 2384	1744	regsvr32.exe	38
PID 1744 wrote to memory of 2384	1744	regsvr32.exe	38
PID 1744 wrote to memory of 2384	1744	regsvr32.exe	38
PID 1744 wrote to memory of 2384	1744	regsvr32.exe	38
PID 2384 wrote to memory of 1980	2384	explorer.exe	39
PID 2384 wrote to memory of 1980	2384	explorer.exe	39
PID 2384 wrote to memory of 1980	2384	explorer.exe	39
PID 2384 wrote to memory of 1980	2384	explorer.exe	39
PID 2384 wrote to memory of 1164	2384	explorer.exe	41
PID 2384 wrote to memory of 1164	2384	explorer.exe	41
PID 2384 wrote to memory of 1164	2384	explorer.exe	41
PID 2384 wrote to memory of 1164	2384	explorer.exe	41

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_558c04ad5a274f9003c4bcbb32265e92.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_558c04ad5a274f9003c4bcbb32265e92.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ddaoqyhjja /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_558c04ad5a274f9003c4bcbb32265e92.dll\"" /SC ONCE /Z /ST 07:31 /ET 07:43
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2128

C:\Windows\system32\taskeng.exe
taskeng.exe {98F2C87B-EE54-4D7D-82ED-DA4234939BF0} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_558c04ad5a274f9003c4bcbb32265e92.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_558c04ad5a274f9003c4bcbb32265e92.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2384
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Cciqu" /d "0"
        5⤵
        Windows security bypass
        
        PID:1980
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Perluzlb" /d "0"
        5⤵
        Windows security bypass
        
        PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_558c04ad5a274f9003c4bcbb32265e92.dll

Filesize
890KB

MD5
558c04ad5a274f9003c4bcbb32265e92

SHA1
842bca681ab760700cdbc94db50ac654adde6b1d

SHA256
1a87b081250e0711d4a92c9dd271accdfcb58052cca6aa23f3fa16d0f48cfe05

SHA512
976c868e0b8c9d781092bbba8cbec22e329f14d92fc66315a3e2e00ab1247345e26a903fdb92ac666300869b8ad113b0b750454b34a2d743f4da8c0c8574d168

Download Submit
memory/1744-25-0x0000000074A50000-0x0000000074B43000-memory.dmp

Filesize
972KB

Download
memory/1744-20-0x0000000074A50000-0x0000000074B43000-memory.dmp

Filesize
972KB

Download
memory/1744-21-0x0000000074A50000-0x0000000074B43000-memory.dmp

Filesize
972KB

Download
memory/2056-3-0x0000000074CCF000-0x0000000074CD5000-memory.dmp

Filesize
24KB

Download
memory/2056-8-0x0000000074BF0000-0x0000000074CE3000-memory.dmp

Filesize
972KB

Download
memory/2056-0-0x0000000074BF0000-0x0000000074CE3000-memory.dmp

Filesize
972KB

Download
memory/2056-4-0x0000000074BF0000-0x0000000074CE3000-memory.dmp

Filesize
972KB

Download
memory/2056-1-0x0000000074BF0000-0x0000000074CE3000-memory.dmp

Filesize
972KB

Download
memory/2384-28-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2384-27-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2384-29-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2548-5-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/2548-15-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2548-12-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2548-13-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2548-11-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2548-7-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download