qakbot | c5148afaf55c8b27a41a5971b6e439c8076b57f84c518f31bfec4171cd112a13

Analysis

max time kernel
130s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-01-2025 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_898ba3b11fb261c893990e9a178d05ff.dll
Size

534KB
MD5

898ba3b11fb261c893990e9a178d05ff
SHA1

9db70b8ed8e080050943dd92e6a90959e77abe1e
SHA256

c5148afaf55c8b27a41a5971b6e439c8076b57f84c518f31bfec4171cd112a13
SHA512

6ec3a441202e233c7cfc563c54023a24e83b55941db46abfd12d614ba5f3fb2fcd4a79515b1b876f10de13935543f421d36bd028c4a18370d7799d266ba76bf5
SSDEEP

3072:vxAqb35qSyYNYuFwXBBWYn0WWeP24iABEabz1fz+Bnp1WC3polyaSXO3etYkpBsk:yqb35qjY7wXrNJicLfz+hqv4BtYyjD

Score

10^/10

qakbot biden54 1634802135 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden54

Campaign

1634802135

81.250.153.227:2222

120.150.218.241:995

76.25.142.196:443

63.143.92.99:995

89.101.97.139:443

136.143.11.232:443

81.213.59.22:443

136.232.34.70:443

140.82.49.12:443

37.208.181.198:61200

78.191.24.189:995

216.201.162.158:443

197.89.144.102:443

89.137.52.44:443

182.176.180.73:443

173.21.10.71:2222

117.198.156.56:443

196.207.140.40:995

103.142.10.177:443

24.231.209.2:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Uebvvjy = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Cofnnwyqa = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
2656	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Cauuqpzusjq	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cauuqpzusjq\be7e32a3 = fa95cee7b7f41b4628d41b414169291f083e7db7c3141b7320332c74aa9aedd2498754a74879f5b7644a16799f848bd645470c12752928b71f428ffe08ac1b74e1f272a79fe86a951e965c0cba4c120d93f2ba8ae3e95799236f4695f871a2b931e4831377a6b7769aa91704280496998c267c3c58670550d780071b3d2e4dadf712ff90e4a7a226d4801de7495564a8c26b86a86db81e446f65bc98dca2f9f47cb5487098c2205202a48da68d5f129a3c1163eb77b44d55ce5a1bd7f95c5f846dfbdc4c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cauuqpzusjq\bc3f12df = 3c2f585f44388cfe18f43a0d87c31e7e1c9cf4ac3de813be22b6332de1abe4f74d600c33fbc9f903d4e16bdced39e306f50ed935e2efe4e93d9a5ff8e4a8e9645ddd016385f55d9c6a6da773d8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cauuqpzusjq\48375ba = 5dcaa7980659d55350066cbe16f9ad1e1a90803c61754ed1534b7ded2f82a6ff08baf8c207367a961e35140aab8d8226ec4228a57b81772aba6d740764795feed1805977c0fc46f8570612386a08927052f8ccb1f331c710886ff3f516987ca150d9fd015306	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cauuqpzusjq\798b3a30 = a6a7bafd953ba3ad5e8312559fd620face621b3d2be621521c03f7969a62bbeb558756d197c8090140d00906c1	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cauuqpzusjq\8be1e2ed = 50e08b2e7e06768126cefd5cfae3702ee6dda1fafeeb03a05ea6633212bab877386683e910ae290fd110881511b307e30edba63863450a9192db93983e71d80a9dc7e7b60c4e8884baa1275f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cauuqpzusjq\c1375d55 = 7cab1bd33941a8997d64f31220d45c9dfa1d0f13fe122d44cf524bce71236fad7b98b18a121caf5d91914da1a36994e2e35b3308659d5f55ea5ed63a4a3432349b2811d0d1c8ff895aa8f1281f65d7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cauuqpzusjq\6c255c6 = cdf0e17c1cd7c1f991e28a950c739459a2af6c43	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cauuqpzusjq\f4a88d1b = 5ad08c0328ec2394ef76b694abda	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Cauuqpzusjq\8be1e2ed = 50e09c2e7e0643baaffebd7c5361c85605c4fcdd5f2b3ba91f50b087537f1767513c66cae44245f7e4941edde752638e83040d8ce165b70bac4bb8c3a90f75431e59f0be77a9bd8a8580fad0ee22d59be51338f911d9429024fb5762f93c62ec87	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2076	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2096	rundll32.exe
2656	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2096	rundll32.exe
2656	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2096	2316	rundll32.exe	31
PID 2316 wrote to memory of 2096	2316	rundll32.exe	31
PID 2316 wrote to memory of 2096	2316	rundll32.exe	31
PID 2316 wrote to memory of 2096	2316	rundll32.exe	31
PID 2316 wrote to memory of 2096	2316	rundll32.exe	31
PID 2316 wrote to memory of 2096	2316	rundll32.exe	31
PID 2316 wrote to memory of 2096	2316	rundll32.exe	31
PID 2096 wrote to memory of 2356	2096	rundll32.exe	32
PID 2096 wrote to memory of 2356	2096	rundll32.exe	32
PID 2096 wrote to memory of 2356	2096	rundll32.exe	32
PID 2096 wrote to memory of 2356	2096	rundll32.exe	32
PID 2096 wrote to memory of 2356	2096	rundll32.exe	32
PID 2096 wrote to memory of 2356	2096	rundll32.exe	32
PID 2356 wrote to memory of 2076	2356	explorer.exe	33
PID 2356 wrote to memory of 2076	2356	explorer.exe	33
PID 2356 wrote to memory of 2076	2356	explorer.exe	33
PID 2356 wrote to memory of 2076	2356	explorer.exe	33
PID 2016 wrote to memory of 1740	2016	taskeng.exe	36
PID 2016 wrote to memory of 1740	2016	taskeng.exe	36
PID 2016 wrote to memory of 1740	2016	taskeng.exe	36
PID 2016 wrote to memory of 1740	2016	taskeng.exe	36
PID 2016 wrote to memory of 1740	2016	taskeng.exe	36
PID 1740 wrote to memory of 2656	1740	regsvr32.exe	37
PID 1740 wrote to memory of 2656	1740	regsvr32.exe	37
PID 1740 wrote to memory of 2656	1740	regsvr32.exe	37
PID 1740 wrote to memory of 2656	1740	regsvr32.exe	37
PID 1740 wrote to memory of 2656	1740	regsvr32.exe	37
PID 1740 wrote to memory of 2656	1740	regsvr32.exe	37
PID 1740 wrote to memory of 2656	1740	regsvr32.exe	37
PID 2656 wrote to memory of 1628	2656	regsvr32.exe	38
PID 2656 wrote to memory of 1628	2656	regsvr32.exe	38
PID 2656 wrote to memory of 1628	2656	regsvr32.exe	38
PID 2656 wrote to memory of 1628	2656	regsvr32.exe	38
PID 2656 wrote to memory of 1628	2656	regsvr32.exe	38
PID 2656 wrote to memory of 1628	2656	regsvr32.exe	38
PID 1628 wrote to memory of 1244	1628	explorer.exe	39
PID 1628 wrote to memory of 1244	1628	explorer.exe	39
PID 1628 wrote to memory of 1244	1628	explorer.exe	39
PID 1628 wrote to memory of 1244	1628	explorer.exe	39
PID 1628 wrote to memory of 2284	1628	explorer.exe	41
PID 1628 wrote to memory of 2284	1628	explorer.exe	41
PID 1628 wrote to memory of 2284	1628	explorer.exe	41
PID 1628 wrote to memory of 2284	1628	explorer.exe	41

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_898ba3b11fb261c893990e9a178d05ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_898ba3b11fb261c893990e9a178d05ff.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xmzgiuw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_898ba3b11fb261c893990e9a178d05ff.dll\"" /SC ONCE /Z /ST 03:50 /ET 04:02
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2076

C:\Windows\system32\taskeng.exe
taskeng.exe {513A1688-FE93-4362-BF9B-DEA7213C6D01} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_898ba3b11fb261c893990e9a178d05ff.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_898ba3b11fb261c893990e9a178d05ff.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1628
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Uebvvjy" /d "0"
        5⤵
        Windows security bypass
        
        PID:1244
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Cofnnwyqa" /d "0"
        5⤵
        Windows security bypass
        
        PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_898ba3b11fb261c893990e9a178d05ff.dll

Filesize
534KB

MD5
898ba3b11fb261c893990e9a178d05ff

SHA1
9db70b8ed8e080050943dd92e6a90959e77abe1e

SHA256
c5148afaf55c8b27a41a5971b6e439c8076b57f84c518f31bfec4171cd112a13

SHA512
6ec3a441202e233c7cfc563c54023a24e83b55941db46abfd12d614ba5f3fb2fcd4a79515b1b876f10de13935543f421d36bd028c4a18370d7799d266ba76bf5

Download Submit
memory/1628-16-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1628-17-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1628-19-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2096-1-0x0000000010000000-0x0000000014595000-memory.dmp

Filesize
69.6MB

Download
memory/2356-0-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/2356-4-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2356-6-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2356-5-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/2656-14-0x0000000010000000-0x0000000014595000-memory.dmp

Filesize
69.6MB

Download