qakbot | 0023fccc4b4a3d75236ebd303555857ae88691f9aafe2ed5d1ea3d66d6382a31

Analysis

max time kernel
131s
max time network
21s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08-01-2025 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_89b2a3f96b90720cb1df7a430845a3c4.dll
Size

534KB
MD5

89b2a3f96b90720cb1df7a430845a3c4
SHA1

c6a44201dfd1d954f2a3ec95061d2a38b3efeee6
SHA256

0023fccc4b4a3d75236ebd303555857ae88691f9aafe2ed5d1ea3d66d6382a31
SHA512

9d9a633ff4e5c0e553af7d708a4bbacd4b3d19c40515d6426d2fac997c7e3342909a7a979013957d988e249c044b825344234d910becea9d47563685332a4791
SSDEEP

3072:vxAqb35qSyYNYuFwXBBWYn0WWeP24iABEabz1fz+Bnp1WC3polyaSXO3etYkpHsk:yqb35qjY7wXrNJicLfz+hqv4BtYyxD

Score

10^/10

qakbot biden54 1634802135 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden54

Campaign

1634802135

81.250.153.227:2222

120.150.218.241:995

76.25.142.196:443

63.143.92.99:995

89.101.97.139:443

136.143.11.232:443

81.213.59.22:443

136.232.34.70:443

140.82.49.12:443

37.208.181.198:61200

78.191.24.189:995

216.201.162.158:443

197.89.144.102:443

89.137.52.44:443

182.176.180.73:443

173.21.10.71:2222

117.198.156.56:443

196.207.140.40:995

103.142.10.177:443

24.231.209.2:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Fylbltkw = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Otiuyeeppu = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
2900	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Seetglp\c0970ec9 = 86847d8d309c2c718b713ece0aee2e01e2ffdc05d9f10c37745f4b57f6bced	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Seetglp\782b69ac = 65e00dce5043c5a791adbd67f37a0201cc8cab99c93dc05c8ece6e9c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Seetglp\5232626 = 71a7cc3344c9b7508914c650541a9986ed4ebad1db99277c00736f21e80a8f8daa0aacf4104d76463b37ae8be3050d373fa5fc75157172b9e050f51a9f5e4ecf230232f6bcd7cf48bb50cfa4eb91afb3219b1717fde3d6ae9b7e78dade8c5f7a0db0dd70	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Seetglp\8800910d = 4c594ace8433dcf34490d5618585ac513b2a46d3dfb65735e6f62fa92dbe2460a8b33f0531353733ce6abe45c81b8b96930e80b5ac	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Seetglp\f749fefb = a23af7b0b0bd552abeb1f7b560d806244a2b54d8d413a4cab1b97e1c69ff1b66a1f369c8ae7b8533a8b0dc302b8caefead5645f5a3eeb50b85b1a32d9753ca8830c7d690f09f66ac5246b0fb5bcfbb27a10416fbd1a15c1b5d66aba897	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Seetglp\f749fefb = a23ae0b0b0bd6067641eee1b921c97d7e62a3af81534cd84b9a0b0ce94417cdc61b9506bee843c3f93b687853d81eef25e1939dd08517bf2a33530bc1c1d5f072ce2ab4ca329d204	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Seetglp\c2d62eb5 = ec7c3252ce643ad370ea105670f891960ed247a6dbbb9368bf827ef9626b5bc147eb73aac0e92958fa376c5b206bdc68f3313962e5a9dce445490e48738f46be09120390e2c326852ab9477969eb3bc413f04f22f3568bd75c710acfefb5b4f7f55a6e4a88d2efd563a14aeae1bacc4d996bdc03ff3dfe5f02b22d2640bfea37bbe8a6ea2bb20efdd4a2b17748cabdfe0a0e51698c71344be5954a193a56f51bbd9c08c0d507bb2d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Seetglp\7a6a49d0 = de53ef06df9906ce63397ce8e1bb00431b041be337b0fa2134f95871e9c922d3fb1f415b62ed32ea5381f963dc50a2f5c6f6baa3cd7839bd9775bd25809842ddfbdccf78c3ef8cbecd3b8a408807c20d26f506d9f4	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Seetglp	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Seetglp\bd9f4143 = 7876dc27c11740b01b0b0f8b4f3bc6c61ad322532a84e51d5dca0e3c911da68a7122f687a2de09b7ad	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2804	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1964	rundll32.exe
2900	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1964	rundll32.exe
2900	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1964	2164	rundll32.exe	29
PID 2164 wrote to memory of 1964	2164	rundll32.exe	29
PID 2164 wrote to memory of 1964	2164	rundll32.exe	29
PID 2164 wrote to memory of 1964	2164	rundll32.exe	29
PID 2164 wrote to memory of 1964	2164	rundll32.exe	29
PID 2164 wrote to memory of 1964	2164	rundll32.exe	29
PID 2164 wrote to memory of 1964	2164	rundll32.exe	29
PID 1964 wrote to memory of 2296	1964	rundll32.exe	30
PID 1964 wrote to memory of 2296	1964	rundll32.exe	30
PID 1964 wrote to memory of 2296	1964	rundll32.exe	30
PID 1964 wrote to memory of 2296	1964	rundll32.exe	30
PID 1964 wrote to memory of 2296	1964	rundll32.exe	30
PID 1964 wrote to memory of 2296	1964	rundll32.exe	30
PID 2296 wrote to memory of 2804	2296	explorer.exe	31
PID 2296 wrote to memory of 2804	2296	explorer.exe	31
PID 2296 wrote to memory of 2804	2296	explorer.exe	31
PID 2296 wrote to memory of 2804	2296	explorer.exe	31
PID 1784 wrote to memory of 2316	1784	taskeng.exe	35
PID 1784 wrote to memory of 2316	1784	taskeng.exe	35
PID 1784 wrote to memory of 2316	1784	taskeng.exe	35
PID 1784 wrote to memory of 2316	1784	taskeng.exe	35
PID 1784 wrote to memory of 2316	1784	taskeng.exe	35
PID 2316 wrote to memory of 2900	2316	regsvr32.exe	36
PID 2316 wrote to memory of 2900	2316	regsvr32.exe	36
PID 2316 wrote to memory of 2900	2316	regsvr32.exe	36
PID 2316 wrote to memory of 2900	2316	regsvr32.exe	36
PID 2316 wrote to memory of 2900	2316	regsvr32.exe	36
PID 2316 wrote to memory of 2900	2316	regsvr32.exe	36
PID 2316 wrote to memory of 2900	2316	regsvr32.exe	36
PID 2900 wrote to memory of 3008	2900	regsvr32.exe	37
PID 2900 wrote to memory of 3008	2900	regsvr32.exe	37
PID 2900 wrote to memory of 3008	2900	regsvr32.exe	37
PID 2900 wrote to memory of 3008	2900	regsvr32.exe	37
PID 2900 wrote to memory of 3008	2900	regsvr32.exe	37
PID 2900 wrote to memory of 3008	2900	regsvr32.exe	37
PID 3008 wrote to memory of 2184	3008	explorer.exe	38
PID 3008 wrote to memory of 2184	3008	explorer.exe	38
PID 3008 wrote to memory of 2184	3008	explorer.exe	38
PID 3008 wrote to memory of 2184	3008	explorer.exe	38
PID 3008 wrote to memory of 1528	3008	explorer.exe	40
PID 3008 wrote to memory of 1528	3008	explorer.exe	40
PID 3008 wrote to memory of 1528	3008	explorer.exe	40
PID 3008 wrote to memory of 1528	3008	explorer.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_89b2a3f96b90720cb1df7a430845a3c4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_89b2a3f96b90720cb1df7a430845a3c4.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hpytaatu /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_89b2a3f96b90720cb1df7a430845a3c4.dll\"" /SC ONCE /Z /ST 03:54 /ET 04:06
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2804

C:\Windows\system32\taskeng.exe
taskeng.exe {D2D76C69-AD72-476D-9703-29DD25EC92BC} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_89b2a3f96b90720cb1df7a430845a3c4.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_89b2a3f96b90720cb1df7a430845a3c4.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:3008
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Fylbltkw" /d "0"
        5⤵
        Windows security bypass
        
        PID:2184
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Otiuyeeppu" /d "0"
        5⤵
        Windows security bypass
        
        PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_89b2a3f96b90720cb1df7a430845a3c4.dll

Filesize
534KB

MD5
89b2a3f96b90720cb1df7a430845a3c4

SHA1
c6a44201dfd1d954f2a3ec95061d2a38b3efeee6

SHA256
0023fccc4b4a3d75236ebd303555857ae88691f9aafe2ed5d1ea3d66d6382a31

SHA512
9d9a633ff4e5c0e553af7d708a4bbacd4b3d19c40515d6426d2fac997c7e3342909a7a979013957d988e249c044b825344234d910becea9d47563685332a4791

Download Submit
memory/1964-1-0x0000000010000000-0x0000000014595000-memory.dmp

Filesize
69.6MB

Download
memory/2296-0-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download
memory/2296-4-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2296-6-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2296-5-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/2900-13-0x0000000010000000-0x0000000014595000-memory.dmp

Filesize
69.6MB

Download
memory/3008-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3008-17-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/3008-16-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download