qakbot | ca8a7e342ecedc4b135787dbd7057501d751d548368d25ad97f70dae1172c3a6

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-01-2025 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_cd89b03a01826aee4607a19a73f7530a.dll
Size

1.2MB
MD5

cd89b03a01826aee4607a19a73f7530a
SHA1

68d4595274b8e87d0875b6c38df8d71771ff92e4
SHA256

ca8a7e342ecedc4b135787dbd7057501d751d548368d25ad97f70dae1172c3a6
SHA512

51cc182b76d38d7895146cb77ffdee0cdfad4183c32b87c253d0f41dff550e8d2a3df717deb5c8f99ce785dedd80018dfc9c88360d622fc1c6b549fe2a31d631
SSDEEP

24576:szVwOlR/8qI8ixvTMH2AVpIP97+xgbZTekrX:szVjR/zI8ixMHzS97+xgbZTfrX

Score

10^/10

qakbot biden53 1634717752 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden53

Campaign

1634717752

103.142.10.177:443

24.152.219.253:995

181.118.183.94:443

129.208.147.188:995

24.119.214.7:443

38.70.253.226:2222

103.143.8.71:443

77.57.204.78:443

65.100.174.110:995

220.255.25.28:2222

91.178.126.51:995

37.210.155.239:995

81.241.252.59:2078

93.48.58.123:2222

65.100.174.110:443

76.25.142.196:443

24.231.209.2:2222

140.82.49.12:443

146.66.238.74:443

39.49.4.147:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Ktbztr = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Xcahjefcyl = "0"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
2884	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ueaoprqauzuwa\d1df02b5 = 5a84418840ef20ececdb356b252ca8bd7dcf26e7877207ebbe351775ee63a95768ea349c91a17ec33943d3b99310e6ef920f435f2ad06c5919941af028cc7468	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ueaoprqauzuwa\146b2a5a = 44a624862903d39186b106cc3c1b99aeadc51dbd5ed96ca7a3e0b24c88	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ueaoprqauzuwa\99489d71 = 48a1dd1d0637d1b1e1ed623cd67d19d69d49fc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ueaoprqauzuwa\e601f287 = 9686962adaab3597075813f864deef11ed4b4543b44283f4240292d54983ac797b027c261ba13da3a77331a4a8b8b38163e72bd9d622fb51942f8a8b9bec669485422b71f9846d715d9fd515aa175d32ee450822	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ueaoprqauzuwa\e601f287 = 9686812adaab0003ca8cd22d9c2f1c5b281583efd38864ced26cc970c186f7e3cbdff8df54686d353e370621536246e770a632f339d45cb70e565ee21adf8b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ueaoprqauzuwa\d39e22c9 = 0534c8402be6d8e34c2c61937dd281afaa46b78ade6d024e52833b7bff891881c0860439e456facafc6f7de4367f0ed6cd629f87d067ddee4a3ad428c15983f56a88675867a04073a5ab45d298b2d4918b69e9f2fd38c767b0bf4870739bb1284d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ueaoprqauzuwa\acd74d3f = 95245810ed071b31d25e2819a6df57140e4ab9e2c2d9a5faeb03e6d41426	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ueaoprqauzuwa\6b2245ac = 89a5592e8480d1dcd8d2d9ce950a4356c5e951d0e6f1a7290169efe79daab1b34541ef40fc2be597e9d353e3a4536f524fd2b28b671232feed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ueaoprqauzuwa	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ueaoprqauzuwa\696365d0 = 8b90238b3c549175a6564839ce349a50288b90e09739c5caf939dae37563284d9e66f2e94656fd0f1317f65236e838ece8b60938b5d3b4c9e34ad0c2787bcbe9b1216436986c676fed9c535201d823721428e1771f167937d1329cc774542b3ea4ddb5827896e12abc	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2824	rundll32.exe
2884	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2824	rundll32.exe
2884	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2824	2772	rundll32.exe	30
PID 2772 wrote to memory of 2824	2772	rundll32.exe	30
PID 2772 wrote to memory of 2824	2772	rundll32.exe	30
PID 2772 wrote to memory of 2824	2772	rundll32.exe	30
PID 2772 wrote to memory of 2824	2772	rundll32.exe	30
PID 2772 wrote to memory of 2824	2772	rundll32.exe	30
PID 2772 wrote to memory of 2824	2772	rundll32.exe	30
PID 2824 wrote to memory of 2032	2824	rundll32.exe	31
PID 2824 wrote to memory of 2032	2824	rundll32.exe	31
PID 2824 wrote to memory of 2032	2824	rundll32.exe	31
PID 2824 wrote to memory of 2032	2824	rundll32.exe	31
PID 2824 wrote to memory of 2032	2824	rundll32.exe	31
PID 2824 wrote to memory of 2032	2824	rundll32.exe	31
PID 2032 wrote to memory of 2572	2032	explorer.exe	32
PID 2032 wrote to memory of 2572	2032	explorer.exe	32
PID 2032 wrote to memory of 2572	2032	explorer.exe	32
PID 2032 wrote to memory of 2572	2032	explorer.exe	32
PID 2800 wrote to memory of 2868	2800	taskeng.exe	35
PID 2800 wrote to memory of 2868	2800	taskeng.exe	35
PID 2800 wrote to memory of 2868	2800	taskeng.exe	35
PID 2800 wrote to memory of 2868	2800	taskeng.exe	35
PID 2800 wrote to memory of 2868	2800	taskeng.exe	35
PID 2868 wrote to memory of 2884	2868	regsvr32.exe	36
PID 2868 wrote to memory of 2884	2868	regsvr32.exe	36
PID 2868 wrote to memory of 2884	2868	regsvr32.exe	36
PID 2868 wrote to memory of 2884	2868	regsvr32.exe	36
PID 2868 wrote to memory of 2884	2868	regsvr32.exe	36
PID 2868 wrote to memory of 2884	2868	regsvr32.exe	36
PID 2868 wrote to memory of 2884	2868	regsvr32.exe	36
PID 2884 wrote to memory of 2060	2884	regsvr32.exe	37
PID 2884 wrote to memory of 2060	2884	regsvr32.exe	37
PID 2884 wrote to memory of 2060	2884	regsvr32.exe	37
PID 2884 wrote to memory of 2060	2884	regsvr32.exe	37
PID 2884 wrote to memory of 2060	2884	regsvr32.exe	37
PID 2884 wrote to memory of 2060	2884	regsvr32.exe	37
PID 2060 wrote to memory of 2948	2060	explorer.exe	38
PID 2060 wrote to memory of 2948	2060	explorer.exe	38
PID 2060 wrote to memory of 2948	2060	explorer.exe	38
PID 2060 wrote to memory of 2948	2060	explorer.exe	38
PID 2060 wrote to memory of 1760	2060	explorer.exe	40
PID 2060 wrote to memory of 1760	2060	explorer.exe	40
PID 2060 wrote to memory of 1760	2060	explorer.exe	40
PID 2060 wrote to memory of 1760	2060	explorer.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd89b03a01826aee4607a19a73f7530a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd89b03a01826aee4607a19a73f7530a.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zbztaso /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd89b03a01826aee4607a19a73f7530a.dll\"" /SC ONCE /Z /ST 17:10 /ET 17:22
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2572

C:\Windows\system32\taskeng.exe
taskeng.exe {CE209C76-30CF-49BA-B765-FFED16B9D20F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd89b03a01826aee4607a19a73f7530a.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd89b03a01826aee4607a19a73f7530a.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2060
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ktbztr" /d "0"
        5⤵
        Windows security bypass
        
        PID:2948
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Xcahjefcyl" /d "0"
        5⤵
        Windows security bypass
        
        PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd89b03a01826aee4607a19a73f7530a.dll

Filesize
1.2MB

MD5
cd89b03a01826aee4607a19a73f7530a

SHA1
68d4595274b8e87d0875b6c38df8d71771ff92e4

SHA256
ca8a7e342ecedc4b135787dbd7057501d751d548368d25ad97f70dae1172c3a6

SHA512
51cc182b76d38d7895146cb77ffdee0cdfad4183c32b87c253d0f41dff550e8d2a3df717deb5c8f99ce785dedd80018dfc9c88360d622fc1c6b549fe2a31d631

Download Submit
memory/2032-13-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2032-5-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/2032-6-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2032-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2032-12-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2032-15-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2060-27-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2060-30-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2060-28-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2824-4-0x00000000749C0000-0x0000000074AFE000-memory.dmp

Filesize
1.2MB

Download
memory/2824-0-0x00000000749C0000-0x0000000074AFE000-memory.dmp

Filesize
1.2MB

Download
memory/2824-3-0x0000000074AED000-0x0000000074AF3000-memory.dmp

Filesize
24KB

Download
memory/2824-1-0x00000000749C0000-0x0000000074AFE000-memory.dmp

Filesize
1.2MB

Download
memory/2824-8-0x00000000749C0000-0x0000000074AFE000-memory.dmp

Filesize
1.2MB

Download
memory/2884-20-0x0000000073F60000-0x000000007409E000-memory.dmp

Filesize
1.2MB

Download
memory/2884-21-0x0000000073F60000-0x000000007409E000-memory.dmp

Filesize
1.2MB

Download
memory/2884-25-0x0000000073F60000-0x000000007409E000-memory.dmp

Filesize
1.2MB

Download