qakbot | 27c936686f3330bc4d6cd52dbe5cae90da5bb88a9883313afce91a908752bf4b

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
02/01/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_3eaad1092176c93967e82ca25d327951.dll
Size 484KB
Sample260102-ldw41aem6x
SHA256 27c936686f3330bc4d6cd52dbe5cae90da5bb88a9883313afce91a908752bf4b
MD5 3eaad1092176c93967e82ca25d327951
SHA1 9c2ef11271a88f41a62d230c565412e9c2f3eac7
SHA512 bde2c41405101048b352e566cef608d14f497d790ffc7520a28474f79707231a95b2b749579ded5dc8680726d8b1afeb1f761e90167a993a9ae5ab34525214f5
SSDEEP 6144:hbqzVbbUYjG8AClk8+n05KhoSiMsJZuSsnDxeHakVqhhmaM+5Vg0nKH5PnFyunZY:BqxgYjG8ACv+0KhpsJZRXH52LMcg5nO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

banker obama103 1632477754 discovery execution qakbot persistence stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

obama103

Campaign

1632477754

136.232.34.70:443
216.201.162.158:443
92.59.35.196:2222
105.198.236.99:443
185.250.148.74:443
73.77.87.137:443
196.218.227.241:995
103.148.120.144:443
120.150.218.241:995
47.22.148.6:443
140.82.49.12:443
71.74.12.34:443
27.223.92.142:995
76.25.142.196:443
95.77.223.148:443
75.188.35.168:443
96.37.113.36:993
173.21.10.71:2222
45.46.53.140:2222
73.151.236.31:443
181.163.96.53:443
189.210.115.207:443
72.252.201.69:443
89.101.97.139:443
109.12.111.14:443
24.55.112.61:443
24.139.72.117:443
24.229.150.54:995
67.165.206.193:993
75.107.26.196:465
68.204.7.158:443
185.250.148.74:2222
68.186.192.69:443
24.152.219.253:995
50.29.166.232:995
75.67.192.125:443
24.95.61.62:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Loads dropped DLL 1 IoCs

pid	Process
3424	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4896	rundll32.exe
4896	rundll32.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4896	rundll32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 4896	4792	rundll32.exe	77
PID 4896 wrote to memory of 4432	4896	rundll32.exe	78
PID 4896 wrote to memory of 4432	4896	rundll32.exe	78
PID 4432 wrote to memory of 2740	4432	explorer.exe	79
PID 2912 wrote to memory of 3424	2912	regsvr32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3eaad1092176c93967e82ca25d327951.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3eaad1092176c93967e82ca25d327951.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ekrjcrzq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3eaad1092176c93967e82ca25d327951.dll\"" /SC ONCE /Z /ST 09:40 /ET 09:52
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2740

C:\Windows\system32\regsvr32.exe
regsvr32.exe
1⤵
PID:2020

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3eaad1092176c93967e82ca25d327951.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3eaad1092176c93967e82ca25d327951.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JaffaCakes118_3eaad1092176c93967e82ca25d327951.dll

Path C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3eaad1092176c93967e82ca25d327951.dll
Size 484KB
SHA256 27c936686f3330bc4d6cd52dbe5cae90da5bb88a9883313afce91a908752bf4b
MD5 3eaad1092176c93967e82ca25d327951
SHA1 9c2ef11271a88f41a62d230c565412e9c2f3eac7
SHA512 bde2c41405101048b352e566cef608d14f497d790ffc7520a28474f79707231a95b2b749579ded5dc8680726d8b1afeb1f761e90167a993a9ae5ab34525214f5
SSDEEP 6144:hbqzVbbUYjG8AClk8+n05KhoSiMsJZuSsnDxeHakVqhhmaM+5Vg0nKH5PnFyunZY:BqxgYjG8ACv+0KhpsJZRXH52LMcg5nO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4432-5-0x0000000000360000-0x0000000000381000-memory.dmp

Download

memory/4432-9-0x0000000000360000-0x0000000000381000-memory.dmp

Download

memory/4432-11-0x0000000000360000-0x0000000000381000-memory.dmp

Download

memory/4432-10-0x0000000000360000-0x0000000000381000-memory.dmp

Download

memory/4432-12-0x0000000000360000-0x0000000000381000-memory.dmp

Download

memory/4432-13-0x0000000000360000-0x0000000000381000-memory.dmp

Download

memory/4896-0-0x0000000010000000-0x0000000010119000-memory.dmp

Download

memory/4896-2-0x0000000010000000-0x0000000010119000-memory.dmp

Download

memory/4896-1-0x0000000010077000-0x000000001007D000-memory.dmp

Download

memory/4896-3-0x0000000010000000-0x0000000010119000-memory.dmp

Download

memory/4896-6-0x0000000010000000-0x0000000010119000-memory.dmp

Download