Analysis
- max time kernel
149s - max time network
158s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
14/04/2026, 04:35
General
- Target 8888888.exe
- Size 1.2MB
- Sample260414-e7r9ksb18n
- SHA256 a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4
Malware Config
Extracted
-
qakbot
-
324.142
-
spx133
-
1591267427
-
49.144.84.21:443
-
189.159.133.162:995
-
173.245.152.231:443
-
77.237.181.212:995
-
207.255.161.8:2078
-
76.187.8.160:443
-
207.255.161.8:2087
-
98.219.77.197:443
-
66.222.88.126:995
-
207.255.161.8:32102
-
108.58.9.238:995
-
47.152.210.233:443
-
1.40.42.4:443
-
188.27.71.163:443
-
82.127.193.151:2222
-
104.50.141.139:995
-
67.83.54.76:2222
-
86.126.97.183:2222
-
73.94.229.115:443
-
47.35.182.97:443
Signatures
- Family: Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- Turns off Windows Defender SpyNet reporting 2 TTPs
- Windows security bypass 2 TTPs 4 IoCs
- CryptOne packer 1 IoCs
Detects CryptOne packer defined in NCC blogpost.
- Executes dropped EXE 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 10 IoCs
- Runs ping.exe 1 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 37 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8888888.exe"C:\Users\Admin\AppData\Local\Temp\8888888.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8888888.exeC:\Users\Admin\AppData\Local\Temp\8888888.exe /C2⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd\jamuusc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd\jamuusc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd\jamuusc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd\jamuusc.exe /C3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mjdrkuvzi /tr "\"C:\Users\Admin\AppData\Local\Temp\8888888.exe\" /I mjdrkuvzi" /SC ONCE /Z /ST 05:38 /ET 05:502⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\8888888.exe"C:\Users\Admin\AppData\Local\Temp\8888888.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8888888.exeC:\Users\Admin\AppData\Local\Temp\8888888.exe /C2⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd\jamuusc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd\jamuusc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd\jamuusc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd\jamuusc.exe /C3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ccgiykg /tr "\"C:\Users\Admin\AppData\Local\Temp\8888888.exe\" /I ccgiykg" /SC ONCE /Z /ST 05:38 /ET 05:502⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\8888888.exeC:\Users\Admin\AppData\Local\Temp\8888888.exe /I mjdrkuvzi1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"2⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"2⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"2⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"2⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"2⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"2⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"2⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"2⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd" /d "0"2⤵
- Windows security bypass
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd\jamuusc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd\jamuusc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd\jamuusc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd\jamuusc.exe /C3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\8888888.exe"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping.exe -n 6 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /DELETE /F /TN mjdrkuvzi2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\8888888.exeC:\Users\Admin\AppData\Local\Temp\8888888.exe /I ccgiykg1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"2⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"2⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"2⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"2⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"2⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"2⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"2⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"2⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd" /d "0"2⤵
- Windows security bypass
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd\jamuusc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd\jamuusc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd\jamuusc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Hsfrd\jamuusc.exe /C3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\8888888.exe"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping.exe -n 6 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /DELETE /F /TN ccgiykg2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
8888888.exe
jamuusc.dat
jamuusc.exe
memory/236-51-0x0000000000400000-0x000000000052D000-memory.dmp
memory/236-49-0x0000000000400000-0x000000000052D000-memory.dmp
memory/576-42-0x0000000000400000-0x000000000052D000-memory.dmp
memory/576-41-0x0000000000400000-0x000000000052D000-memory.dmp
memory/996-16-0x0000000000400000-0x000000000052D000-memory.dmp
memory/996-19-0x0000000000400000-0x000000000052D000-memory.dmp
memory/996-26-0x0000000000400000-0x000000000052D000-memory.dmp
memory/1748-29-0x0000000000400000-0x000000000052D000-memory.dmp
memory/1748-18-0x0000000000400000-0x000000000052D000-memory.dmp
memory/1748-15-0x0000000000400000-0x000000000052D000-memory.dmp
memory/1748-14-0x0000000000400000-0x000000000052D000-memory.dmp
memory/2184-36-0x00000000031A0000-0x000000000327A000-memory.dmp
memory/2184-33-0x0000000000D20000-0x0000000000D53000-memory.dmp
memory/2184-31-0x0000000000D20000-0x0000000000D53000-memory.dmp
memory/2184-30-0x0000000000D20000-0x0000000000D53000-memory.dmp
memory/2184-27-0x0000000000D20000-0x0000000000D53000-memory.dmp
memory/2496-23-0x0000000000400000-0x000000000052D000-memory.dmp
memory/2496-22-0x0000000000400000-0x000000000052D000-memory.dmp
memory/2512-62-0x0000000000400000-0x000000000052D000-memory.dmp
memory/2536-43-0x0000000000400000-0x000000000052D000-memory.dmp
memory/2536-37-0x0000000000400000-0x000000000052D000-memory.dmp
memory/2536-40-0x0000000000400000-0x000000000052D000-memory.dmp
memory/3380-59-0x0000000000400000-0x000000000052D000-memory.dmp
memory/3880-52-0x0000000000400000-0x000000000052D000-memory.dmp
memory/3880-54-0x0000000000400000-0x000000000052D000-memory.dmp
memory/4452-21-0x0000000000400000-0x000000000052D000-memory.dmp
memory/4452-20-0x0000000000400000-0x000000000052D000-memory.dmp
memory/4772-13-0x0000000000400000-0x000000000052D000-memory.dmp
memory/4772-2-0x0000000000400000-0x000000000052D000-memory.dmp
memory/4772-1-0x0000000000400000-0x000000000052D000-memory.dmp
memory/4772-0-0x000000000050B000-0x000000000050D000-memory.dmp
memory/4964-3-0x0000000000400000-0x000000000052D000-memory.dmp
memory/4964-5-0x0000000000400000-0x000000000052D000-memory.dmp