Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/04/2024, 05:42
Static task
static1
Behavioral task
behavioral1
Sample
8538019c513379a092104fa35dfd5d76_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
8538019c513379a092104fa35dfd5d76_JaffaCakes118.dll
-
Size
662KB
-
MD5
8538019c513379a092104fa35dfd5d76
-
SHA1
f524fea3b2f880359c2ed44453e5515c9f99cefe
-
SHA256
b69d373340bdd8dde8c718286c5f2bb8e1bbfc0c817f0fc7d5b1b712e4ef85ff
-
SHA512
5c3ed2a46507d7fa797a61ac54085a206dac66014a8e1b7217b134fd640f53c7d23c04e4f1f368aac27417262118dbb450bf979aa1fffa4dedd5b780b362cf1e
-
SSDEEP
12288:Nq2QnkzDxeIiGD1EWh1KFxBPuH+3AS58O7A6xIjh2gUv:NzQnkBnT5EWh1KFfuHWAS58O7AQ
Malware Config
Extracted
qakbot
402.343
tr
1632730751
95.77.223.148:443
47.22.148.6:443
89.101.97.139:443
27.223.92.142:995
120.151.47.189:443
136.232.34.70:443
120.150.218.241:995
185.250.148.74:443
181.118.183.94:443
140.82.49.12:443
67.165.206.193:993
103.148.120.144:443
71.74.12.34:443
76.25.142.196:443
73.151.236.31:443
173.21.10.71:2222
75.188.35.168:443
2.178.88.145:61202
71.80.168.245:443
45.46.53.140:2222
109.12.111.14:443
105.198.236.99:443
73.77.87.137:443
41.248.239.221:995
182.176.112.182:443
96.37.113.36:993
75.66.88.33:443
162.244.227.34:443
24.229.150.54:995
216.201.162.158:443
92.59.35.196:2222
196.218.227.241:995
24.139.72.117:443
68.207.102.78:443
72.252.201.69:443
2.188.27.77:443
177.130.82.197:2222
68.204.7.158:443
189.210.115.207:443
181.163.96.53:443
24.55.112.61:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
24.152.219.253:995
50.29.166.232:995
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1828 2040 WerFault.exe 85 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4744 wrote to memory of 2040 4744 regsvr32.exe 85 PID 4744 wrote to memory of 2040 4744 regsvr32.exe 85 PID 4744 wrote to memory of 2040 4744 regsvr32.exe 85
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8538019c513379a092104fa35dfd5d76_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\8538019c513379a092104fa35dfd5d76_JaffaCakes118.dll2⤵PID:2040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 10043⤵
- Program crash
PID:1828
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2040 -ip 20401⤵PID:1728