Malware Analysis Report

2024-09-23 04:57

Sample ID 240506-y1frrahc6v
Target 1e2fab3a423ffc11c1bc916a500c9085_JaffaCakes118
SHA256 a8378d35eb92c8427a1f9505e9b12de0059a3e0463a7a465ae1665301dbf0c7c
Tags
qulab discovery ransomware spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a8378d35eb92c8427a1f9505e9b12de0059a3e0463a7a465ae1665301dbf0c7c

Threat Level: Known bad

The file 1e2fab3a423ffc11c1bc916a500c9085_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

qulab discovery ransomware spyware stealer upx

Qulab Stealer & Clipper

Reads user/profile data of web browsers

UPX packed file

Executes dropped EXE

ACProtect 1.3x - 1.4x DLL software

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Looks up external IP address via web service

Checks installed software on the system

AutoIT Executable

Drops file in System32 directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

NTFS ADS

Suspicious use of WriteProcessMemory

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-06 20:14

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-06 20:14

Reported

2024-05-06 20:17

Platform

win7-20240221-en

Max time kernel

119s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e2fab3a423ffc11c1bc916a500c9085_JaffaCakes118.exe"

Signatures

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ C:\Users\Admin\AppData\Local\Temp\1e2fab3a423ffc11c1bc916a500c9085_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1e2fab3a423ffc11c1bc916a500c9085_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1e2fab3a423ffc11c1bc916a500c9085_JaffaCakes118.exe"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-06 20:14

Reported

2024-05-06 20:17

Platform

win10v2004-20240419-en

Max time kernel

135s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e2fab3a423ffc11c1bc916a500c9085_JaffaCakes118.exe"

Signatures

Qulab Stealer & Clipper

stealer qulab

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.module.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.exe N/A
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ C:\Users\Admin\AppData\Local\Temp\1e2fab3a423ffc11c1bc916a500c9085_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e2fab3a423ffc11c1bc916a500c9085_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1e2fab3a423ffc11c1bc916a500c9085_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1e2fab3a423ffc11c1bc916a500c9085_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.module.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\ENU_801FE97C7A44B6CE9D41.7z" "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\1\*"

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 ipapi.co udp
US 104.26.8.44:443 ipapi.co tcp
US 8.8.8.8:53 x2.c.lencr.org udp
BE 23.55.97.11:80 x2.c.lencr.org tcp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 23.249.124.192.in-addr.arpa udp
US 8.8.8.8:53 44.8.26.104.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
NL 149.154.167.220:443 api.telegram.org tcp
US 204.79.197.237:443 g.bing.com tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
RU 89.191.233.38:65233 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 99.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 48.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/1960-1-0x0000000000640000-0x00000000007CD000-memory.dmp

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.sqlite3.module.dll.7

MD5 0d6b0c604f84af78305a6a77a96957fe
SHA1 73348cbd776fb032f4045b7c6e33f6996ad655d2
SHA256 039ab05913f1e60694ea48c101341a212a169c2eb24f42348459a963473c341a
SHA512 2957b4fffbb0719da90df5e58065b416cae83210e0ccf3853d34f64ec071e6ecec4f913348e20a252934c3ded187d95240726d71557b6f529cf3f61b07ed5327

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.sqlite3.module.dll

MD5 a6e1b13b0b624094e6fb3a7bedb70930
SHA1 84b58920afd8e88181c4286fa2438af81f097781
SHA256 3b266088e1eb148534a8f95610e07749f7254f29d19f6f6686a1f0c85c9241bd
SHA512 26c2dffb44b7b0c2eb6e8fde7d5c6dce118af14971552bedeb131436f53edd28da98af8cf219bb7814cf4563624638cf73c7017fc3936b5112ff9f8c43f11591

memory/1612-14-0x0000000061E00000-0x0000000061ED1000-memory.dmp

memory/1612-17-0x0000000061E00000-0x0000000061ED1000-memory.dmp

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.module.exe.7

MD5 68d956f791dd8d41bb0c35a79490b267
SHA1 f3f8458ff5db32b82b51fca5980bc2c3ccbf6bc8
SHA256 8f1df770b761d2cbde142e2d6e772cca469c1447f2e43a8962b26adf46dd44e7
SHA512 5f6197a832f1a539115dac00f8b5a2b8bc1f3829ead90e72960ccc96afd5e9a035a40175c265475242f1fcd58a98c539ff3531dc9ceeb9ac286e0defa1fab60b

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\spwmp.module.exe

MD5 9c5b4e4fcae7eb410f09c9e46ffb4a6d
SHA1 9d233bbe69676b1064f1deafba8e70a9acc00773
SHA256 0376139308f3e83a73b76d3938d9c100779a83b98eeb3b3ebacfcbd1cc027fe9
SHA512 59c35d730dc17e790aa4c89f82fd2f64b4d67405c2bdf21d4a9757fa8bfb64461f1247c9da482b310b117f1a24144bf6c612c9f7587577b7a286e2e3de724ee5

memory/4828-48-0x0000000000400000-0x000000000048E000-memory.dmp

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\1\Information.txt

MD5 48811e1e5a90fd07733952b37137ace4
SHA1 ddcf8cb3e85f5efaa1982208474575730f292627
SHA256 fc36ed536818bd2b39672f2e97b4784dad20b60218e5c64f74edfbe8a137a8d8
SHA512 99dbcc32fb5051b9da6d890312a7ebe984aeb668e9cc831d8106e9d602bd0d0ee54386ae86928e7b5d51de90c3467da5d615bc78fff345cf5fcfd3e1217ae4dc

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\1\Screen.jpg

MD5 b1aaad58f6f48d4d9673086076d5fe80
SHA1 0cba632f7e39271244adfe7cc5a112254a5cc4cb
SHA256 e69a88c17d4317305d680a1300d9f4e19eb7fa7f26aa95ccff5e3239cf48a950
SHA512 ecc7508f6b01ba6aa096ae4c3bff68d62e7c59ff588df1a3265e36da3db4019bfc481aed9b7e65f89d3b5926ccd6363df9012ac85fc81faee6e51fda9605e17a

memory/4828-53-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1612-55-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

memory/1612-56-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

memory/1612-58-0x0000000004C00000-0x0000000004C01000-memory.dmp

memory/1612-57-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\ENU_801FE97C7A44B6CE9D41.7z

MD5 8ab5293379197fe4a42f30d6743747a2
SHA1 eba893889431b6f0310ed4ae1b7a20a6b6d1d1f9
SHA256 b41a4fa964d513d8c5dc359ec35aad384368034aede073ccc849e92ea2149b5f
SHA512 b75086ff91a0310caffe247e4b6a6327c9a94a4a374c7bd57011947c5ef228946a1714fd6eae263241d87f0721e8250f20a9bebd0dcee6f83a03591059143d12