Analysis
-
max time kernel
131s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 14:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_24746fdccccce4b955e650760f0b1ffd_mafia_qakbot.exe
Resource
win7-20240508-en
General
-
Target
2024-05-22_24746fdccccce4b955e650760f0b1ffd_mafia_qakbot.exe
-
Size
886KB
-
MD5
24746fdccccce4b955e650760f0b1ffd
-
SHA1
fffec1f8109f52d5360dac1ee73b1ddcd9f11c45
-
SHA256
04f68ad08927b21f3ee4b7c37c3356220672ce24ac92b33cd068582ab396e884
-
SHA512
2e7bb5111277ad4a453991abc8791587915fc83b845af16379f556509ca88b30bfc38b98046087ea13dfb7c4b2a774f76ed99ee05aca04fd9cc1d50adf2e3c4d
-
SSDEEP
24576:AOf6bQl8CqETla+mf8qxh0WbS/fu0tY66Lv54SX:AOfsCBlakutbS/fuZ66L+K
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2024-05-22_24746fdccccce4b955e650760f0b1ffd_mafia_qakbot.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup.exe -
Executes dropped EXE 1 IoCs
pid Process 744 Setup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 2024-05-22_24746fdccccce4b955e650760f0b1ffd_mafia_qakbot.exe File opened (read-only) \??\VBoxMiniRdrDN Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\Setup.exe = "1" Setup.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Setup.exe = "0" Setup.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS Setup.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2276 wrote to memory of 744 2276 2024-05-22_24746fdccccce4b955e650760f0b1ffd_mafia_qakbot.exe 83 PID 2276 wrote to memory of 744 2276 2024-05-22_24746fdccccce4b955e650760f0b1ffd_mafia_qakbot.exe 83 PID 2276 wrote to memory of 744 2276 2024-05-22_24746fdccccce4b955e650760f0b1ffd_mafia_qakbot.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_24746fdccccce4b955e650760f0b1ffd_mafia_qakbot.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_24746fdccccce4b955e650760f0b1ffd_mafia_qakbot.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\a2MGB9aA76\m5LMEOz3\Setup.exe"C:\Users\Admin\AppData\Local\Temp\a2MGB9aA76\m5LMEOz3\Setup.exe" --relaunch2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies Internet Explorer settings
PID:744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
886KB
MD524746fdccccce4b955e650760f0b1ffd
SHA1fffec1f8109f52d5360dac1ee73b1ddcd9f11c45
SHA25604f68ad08927b21f3ee4b7c37c3356220672ce24ac92b33cd068582ab396e884
SHA5122e7bb5111277ad4a453991abc8791587915fc83b845af16379f556509ca88b30bfc38b98046087ea13dfb7c4b2a774f76ed99ee05aca04fd9cc1d50adf2e3c4d