Analysis

  • max time kernel
    131s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 14:32

General

  • Target

    2024-05-22_24746fdccccce4b955e650760f0b1ffd_mafia_qakbot.exe

  • Size

    886KB

  • MD5

    24746fdccccce4b955e650760f0b1ffd

  • SHA1

    fffec1f8109f52d5360dac1ee73b1ddcd9f11c45

  • SHA256

    04f68ad08927b21f3ee4b7c37c3356220672ce24ac92b33cd068582ab396e884

  • SHA512

    2e7bb5111277ad4a453991abc8791587915fc83b845af16379f556509ca88b30bfc38b98046087ea13dfb7c4b2a774f76ed99ee05aca04fd9cc1d50adf2e3c4d

  • SSDEEP

    24576:AOf6bQl8CqETla+mf8qxh0WbS/fu0tY66Lv54SX:AOfsCBlakutbS/fuZ66L+K

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-22_24746fdccccce4b955e650760f0b1ffd_mafia_qakbot.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-22_24746fdccccce4b955e650760f0b1ffd_mafia_qakbot.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks for VirtualBox DLLs, possible anti-VM trick
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Users\Admin\AppData\Local\Temp\a2MGB9aA76\m5LMEOz3\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\a2MGB9aA76\m5LMEOz3\Setup.exe" --relaunch
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Executes dropped EXE
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Modifies Internet Explorer settings
      PID:744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\a2MGB9aA76\m5LMEOz3\Setup.exe

    Filesize

    886KB

    MD5

    24746fdccccce4b955e650760f0b1ffd

    SHA1

    fffec1f8109f52d5360dac1ee73b1ddcd9f11c45

    SHA256

    04f68ad08927b21f3ee4b7c37c3356220672ce24ac92b33cd068582ab396e884

    SHA512

    2e7bb5111277ad4a453991abc8791587915fc83b845af16379f556509ca88b30bfc38b98046087ea13dfb7c4b2a774f76ed99ee05aca04fd9cc1d50adf2e3c4d