Analysis

  • max time kernel
    129s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    03-07-2024 19:16

General

  • Target

    2375a2057ad93f893797807c021eb0ca_JaffaCakes118.dll

  • Size

    398KB

  • MD5

    2375a2057ad93f893797807c021eb0ca

  • SHA1

    af5debdd1ef5b35b60bdd14da442cc4606b35ab2

  • SHA256

    7e91adf79cadbc67e1eb8fdaf2012d36ecb492bda739d2970a12f61c29e2c944

  • SHA512

    68053e28216dd966cda5d9b6117db4a0cfeffbfa26d854ba637d9650f79033888efb0374ce74f1ad28625baed9364e4343e5ad9609df3c7941e144be6bf8be79

  • SSDEEP

    6144:D9ykYklEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesN23wU7HuAmHK+P:R2wr03pdf8vhhOKJET8Byq+P

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

biden01

Campaign

1613656969

C2

172.87.157.235:3389

173.184.119.153:995

81.150.181.168:2222

71.187.170.235:443

197.45.110.165:995

86.160.137.132:443

86.236.77.68:2222

106.51.85.162:443

108.31.15.10:995

38.92.225.121:443

72.252.201.69:443

71.117.132.169:443

98.173.34.212:995

83.110.12.140:2222

95.77.223.148:443

41.39.134.183:443

85.52.72.32:2222

195.12.154.8:443

108.160.123.244:443

96.57.188.174:2222

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2375a2057ad93f893797807c021eb0ca_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\2375a2057ad93f893797807c021eb0ca_JaffaCakes118.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2020
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1340
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hytecxj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\2375a2057ad93f893797807c021eb0ca_JaffaCakes118.dll\"" /SC ONCE /Z /ST 19:18 /ET 19:30
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2240
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {66850884-DF65-4D0D-8895-D039E10FFA02} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2776
    • C:\Windows\system32\regsvr32.exe
      regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\2375a2057ad93f893797807c021eb0ca_JaffaCakes118.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Windows\SysWOW64\regsvr32.exe
        -s "C:\Users\Admin\AppData\Local\Temp\2375a2057ad93f893797807c021eb0ca_JaffaCakes118.dll"
        3⤵
        • Loads dropped DLL
        PID:612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\2375a2057ad93f893797807c021eb0ca_JaffaCakes118.dll

    Filesize

    398KB

    MD5

    5114a50d5a99ab1637df9473d6fd0336

    SHA1

    366b52bc7d627cc9abe8cf1942819579f2b86ac5

    SHA256

    751a98e45d432433ae87b56a74b80969fbf88770c8a51b3f0fb73007dab23e26

    SHA512

    1357b7c8bdd8155f0ccc7fd311ad66715b2f8da684d007d4a1c82477889818ad631d7fdd0d2660c8b47078b67a6c88cd39c060a3e2d63ae0c339a6dfcd7ed03d

  • memory/1340-3-0x00000000000C0000-0x00000000000C2000-memory.dmp

    Filesize

    8KB

  • memory/1340-5-0x0000000000080000-0x00000000000B5000-memory.dmp

    Filesize

    212KB

  • memory/1340-7-0x0000000000080000-0x00000000000B5000-memory.dmp

    Filesize

    212KB

  • memory/1340-10-0x0000000000080000-0x00000000000B5000-memory.dmp

    Filesize

    212KB

  • memory/1340-9-0x0000000000080000-0x00000000000B5000-memory.dmp

    Filesize

    212KB

  • memory/1340-8-0x0000000000080000-0x00000000000B5000-memory.dmp

    Filesize

    212KB

  • memory/1340-11-0x0000000000080000-0x00000000000B5000-memory.dmp

    Filesize

    212KB

  • memory/2020-0-0x0000000010000000-0x0000000010064000-memory.dmp

    Filesize

    400KB

  • memory/2020-1-0x0000000000820000-0x0000000000884000-memory.dmp

    Filesize

    400KB

  • memory/2020-2-0x0000000010000000-0x0000000010064000-memory.dmp

    Filesize

    400KB