Analysis

  • max time kernel
    140s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-07-2024 23:35

General

  • Target

    598e8766b8078fe83a5d42cf7a6ebd9e_JaffaCakes118.dll

  • Size

    398KB

  • MD5

    598e8766b8078fe83a5d42cf7a6ebd9e

  • SHA1

    3d99d254c80a15f60aa605147c61b56cf3f71940

  • SHA256

    d1cce86136bd854c77f10c82ccea0e4abf1dcd91b1daf5b460fd85c8ecee634d

  • SHA512

    980316ca71383bd041fbfcbc0b0ccb8ab6ea2b07e3561a8c37cc77eda352041198d6b21805d9edb5afbd3b327f11c37cac4480f6b02385ae92c2607d7e9e1dc5

  • SSDEEP

    6144:L9ykYklEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesN23wU7HuAmHK+v:p2wr03pdf8vhhOKJET8Byq+v

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

biden01

Campaign

1613656969

C2

172.87.157.235:3389

173.184.119.153:995

81.150.181.168:2222

71.187.170.235:443

197.45.110.165:995

86.160.137.132:443

86.236.77.68:2222

106.51.85.162:443

108.31.15.10:995

38.92.225.121:443

72.252.201.69:443

71.117.132.169:443

98.173.34.212:995

83.110.12.140:2222

95.77.223.148:443

41.39.134.183:443

85.52.72.32:2222

195.12.154.8:443

108.160.123.244:443

96.57.188.174:2222

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\598e8766b8078fe83a5d42cf7a6ebd9e_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4152
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\598e8766b8078fe83a5d42cf7a6ebd9e_JaffaCakes118.dll
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:212
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4256
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zwopprcqon /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\598e8766b8078fe83a5d42cf7a6ebd9e_JaffaCakes118.dll\"" /SC ONCE /Z /ST 23:37 /ET 23:49
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4252
  • C:\Windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\598e8766b8078fe83a5d42cf7a6ebd9e_JaffaCakes118.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\598e8766b8078fe83a5d42cf7a6ebd9e_JaffaCakes118.dll"
      2⤵
      • Loads dropped DLL
      PID:4036
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 584
        3⤵
        • Program crash
        PID:3668
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4036 -ip 4036
    1⤵
      PID:2940

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\598e8766b8078fe83a5d42cf7a6ebd9e_JaffaCakes118.dll

      Filesize

      398KB

      MD5

      e8c643e969c1ec61c857b719e24d770a

      SHA1

      8cb188734c9b30b6c34bcfee9cda70b8cd4cade5

      SHA256

      6409602391119b675dc36a319a552a1e1fe2a42e45717909219c1ab08d8cb4ad

      SHA512

      f50d7ee24d7a60735efffc72c443a6b8f7f8e34ffad0c1d13ef8558107c6996416d330982853d87bb0faf7dd63dcd613c817da6a9509d29550ff30915eca670e

    • memory/212-0-0x0000000010000000-0x0000000010064000-memory.dmp

      Filesize

      400KB

    • memory/212-1-0x0000000002650000-0x00000000026B4000-memory.dmp

      Filesize

      400KB

    • memory/212-2-0x0000000010000000-0x0000000010064000-memory.dmp

      Filesize

      400KB

    • memory/4036-13-0x0000000010000000-0x0000000010064000-memory.dmp

      Filesize

      400KB

    • memory/4256-3-0x0000000000E00000-0x0000000000E35000-memory.dmp

      Filesize

      212KB

    • memory/4256-7-0x0000000000E00000-0x0000000000E35000-memory.dmp

      Filesize

      212KB

    • memory/4256-6-0x0000000000E00000-0x0000000000E35000-memory.dmp

      Filesize

      212KB

    • memory/4256-5-0x0000000000E00000-0x0000000000E35000-memory.dmp

      Filesize

      212KB

    • memory/4256-9-0x0000000000E00000-0x0000000000E35000-memory.dmp

      Filesize

      212KB