Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-07-2024 20:54

General

  • Target

    5906b211144bb691aba80030e1aeebc5_JaffaCakes118.dll

  • Size

    957KB

  • MD5

    5906b211144bb691aba80030e1aeebc5

  • SHA1

    1912a17b81527a4703093e95e3985780ae73f01d

  • SHA256

    0dfa8d04fff81c0abaa91bdd60203a22606be027365967383f3a75cc1fb65c96

  • SHA512

    ae16d01e5abbc1a609141ea27fc7fdc9bce8bb8e05be714ad1d30eb67c48b69f7144e44c26fa0c2c8964a2f08edc64b655dd25ac1cad2f00f3c05c329c4c7656

  • SSDEEP

    24576:ixvBJCYfTVuEw7wJarOIq0PqJtp050YjpovM:iolEJtWyYqvM

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

tr

Campaign

1613385567

C2

78.63.226.32:443

197.51.82.72:443

193.248.221.184:2222

95.77.223.148:443

71.199.192.62:443

77.211.30.202:995

80.227.5.69:443

77.27.204.204:995

81.97.154.100:443

173.184.119.153:995

38.92.225.121:443

81.150.181.168:2222

90.65.236.181:2222

83.110.103.152:443

73.153.211.227:443

188.25.63.105:443

89.137.211.239:995

202.188.138.162:443

98.173.34.212:995

87.202.87.210:2222

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\5906b211144bb691aba80030e1aeebc5_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4808
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\5906b211144bb691aba80030e1aeebc5_JaffaCakes118.dll,#1
      2⤵
        PID:1044
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 736
          3⤵
          • Program crash
          PID:232
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1044 -ip 1044
      1⤵
        PID:4264

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1044-0-0x00000000011D0000-0x00000000011D1000-memory.dmp

        Filesize

        4KB

      • memory/1044-1-0x0000000001270000-0x00000000012A3000-memory.dmp

        Filesize

        204KB

      • memory/1044-2-0x0000000003180000-0x00000000031B5000-memory.dmp

        Filesize

        212KB

      • memory/1044-4-0x0000000001270000-0x00000000012A3000-memory.dmp

        Filesize

        204KB

      • memory/1044-3-0x0000000000400000-0x00000000004F1000-memory.dmp

        Filesize

        964KB