Analysis

  • max time kernel
    129s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    22-07-2024 19:09

General

  • Target

    646e25e4a4aaea89c0431595b742e197_JaffaCakes118.dll

  • Size

    337KB

  • MD5

    646e25e4a4aaea89c0431595b742e197

  • SHA1

    2de2b2ed2551d451349e3c947b6cb18372ff2853

  • SHA256

    2bd9fd6b0e5a47bc10b4677e73838ed324ca07ae5cd2b67bf9fe1463a8b6113e

  • SHA512

    6404914b5cfceacccea37e44228628acda34efbd3316e635dc5b363e0d5f77e44bbb92d98ba88297211cd8311536f24b77be12b23cfb56e7760be9891b69a10d

  • SSDEEP

    6144:VgOXktvhhOU35RJEesNr3wU7HuAmHKmlEwrPmRPWEpWFn2E6lyD2:3kvhhOKJETRByqTwr03pdf1

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

obama04

Campaign

1613469138

C2

50.29.166.232:995

89.137.211.239:995

172.78.30.215:443

193.248.221.184:2222

80.227.5.69:443

216.201.162.158:443

75.67.192.125:443

105.96.8.96:443

77.211.30.202:995

136.232.34.70:443

87.202.87.210:2222

86.245.46.27:2222

90.101.117.122:2222

81.97.154.100:443

47.196.192.184:443

197.161.154.132:443

78.185.59.190:443

202.188.138.162:443

77.27.204.204:995

203.194.110.74:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\646e25e4a4aaea89c0431595b742e197_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\646e25e4a4aaea89c0431595b742e197_JaffaCakes118.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2964
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vlcssfb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\646e25e4a4aaea89c0431595b742e197_JaffaCakes118.dll\"" /SC ONCE /Z /ST 19:29 /ET 19:41
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2872
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {D6D46D2E-BAD3-4F47-9FEE-FBF1BD04BCEC} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\Windows\system32\regsvr32.exe
      regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\646e25e4a4aaea89c0431595b742e197_JaffaCakes118.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Windows\SysWOW64\regsvr32.exe
        -s "C:\Users\Admin\AppData\Local\Temp\646e25e4a4aaea89c0431595b742e197_JaffaCakes118.dll"
        3⤵
        • Loads dropped DLL
        PID:2928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\646e25e4a4aaea89c0431595b742e197_JaffaCakes118.dll

    Filesize

    337KB

    MD5

    e9bde024fb31fb840be065cc07ef7735

    SHA1

    342e7062c523f9823ef65b16c1762c0d9279fe48

    SHA256

    bd7254f876a0d9f58db71c0f5b2f06e5d22812c3775583a0e268416457a562cc

    SHA512

    3e2778483590eeb13c56c6263f83af51c8019a424b2a6a492ae1822ac4c2b510a83f05f9cabd16ed2ba1bab4a742fb023b719fc98abe704bc717b52114911ec4

  • memory/2700-0-0x0000000010000000-0x0000000010056000-memory.dmp

    Filesize

    344KB

  • memory/2700-1-0x0000000000910000-0x0000000000966000-memory.dmp

    Filesize

    344KB

  • memory/2700-2-0x0000000010000000-0x0000000010056000-memory.dmp

    Filesize

    344KB

  • memory/2964-3-0x0000000000080000-0x0000000000082000-memory.dmp

    Filesize

    8KB

  • memory/2964-5-0x0000000000950000-0x0000000000951000-memory.dmp

    Filesize

    4KB

  • memory/2964-7-0x0000000000920000-0x0000000000BA1000-memory.dmp

    Filesize

    2.5MB

  • memory/2964-8-0x00000000000F0000-0x0000000000125000-memory.dmp

    Filesize

    212KB

  • memory/2964-9-0x00000000000F0000-0x0000000000125000-memory.dmp

    Filesize

    212KB

  • memory/2964-10-0x00000000000F0000-0x0000000000125000-memory.dmp

    Filesize

    212KB