Analysis

  • max time kernel
    126s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    13-08-2024 01:01

General

  • Target

    91000c46a9c5ea5c0a092a916a18d80d_JaffaCakes118.dll

  • Size

    337KB

  • MD5

    91000c46a9c5ea5c0a092a916a18d80d

  • SHA1

    e610e144a88873e4e4b4c8b734e84c65291b0b52

  • SHA256

    a7f5863eb4a34ffcb20094dc379e369e09e0196f41d6c29fdf735adabef5720b

  • SHA512

    6dcf25358a644c7e2fd0a6cdaf11189519f15b09d9f77180d17f5e65775fb0b46a378a5ff73da77b3453559be1497dc7ed93145199169b7375cb59c37c40105e

  • SSDEEP

    6144:HgOXktvhhOU35RJEesNr3wU7HuAmHKmlEwrPmRPWEpWFn2E6lyDe:VkvhhOKJETRByqTwr03pdft

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

obama04

Campaign

1613469138

C2

50.29.166.232:995

89.137.211.239:995

172.78.30.215:443

193.248.221.184:2222

80.227.5.69:443

216.201.162.158:443

75.67.192.125:443

105.96.8.96:443

77.211.30.202:995

136.232.34.70:443

87.202.87.210:2222

86.245.46.27:2222

90.101.117.122:2222

81.97.154.100:443

47.196.192.184:443

197.161.154.132:443

78.185.59.190:443

202.188.138.162:443

77.27.204.204:995

203.194.110.74:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\91000c46a9c5ea5c0a092a916a18d80d_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\91000c46a9c5ea5c0a092a916a18d80d_JaffaCakes118.dll
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2468
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ucrsbcauzc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\91000c46a9c5ea5c0a092a916a18d80d_JaffaCakes118.dll\"" /SC ONCE /Z /ST 01:03 /ET 01:15
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2780
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {2DDA0EA2-D19D-4F30-B0FD-021D9EAB9905} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Windows\system32\regsvr32.exe
      regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\91000c46a9c5ea5c0a092a916a18d80d_JaffaCakes118.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2344
      • C:\Windows\SysWOW64\regsvr32.exe
        -s "C:\Users\Admin\AppData\Local\Temp\91000c46a9c5ea5c0a092a916a18d80d_JaffaCakes118.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2404

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\91000c46a9c5ea5c0a092a916a18d80d_JaffaCakes118.dll

    Filesize

    337KB

    MD5

    8893c39c0d2877535c7ecec0420ae211

    SHA1

    43c7668499c51aa8f7872c418d3b5c8c8a035cab

    SHA256

    bc14c38801949b0dcc779f4d2366c6b631ac9e2c2dcca61aca32bbe7dc923bac

    SHA512

    76910c29669a06bd358031a948f3755b3aca3c7e44efc85e3a8ac1770556a107a2dc102abfd2cb1de67f2cb2a4913216cd9bd9afd7194e76f8d17987fde57a98

  • memory/1696-0-0x0000000010000000-0x0000000010056000-memory.dmp

    Filesize

    344KB

  • memory/1696-1-0x00000000001A0000-0x00000000001F6000-memory.dmp

    Filesize

    344KB

  • memory/1696-2-0x0000000010000000-0x0000000010056000-memory.dmp

    Filesize

    344KB

  • memory/1696-7-0x00000000001A0000-0x00000000001F6000-memory.dmp

    Filesize

    344KB

  • memory/2468-3-0x0000000000080000-0x0000000000082000-memory.dmp

    Filesize

    8KB

  • memory/2468-5-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2468-9-0x0000000000220000-0x00000000004A1000-memory.dmp

    Filesize

    2.5MB

  • memory/2468-8-0x00000000000F0000-0x0000000000125000-memory.dmp

    Filesize

    212KB

  • memory/2468-11-0x00000000000F0000-0x0000000000125000-memory.dmp

    Filesize

    212KB

  • memory/2468-10-0x00000000000F0000-0x0000000000125000-memory.dmp

    Filesize

    212KB

  • memory/2468-12-0x00000000000F0000-0x0000000000125000-memory.dmp

    Filesize

    212KB