Analysis

  • max time kernel
    138s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-08-2024 01:01

General

  • Target

    91000c46a9c5ea5c0a092a916a18d80d_JaffaCakes118.dll

  • Size

    337KB

  • MD5

    91000c46a9c5ea5c0a092a916a18d80d

  • SHA1

    e610e144a88873e4e4b4c8b734e84c65291b0b52

  • SHA256

    a7f5863eb4a34ffcb20094dc379e369e09e0196f41d6c29fdf735adabef5720b

  • SHA512

    6dcf25358a644c7e2fd0a6cdaf11189519f15b09d9f77180d17f5e65775fb0b46a378a5ff73da77b3453559be1497dc7ed93145199169b7375cb59c37c40105e

  • SSDEEP

    6144:HgOXktvhhOU35RJEesNr3wU7HuAmHKmlEwrPmRPWEpWFn2E6lyDe:VkvhhOKJETRByqTwr03pdft

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

obama04

Campaign

1613469138

C2

50.29.166.232:995

89.137.211.239:995

172.78.30.215:443

193.248.221.184:2222

80.227.5.69:443

216.201.162.158:443

75.67.192.125:443

105.96.8.96:443

77.211.30.202:995

136.232.34.70:443

87.202.87.210:2222

86.245.46.27:2222

90.101.117.122:2222

81.97.154.100:443

47.196.192.184:443

197.161.154.132:443

78.185.59.190:443

202.188.138.162:443

77.27.204.204:995

203.194.110.74:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\91000c46a9c5ea5c0a092a916a18d80d_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1440
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\91000c46a9c5ea5c0a092a916a18d80d_JaffaCakes118.dll
      2⤵
      • System Location Discovery: System Language Discovery
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:868
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:220
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn gqtrzfwl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\91000c46a9c5ea5c0a092a916a18d80d_JaffaCakes118.dll\"" /SC ONCE /Z /ST 01:03 /ET 01:15
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:404
  • C:\Windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\91000c46a9c5ea5c0a092a916a18d80d_JaffaCakes118.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:752
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\91000c46a9c5ea5c0a092a916a18d80d_JaffaCakes118.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3796
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 196
        3⤵
        • Program crash
        PID:4904
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3796 -ip 3796
    1⤵
      PID:3168

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\91000c46a9c5ea5c0a092a916a18d80d_JaffaCakes118.dll

      Filesize

      337KB

      MD5

      8893c39c0d2877535c7ecec0420ae211

      SHA1

      43c7668499c51aa8f7872c418d3b5c8c8a035cab

      SHA256

      bc14c38801949b0dcc779f4d2366c6b631ac9e2c2dcca61aca32bbe7dc923bac

      SHA512

      76910c29669a06bd358031a948f3755b3aca3c7e44efc85e3a8ac1770556a107a2dc102abfd2cb1de67f2cb2a4913216cd9bd9afd7194e76f8d17987fde57a98

    • memory/220-3-0x0000000000CA3000-0x0000000000CA4000-memory.dmp

      Filesize

      4KB

    • memory/220-5-0x0000000000BC0000-0x0000000000FF3000-memory.dmp

      Filesize

      4.2MB

    • memory/220-6-0x0000000000880000-0x00000000008B5000-memory.dmp

      Filesize

      212KB

    • memory/220-8-0x0000000000880000-0x00000000008B5000-memory.dmp

      Filesize

      212KB

    • memory/220-7-0x0000000000880000-0x00000000008B5000-memory.dmp

      Filesize

      212KB

    • memory/868-0-0x0000000010000000-0x0000000010056000-memory.dmp

      Filesize

      344KB

    • memory/868-2-0x0000000010000000-0x0000000010056000-memory.dmp

      Filesize

      344KB

    • memory/868-1-0x0000000000A50000-0x0000000000AA6000-memory.dmp

      Filesize

      344KB

    • memory/3796-13-0x0000000010000000-0x0000000010056000-memory.dmp

      Filesize

      344KB