Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-10-2024 07:56

General

  • Target

    6dcf8baea04fda87a96b3a137ea4dbfc_JaffaCakes118.dll

  • Size

    136KB

  • MD5

    6dcf8baea04fda87a96b3a137ea4dbfc

  • SHA1

    19ed57597ebb7649e76076c1531f2d665b551435

  • SHA256

    6ca1498b43435ae08ce08a4cffce0fcfe660bdd907a48eda0dc7a663f4c971a7

  • SHA512

    33e252f7a262d1c7d6fb0d1792381a9295a0d81ff9191298989f1e01de9d7d3d560804131abd1d265618b46254d2fae18e7c8e8cc6f7efcc36880571beb2b2eb

  • SSDEEP

    1536:AKQJDzynl8pck/VxhNRjJrBbQ2oTPycJFtNmQ/IOEnToIfwTToqMV29ic:jnl1kNxhN1J9c2oTzJHNfxoTBfwEVA

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1632817399

C2

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

181.118.183.94:443

120.150.218.241:995

185.250.148.74:443

95.77.223.148:443

75.66.88.33:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Windows security bypass 2 TTPs 4 IoCs
  • Loads dropped DLL 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 10 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6dcf8baea04fda87a96b3a137ea4dbfc_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\6dcf8baea04fda87a96b3a137ea4dbfc_JaffaCakes118.dll
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3660
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2468
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qjdkhbxxf /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\6dcf8baea04fda87a96b3a137ea4dbfc_JaffaCakes118.dll\"" /SC ONCE /Z /ST 07:59 /ET 08:11
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1528
  • C:\Windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\6dcf8baea04fda87a96b3a137ea4dbfc_JaffaCakes118.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\6dcf8baea04fda87a96b3a137ea4dbfc_JaffaCakes118.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:2548
        • C:\Windows\system32\reg.exe
          C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Vuhqa" /d "0"
          4⤵
          • Windows security bypass
          PID:3728
        • C:\Windows\system32\reg.exe
          C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Zfixbyjd" /d "0"
          4⤵
          • Windows security bypass
          PID:2072

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\6dcf8baea04fda87a96b3a137ea4dbfc_JaffaCakes118.dll

    Filesize

    136KB

    MD5

    6dcf8baea04fda87a96b3a137ea4dbfc

    SHA1

    19ed57597ebb7649e76076c1531f2d665b551435

    SHA256

    6ca1498b43435ae08ce08a4cffce0fcfe660bdd907a48eda0dc7a663f4c971a7

    SHA512

    33e252f7a262d1c7d6fb0d1792381a9295a0d81ff9191298989f1e01de9d7d3d560804131abd1d265618b46254d2fae18e7c8e8cc6f7efcc36880571beb2b2eb

  • memory/2468-2-0x00000000008C0000-0x00000000008E2000-memory.dmp

    Filesize

    136KB

  • memory/2468-5-0x00000000008C0000-0x00000000008E2000-memory.dmp

    Filesize

    136KB

  • memory/2468-7-0x00000000008C0000-0x00000000008E2000-memory.dmp

    Filesize

    136KB

  • memory/2468-6-0x00000000008C0000-0x00000000008E2000-memory.dmp

    Filesize

    136KB

  • memory/2468-9-0x00000000008C0000-0x00000000008E2000-memory.dmp

    Filesize

    136KB

  • memory/2548-18-0x0000000000CA0000-0x0000000000CC2000-memory.dmp

    Filesize

    136KB

  • memory/2548-19-0x0000000000CA0000-0x0000000000CC2000-memory.dmp

    Filesize

    136KB

  • memory/2548-20-0x0000000000CA0000-0x0000000000CC2000-memory.dmp

    Filesize

    136KB

  • memory/2560-14-0x0000000000650000-0x0000000000672000-memory.dmp

    Filesize

    136KB

  • memory/3660-0-0x00000000009F0000-0x0000000000A12000-memory.dmp

    Filesize

    136KB