Analysis

  • max time kernel
    138s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-01-2025 01:06

General

  • Target

    JaffaCakes118_d6eb34e27a93a20912f633b61e9f01df.dll

  • Size

    1.6MB

  • MD5

    d6eb34e27a93a20912f633b61e9f01df

  • SHA1

    c0abe3bf312c87bbdd6e285e9d6efdc21330535d

  • SHA256

    04f3d30e89f9eb9bce8519ccc9bc04f907098f791d6630a9da46feae85a78edd

  • SHA512

    5ca7886162cd1b311c5f13996938e117a045e2efc069f3037ea1cc9d365369063e32d66ca210189a70b652b56240b0765261c2392f01565ae124aeaef79fc664

  • SSDEEP

    24576:c9mB+XxJ7zUqNS8KqCx2ffNrC0O60+bPzTk1wK7TpKsx:cUBav7zbS8JCx2fftCv6JLwJ7FKsx

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot family
  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Windows security bypass 2 TTPs 4 IoCs
  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 10 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d6eb34e27a93a20912f633b61e9f01df.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d6eb34e27a93a20912f633b61e9f01df.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3508
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3980
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn txpemzj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d6eb34e27a93a20912f633b61e9f01df.dll\"" /SC ONCE /Z /ST 01:08 /ET 01:20
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:4524
  • C:\Windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d6eb34e27a93a20912f633b61e9f01df.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d6eb34e27a93a20912f633b61e9f01df.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:400
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:3492
        • C:\Windows\system32\reg.exe
          C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Yuovismkiyuy" /d "0"
          4⤵
          • Windows security bypass
          PID:2508
        • C:\Windows\system32\reg.exe
          C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Oayxqeipj" /d "0"
          4⤵
          • Windows security bypass
          PID:3516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d6eb34e27a93a20912f633b61e9f01df.dll

    Filesize

    1.6MB

    MD5

    d6eb34e27a93a20912f633b61e9f01df

    SHA1

    c0abe3bf312c87bbdd6e285e9d6efdc21330535d

    SHA256

    04f3d30e89f9eb9bce8519ccc9bc04f907098f791d6630a9da46feae85a78edd

    SHA512

    5ca7886162cd1b311c5f13996938e117a045e2efc069f3037ea1cc9d365369063e32d66ca210189a70b652b56240b0765261c2392f01565ae124aeaef79fc664

  • memory/400-18-0x0000000073620000-0x00000000737CB000-memory.dmp

    Filesize

    1.7MB

  • memory/400-20-0x0000000073620000-0x00000000737CB000-memory.dmp

    Filesize

    1.7MB

  • memory/400-17-0x0000000073620000-0x00000000737CB000-memory.dmp

    Filesize

    1.7MB

  • memory/3492-24-0x0000000000C00000-0x0000000000C21000-memory.dmp

    Filesize

    132KB

  • memory/3492-23-0x0000000000C00000-0x0000000000C21000-memory.dmp

    Filesize

    132KB

  • memory/3492-22-0x0000000000C00000-0x0000000000C21000-memory.dmp

    Filesize

    132KB

  • memory/3508-0-0x0000000074DC0000-0x0000000074F6B000-memory.dmp

    Filesize

    1.7MB

  • memory/3508-2-0x0000000074DC0000-0x0000000074F6B000-memory.dmp

    Filesize

    1.7MB

  • memory/3508-3-0x0000000074DC0000-0x0000000074F6B000-memory.dmp

    Filesize

    1.7MB

  • memory/3508-1-0x0000000074F50000-0x0000000074F56000-memory.dmp

    Filesize

    24KB

  • memory/3508-6-0x0000000074DC0000-0x0000000074F6B000-memory.dmp

    Filesize

    1.7MB

  • memory/3980-5-0x0000000000240000-0x0000000000261000-memory.dmp

    Filesize

    132KB

  • memory/3980-13-0x0000000000240000-0x0000000000261000-memory.dmp

    Filesize

    132KB

  • memory/3980-10-0x0000000000240000-0x0000000000261000-memory.dmp

    Filesize

    132KB

  • memory/3980-11-0x0000000000240000-0x0000000000261000-memory.dmp

    Filesize

    132KB

  • memory/3980-9-0x0000000000240000-0x0000000000261000-memory.dmp

    Filesize

    132KB