Behavioral Report

General

Target

verify.dll
Size

374KB
MD5

825aa87ffbc7e0e064088c051b5fbc14
SHA1

eeee61f8e50b036ce6ad393444645c66395e719f
SHA256

cc1b453ef566a77c6fb1739e8654789214870e97ee742044c9d0ce76032b283a
SHA512

1c24da6d0c8a783b9982a12c276e090d8d9efe3188c593f847d2bdc2e047c0635770aa5dc6c904b0e03063b3b59746d7e44b28824bb056d7429baf8210ba7af2
SSDEEP

6144:XKR66t98Uah1oq7PbQIIJSLiyCE0taaRIC6w/9IuFK+20m6WdMxgYURpi92H4X:w6E1YF7P01JSdCLjqa/9iNdMxgligH8

Score

10^/10

qakbot obama223 1668757345 banker stealer trojan

Malware Config

Extracted

Family	qakbot
Version	404.30
Botnet	obama223
Campaign	1668757345
C2	68.47.128.161:443 87.65.160.87:995 172.90.139.138:2222 86.175.128.143:443 12.172.173.82:465 71.247.10.63:2083 47.41.154.250:443 91.254.215.167:443 71.31.101.183:443 81.229.117.95:2222 24.4.239.157:443 41.99.177.175:443 92.149.205.238:2222 73.230.28.7:443 47.229.96.60:443 186.188.2.193:443 174.112.25.29:2078 84.35.26.14:995 86.130.9.167:2222 116.74.163.221:443 86.195.32.149:2222 80.13.179.151:2222 64.207.237.118:443 24.206.27.39:443 170.253.25.35:443 157.231.42.190:995 170.249.59.153:443 174.101.111.4:443 23.240.47.58:995 99.229.146.120:443 184.155.91.69:443 89.129.109.27:2222 91.169.12.198:32100 87.202.101.164:50000 197.148.17.17:2078 94.63.65.146:443 69.133.162.35:443 24.64.114.59:2078 76.20.42.45:443 71.183.236.133:443 12.172.173.82:990 70.66.199.12:443 45.248.169.101:443 90.104.22.28:2222 90.89.95.158:2222 76.80.180.154:995 176.142.207.63:443 91.165.188.74:50000 72.82.136.90:443 88.126.94.4:50000 64.228.191.212:2222 12.172.173.82:21 142.161.27.232:2222 71.247.10.63:50003 108.6.249.139:443 184.176.154.83:995 174.104.184.149:443 82.34.170.37:443 47.34.30.133:443 71.247.10.63:995 70.64.77.115:443 175.205.2.54:443 92.207.132.174:2222 76.127.192.23:443 182.66.197.35:443 98.147.155.235:443 49.175.72.56:443 82.31.37.241:443 73.36.196.11:443 2.84.98.228:2222 188.54.79.88:995 184.153.132.82:443 74.66.134.24:443 172.117.139.142:995 24.64.114.59:3389 12.172.173.82:2087 78.92.133.215:443 24.64.114.59:2222 50.68.204.71:995 105.184.161.242:443 12.172.173.82:22 221.161.103.6:443 98.145.23.67:443 73.161.176.218:443 50.68.204.71:443 24.142.218.202:443 66.191.69.18:995 183.82.100.110:2222 24.49.232.96:443 70.115.104.126:995 176.151.15.101:443 93.156.103.241:443 86.217.250.15:2222 12.172.173.82:443 173.18.126.3:443 157.231.42.190:443 92.24.200.226:995 187.199.224.16:32103 213.91.235.146:443 188.4.142.139:995 199.83.165.233:443 63.248.148.87:443 58.162.223.233:443 102.159.188.241:443 12.172.173.82:50001 174.45.15.123:443 86.171.75.63:443 75.99.125.238:2222 75.158.15.211:443 79.37.204.67:443 27.110.134.202:995 12.172.173.82:993 58.247.115.126:995 181.118.183.116:443 31.167.227.31:443 2.83.62.105:443 77.126.81.208:443 174.112.25.29:2222 92.106.70.62:2222 68.47.128.161:443 87.65.160.87:995 172.90.139.138:2222 86.175.128.143:443 12.172.173.82:465 71.247.10.63:2083 47.41.154.250:443 91.254.215.167:443 71.31.101.183:443 81.229.117.95:2222 24.4.239.157:443 41.99.177.175:443 92.149.205.238:2222 73.230.28.7:443 47.229.96.60:443 186.188.2.193:443 174.112.25.29:2078 84.35.26.14:995 86.130.9.167:2222 116.74.163.221:443 86.195.32.149:2222 80.13.179.151:2222 64.207.237.118:443 24.206.27.39:443 170.253.25.35:443 157.231.42.190:995 170.249.59.153:443 174.101.111.4:443 23.240.47.58:995 99.229.146.120:443 184.155.91.69:443 89.129.109.27:2222 91.169.12.198:32100 87.202.101.164:50000 197.148.17.17:2078 94.63.65.146:443 69.133.162.35:443 24.64.114.59:2078 76.20.42.45:443 71.183.236.133:443 12.172.173.82:990 70.66.199.12:443 45.248.169.101:443 90.104.22.28:2222 90.89.95.158:2222 76.80.180.154:995 176.142.207.63:443 91.165.188.74:50000 72.82.136.90:443 88.126.94.4:50000 64.228.191.212:2222 12.172.173.82:21 142.161.27.232:2222 71.247.10.63:50003 108.6.249.139:443 184.176.154.83:995 174.104.184.149:443 82.34.170.37:443 47.34.30.133:443 71.247.10.63:995 70.64.77.115:443 175.205.2.54:443 92.207.132.174:2222 76.127.192.23:443 182.66.197.35:443 98.147.155.235:443 49.175.72.56:443 82.31.37.241:443 73.36.196.11:443 2.84.98.228:2222 188.54.79.88:995 184.153.132.82:443 74.66.134.24:443 172.117.139.142:995 24.64.114.59:3389 12.172.173.82:2087 78.92.133.215:443 24.64.114.59:2222 50.68.204.71:995 105.184.161.242:443 12.172.173.82:22 221.161.103.6:443 98.145.23.67:443 73.161.176.218:443 50.68.204.71:443 24.142.218.202:443 66.191.69.18:995 183.82.100.110:2222 24.49.232.96:443 70.115.104.126:995 176.151.15.101:443 93.156.103.241:443 86.217.250.15:2222 12.172.173.82:443 173.18.126.3:443 157.231.42.190:443 92.24.200.226:995 187.199.224.16:32103 213.91.235.146:443 188.4.142.139:995 199.83.165.233:443 63.248.148.87:443 58.162.223.233:443 102.159.188.241:443 12.172.173.82:50001 174.45.15.123:443 86.171.75.63:443 75.99.125.238:2222 75.158.15.211:443 79.37.204.67:443 27.110.134.202:995 12.172.173.82:993 58.247.115.126:995 181.118.183.116:443 31.167.227.31:443 2.83.62.105:443 77.126.81.208:443 174.112.25.29:2222 92.106.70.62:2222
Attributes	salt SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses ⋅ 64 IoCs

Processes:

regsvr32.exewermgr.exe

pid	process
2208	regsvr32.exe
2208	regsvr32.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe
4124	wermgr.exe

Suspicious behavior: MapViewOfSection ⋅ 1 IoCs

Processes:

regsvr32.exe

pid process

2208 regsvr32.exe

Suspicious use of WriteProcessMemory ⋅ 8 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4940 wrote to memory of 2208	4940	regsvr32.exe	regsvr32.exe
PID 4940 wrote to memory of 2208	4940	regsvr32.exe	regsvr32.exe
PID 4940 wrote to memory of 2208	4940	regsvr32.exe	regsvr32.exe
PID 2208 wrote to memory of 4124	2208	regsvr32.exe	wermgr.exe
PID 2208 wrote to memory of 4124	2208	regsvr32.exe	wermgr.exe
PID 2208 wrote to memory of 4124	2208	regsvr32.exe	wermgr.exe
PID 2208 wrote to memory of 4124	2208	regsvr32.exe	wermgr.exe
PID 2208 wrote to memory of 4124	2208	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\verify.dll

Suspicious use of WriteProcessMemory

PID:4940

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\verify.dll

Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory

PID:2208

C:\Windows\SysWOW64\wermgr.exe

C:\Windows\SysWOW64\wermgr.exe

Suspicious behavior: EnumeratesProcesses

PID:4124

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

memory/2208-132-0x0000000000000000-mapping.dmp

Download
memory/2208-133-0x00000000006E0000-0x000000000070E000-memory.dmp

Download
memory/2208-134-0x0000000000710000-0x000000000073A000-memory.dmp

Download
memory/2208-136-0x0000000000710000-0x000000000073A000-memory.dmp

Download
memory/4124-135-0x0000000000000000-mapping.dmp

Download
memory/4124-137-0x0000000000B80000-0x0000000000BAA000-memory.dmp

Download
memory/4124-138-0x0000000000B80000-0x0000000000BAA000-memory.dmp

Download

Analysis

Sharing