Behavioral task
behavioral1
Sample
2024-05-17_cac615b050676b964f7a791be2f92717_icedid_qakbot.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-17_cac615b050676b964f7a791be2f92717_icedid_qakbot.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-17_cac615b050676b964f7a791be2f92717_icedid_qakbot
-
Size
1.8MB
-
MD5
cac615b050676b964f7a791be2f92717
-
SHA1
0c3ba4442ef450f97dd491e7d0134a80812068bd
-
SHA256
0d8d998ff0bd5ff2d06dce7c5df3359f4d16b3167e384d64e211b6ef0dceb010
-
SHA512
23f2bc7cf100cbfa361bf8b874570088abd66d2bcb1023558b950ec13af326a9115e63c4907cc93f00bf4f494f2cb25149e1be10c04b316cec5c66235f6468ad
-
SSDEEP
24576:NuD8FskK5ru+djKAjCTdleKWoy/5BJu7JgwSNgsN8VpfApKYeirR3PinTwF:wDrXj/CGh5ceqVpYoYeiV3PinT
Malware Config
Signatures
-
Detect Lumma Stealer payload V4 1 IoCs
resource yara_rule sample family_lumma_v4 -
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-17_cac615b050676b964f7a791be2f92717_icedid_qakbot
Files
-
2024-05-17_cac615b050676b964f7a791be2f92717_icedid_qakbot.exe windows:4 windows x86 arch:x86
549c6ec01be54ce84196eaa33e113375
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
i2e_ciio
I2E_SaveAsJPG
I2E_FreeImage
I2EIO_Destroy
I2E_LoadImage
I2EIO_Create
i2e_cint
I2E_AddImage
I2E_EndOrder
I2E_ProcessImage
I2E_UMSharpen
I2E_Exit
I2E_Destroy
I2E_Create
I2E_Initialize
I2E_SetProcessing
I2E_SetParameters
I2E_StartOrder
kernel32
UnhandledExceptionFilter
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
IsBadWritePtr
GetStringTypeA
GetStringTypeW
SetHandleCount
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
IsBadReadPtr
IsBadCodePtr
SetEnvironmentVariableA
GetDateFormatA
SetUnhandledExceptionFilter
GetFileType
SetStdHandle
HeapSize
GetStartupInfoA
HeapReAlloc
TerminateProcess
ExitProcess
VirtualQuery
GetSystemInfo
GetEnvironmentStringsW
VirtualProtect
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
SizeofResource
LockResource
LoadResource
FindResourceA
InitializeCriticalSection
DeleteCriticalSection
WideCharToMultiByte
Sleep
LeaveCriticalSection
EnterCriticalSection
GlobalUnlock
GlobalLock
GlobalFree
CloseHandle
ResetEvent
SetFileAttributesA
FindClose
FindNextFileA
FindFirstFileA
CreateEventA
SetEvent
SetLastError
GetLastError
GlobalSize
GlobalAlloc
GlobalReAlloc
GetTimeFormatA
GetSystemTimeAsFileTime
CreateThread
ExitThread
RtlUnwind
SetErrorMode
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileTime
SetFileTime
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcmpA
LocalAlloc
GetCurrentProcess
DuplicateHandle
UnlockFile
LockFile
FlushFileBuffers
GetPrivateProfileStringA
GetPrivateProfileIntA
RaiseException
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcatA
lstrcmpW
MulDiv
lstrcpynA
GetTimeZoneInformation
Beep
GetLocalTime
GetFullPathNameA
FileTimeToLocalFileTime
FileTimeToSystemTime
WaitForMultipleObjects
VirtualFree
VirtualAlloc
WaitForSingleObject
SetThreadPriority
ResumeThread
DeviceIoControl
LoadLibraryA
FreeLibrary
GetStringTypeExA
CompareStringW
CompareStringA
lstrcmpiA
GetVersion
GetShortPathNameA
WritePrivateProfileStringA
HeapFree
HeapAlloc
SetFilePointer
SetEndOfFile
ReadFile
RemoveDirectoryA
GetModuleFileNameA
MoveFileA
LocalFree
GetFileSize
GetSystemDirectoryA
GetWindowsDirectoryA
FormatMessageA
CopyFileA
WriteFile
GetCommandLineA
GetCurrentDirectoryA
SetCurrentDirectoryA
CreateProcessA
GetExitCodeProcess
lstrcpyA
MultiByteToWideChar
GetTickCount
GetLogicalDrives
GetDriveTypeA
CreateFileA
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
GetDiskFreeSpaceA
GetTempPathA
GetTempFileNameA
DeleteFileA
GetFileAttributesA
CreateDirectoryA
lstrlenA
InterlockedDecrement
InterlockedIncrement
user32
IsZoomed
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
GetMessageA
TranslateMessage
ValidateRect
PostQuitMessage
SetCursorPos
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsA
InsertMenuItemA
SetRectEmpty
BringWindowToTop
SetMenu
TranslateAcceleratorA
SetRect
GetDesktopWindow
CreateDialogIndirectParamA
EndDialog
GetCursorPos
SetWindowRgn
DrawIcon
IsRectEmpty
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
IsChild
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
ScrollWindow
GetKeyState
SetScrollRange
GetSysColorBrush
SetScrollPos
GetScrollPos
ShowScrollBar
IsWindowVisible
GetMenu
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
GetClassInfoA
RegisterClassA
GetDlgCtrlID
SetWindowPos
IntersectRect
GetWindowPlacement
PtInRect
GetWindow
EndPaint
BeginPaint
GetWindowDC
UnhookWindowsHookEx
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
PostMessageA
GetClientRect
InvalidateRect
SetTimer
KillTimer
GetParent
EnableWindow
LoadImageA
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
SendMessageA
GetDC
InsertMenuA
GetMenuItemCount
RemoveMenu
CharUpperA
CreatePopupMenu
TrackPopupMenu
EmptyClipboard
CloseClipboard
OpenClipboard
IsWindow
ReleaseCapture
SetCapture
SetParent
CopyAcceleratorTableA
CreateMenu
PostThreadMessageA
GetTabbedTextExtentA
CharNextA
DeleteMenu
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
ScreenToClient
EnableMenuItem
CheckMenuItem
SystemParametersInfoA
IsClipboardFormatAvailable
ModifyMenuA
DefWindowProcA
LoadIconA
UnregisterClassA
SetForegroundWindow
GetLastActivePopup
FindWindowA
IsIconic
UpdateWindow
wsprintfA
GetSystemMetrics
RedrawWindow
MessageBoxA
GetDCEx
LockWindowUpdate
RegisterClipboardFormatA
GetScrollRange
ReleaseDC
LoadCursorA
SetCursor
CallWindowProcA
SetWindowLongA
GetWindowLongA
CopyRect
LoadBitmapA
FillRect
GetFocus
DestroyIcon
DrawStateA
GetIconInfo
InflateRect
OffsetRect
FrameRect
DrawFocusRect
GetWindowRect
ClientToScreen
GetActiveWindow
GetNextDlgTabItem
WindowFromPoint
DestroyMenu
DestroyCursor
TrackPopupMenuEx
GetSubMenu
GetSysColor
LoadMenuA
SendDlgItemMessageA
GetMenuItemInfoA
gdi32
SetBkColor
SelectObject
CreateBitmap
SetPixel
GetPixel
GetDIBits
CreateDIBSection
PatBlt
SelectPalette
RealizePalette
StartPage
EndPage
EndDoc
CreateDIBitmap
SetStretchBltMode
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
SetBkMode
CombineRgn
CreateRectRgn
SetWinMetaFileBits
DeleteEnhMetaFile
GetEnhMetaFileHeader
SetEnhMetaFileBits
PlayEnhMetaFile
CreatePalette
GetEnhMetaFilePaletteEntries
CreateDCA
SaveDC
RestoreDC
SetPolyFillMode
SetROP2
SetMapMode
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
SetTextColor
SelectClipRgn
StartDocA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
CreatePatternBrush
CreateEllipticRgn
Ellipse
SetRectRgn
GetViewportOrgEx
SetAbortProc
AbortDoc
GetTextMetricsA
GetCharWidthA
CreateFontA
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextColor
GetTextAlign
GetTextFaceA
GetWindowOrgEx
GetRgnBox
DeleteDC
GetStockObject
StretchBlt
GetObjectA
StretchDIBits
GetDeviceCaps
GetTextExtentPoint32A
CreateFontIndirectA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
BitBlt
RoundRect
LPtoDP
DPtoLP
GetWindowExtEx
GetViewportExtEx
GetMapMode
GetBkColor
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
Rectangle
CreatePen
CreateSolidBrush
comdlg32
GetOpenFileNameA
PrintDlgA
GetSaveFileNameA
CommDlgExtendedError
GetFileTitleA
winspool.drv
ClosePrinter
OpenPrinterA
GetJobA
DocumentPropertiesA
advapi32
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegSetValueA
RegOpenKeyA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
SetFileSecurityA
GetFileSecurityA
RegCreateKeyA
RegSetValueExA
shell32
SHChangeNotify
ShellExecuteA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHGetDesktopFolder
ExtractIconA
DragQueryFileA
DragFinish
ShellExecuteExA
SHGetFileInfoA
SHBrowseForFolderA
ExtractAssociatedIconA
comctl32
ImageList_ReplaceIcon
_TrackMouseEvent
ImageList_GetIcon
ImageList_SetBkColor
ImageList_SetImageCount
ord17
ImageList_Create
ImageList_Draw
ImageList_GetImageInfo
ImageList_AddMasked
ImageList_Destroy
shlwapi
PathStripToRootA
PathIsUNCA
UrlUnescapeA
PathFindFileNameA
SHDeleteKeyA
PathFindExtensionA
oledlg
ord8
ole32
CLSIDFromProgID
CoTaskMemAlloc
CLSIDFromString
CoTaskMemFree
CoInitialize
CoCreateInstance
OleRun
OleTranslateAccelerator
IsAccelerator
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
CoGetClassObject
StgOpenStorageOnILockBytes
CoRevokeClassObject
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
oleaut32
SysAllocString
SysFreeString
DispGetParam
VariantInit
SysAllocStringByteLen
SysStringByteLen
VariantClear
VariantChangeType
SysAllocStringLen
SysStringLen
VariantCopy
SafeArrayDestroy
SystemTimeToVariantTime
OleCreateFontIndirect
GetErrorInfo
wininet
HttpOpenRequestA
InternetConnectA
HttpSendRequestExA
HttpEndRequestA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
HttpQueryInfoA
HttpAddRequestHeadersA
InternetQueryDataAvailable
InternetCanonicalizeUrlA
InternetCrackUrlA
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 404KB - Virtual size: 402KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ