qakbot | d4f7a0b2f29812223444cbce4684c12891962616708bbcc7a684a0efa510bdb4

Resubmissions

23/05/2024, 04:24

240523-e1jzmadg7710

23/05/2024, 04:18

240523-ew76nadf2w10

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vegetated.dll
Size 354KB
Sample240523-e1jzmadg77
SHA256 d4f7a0b2f29812223444cbce4684c12891962616708bbcc7a684a0efa510bdb4
MD5 95b1ae44716fb74b3ce589d7e1b53c3a
SHA1 d322925f126c486cd2b5112057e4dd3e9692b7be
SHA512 dcd2aa426895a12e0e0a40a8e034c4b72161b8c929efae1d296ca29307e906c4a8df309b6ddbc234f3f63e0ac288641a3214895646d9d5c98ac9e69f1c5dd3d2
SSDEEP 6144:ENsacLpop/C9lIbtBMHkqmO+pefWoAw6hjSy/AACs98K/f+ZuDXKK8bTcTCaULa4:gs/tMrbQHt+ps4w6RcA3/2oXmbTdaUe4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot obama220 1667373670 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.14

Botnet

obama220

Campaign

1667373670

174.0.224.214:443
70.60.142.214:2222
136.232.184.134:995
67.87.214.7:443
174.104.184.149:443
64.207.237.118:443
144.202.15.58:443
74.33.84.227:443
175.205.2.54:443
174.77.209.5:443
45.49.137.80:443
74.92.243.113:995
76.68.34.167:2222
49.175.72.56:443
190.24.45.24:995
50.68.204.71:443
179.100.109.130:32101
70.64.77.115:443
109.151.171.116:2222
91.138.17.202:443
182.66.197.35:443
193.3.19.137:443
41.44.11.227:995
154.247.31.51:993
50.68.204.71:993
190.207.121.156:2222
157.231.42.190:443
66.131.25.6:443
73.165.119.20:443
187.199.171.252:32103
154.247.31.51:995
154.247.31.51:32103
50.68.204.71:995
58.162.223.233:443
101.109.57.236:995
58.247.115.126:995
84.35.26.14:995
172.219.147.156:3389
102.158.228.70:995
74.92.243.113:50000
157.231.42.190:995
68.146.18.15:443
216.82.134.218:443
181.164.194.228:443
190.18.236.175:443
200.233.108.153:995
50.37.149.215:443
186.64.67.44:443
71.199.168.185:443
94.49.5.116:443
217.39.57.121:443
108.44.207.232:443
181.56.171.3:995
136.244.25.165:443
173.32.181.236:443
186.73.140.43:443
97.119.214.233:443
190.74.248.136:443
50.86.217.209:443
73.88.173.113:443
86.173.19.76:443
45.62.78.1:443
201.245.250.192:995
206.1.168.96:443
78.162.245.96:443
62.35.100.38:443
181.55.106.237:443
72.11.161.70:443
190.134.202.68:443
24.69.87.61:443
123.3.240.16:995
204.210.210.7:443
78.165.146.61:443
142.161.120.116:2222
70.51.139.148:2222
68.103.242.126:995
174.4.112.228:443
88.171.156.150:50000
196.89.174.35:443
74.59.46.149:2222
76.125.91.160:443
62.46.231.64:443
24.253.221.86:443
109.154.46.73:443
142.118.239.135:2222
65.20.175.208:443
78.161.38.242:443
205.161.22.189:443
72.88.245.71:443
99.253.103.210:443
90.165.109.4:2222
151.213.183.141:995
190.75.37.178:2222
149.126.159.224:443
85.241.180.94:443
78.202.9.97:443
92.26.102.243:995
156.220.4.75:993
102.159.56.88:443
152.170.17.136:443
41.99.229.52:443
102.158.184.73:443
75.84.234.68:443
190.203.11.218:443
178.197.228.37:2222
64.127.146.153:443
47.6.225.229:443
51.219.234.104:2222
199.68.108.190:443
92.239.81.124:443
113.169.59.46:443
138.207.238.47:443
58.186.75.42:443
115.70.203.2:995
190.207.196.66:2222
206.1.230.114:2087
94.15.58.251:443
190.78.69.192:993
23.233.254.195:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2208	regsvr32.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe
2780	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2208	regsvr32.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2208	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2208	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2208	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2208	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2208	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2208	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2208	2216	regsvr32.exe	28
PID 2208 wrote to memory of 2780	2208	regsvr32.exe	29
PID 2208 wrote to memory of 2780	2208	regsvr32.exe	29
PID 2208 wrote to memory of 2780	2208	regsvr32.exe	29
PID 2208 wrote to memory of 2780	2208	regsvr32.exe	29
PID 2208 wrote to memory of 2780	2208	regsvr32.exe	29
PID 2208 wrote to memory of 2780	2208	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\vegetated.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\vegetated.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-7-0x0000000000210000-0x000000000023A000-memory.dmp

Download

memory/2208-1-0x00000000001E0000-0x000000000020C000-memory.dmp

Download

memory/2208-0-0x0000000000210000-0x000000000023A000-memory.dmp

Download

memory/2208-4-0x0000000000210000-0x000000000023A000-memory.dmp

Download

memory/2208-3-0x0000000000210000-0x000000000023A000-memory.dmp

Download

memory/2208-2-0x0000000000210000-0x000000000023A000-memory.dmp

Download

memory/2780-13-0x0000000000100000-0x000000000012A000-memory.dmp

Download

memory/2780-11-0x0000000000100000-0x000000000012A000-memory.dmp

Download

memory/2780-5-0x0000000000130000-0x0000000000132000-memory.dmp

Download

memory/2780-12-0x0000000000100000-0x000000000012A000-memory.dmp

Download

memory/2780-8-0x0000000000100000-0x000000000012A000-memory.dmp

Download

memory/2780-15-0x0000000000100000-0x000000000012A000-memory.dmp

Download

memory/2780-14-0x0000000000100000-0x000000000012A000-memory.dmp

Download

memory/2780-16-0x0000000000100000-0x000000000012A000-memory.dmp

Download

memory/2780-19-0x0000000000100000-0x000000000012A000-memory.dmp

Download