Overview

overview

10

Static

static

1

vegetated.dll

windows10-1703-x64

10

Resubmissions

23-05-2024 04:24

240523-e1jzmadg77 10

23-05-2024 04:18

240523-ew76nadf2w 10

Analysis

  • max time kernel
    97s
  • max time network
    81s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23-05-2024 04:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    vegetated.dll

  • Size

    354KB

  • MD5

    95b1ae44716fb74b3ce589d7e1b53c3a

  • SHA1

    d322925f126c486cd2b5112057e4dd3e9692b7be

  • SHA256

    d4f7a0b2f29812223444cbce4684c12891962616708bbcc7a684a0efa510bdb4

  • SHA512

    dcd2aa426895a12e0e0a40a8e034c4b72161b8c929efae1d296ca29307e906c4a8df309b6ddbc234f3f63e0ac288641a3214895646d9d5c98ac9e69f1c5dd3d2

  • SSDEEP

    6144:ENsacLpop/C9lIbtBMHkqmO+pefWoAw6hjSy/AACs98K/f+ZuDXKK8bTcTCaULa4:gs/tMrbQHt+ps4w6RcA3/2oXmbTdaUe4

Score
10/10
qakbotobama2201667373670bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.14

Botnet

obama220

Campaign

1667373670

C2

174.0.224.214:443

70.60.142.214:2222

136.232.184.134:995

67.87.214.7:443

174.104.184.149:443

64.207.237.118:443

144.202.15.58:443

74.33.84.227:443

175.205.2.54:443

174.77.209.5:443

45.49.137.80:443

74.92.243.113:995

76.68.34.167:2222

49.175.72.56:443

190.24.45.24:995

50.68.204.71:443

179.100.109.130:32101

70.64.77.115:443

109.151.171.116:2222

91.138.17.202:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 50 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\vegetated.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\vegetated.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Windows\SysWOW64\wermgr.exe
        C:\Windows\SysWOW64\wermgr.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3932
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:320

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2796-0-0x0000000002F30000-0x0000000002F5A000-memory.dmp
    Filesize

    168KB

    Download
  • memory/2796-2-0x0000000002F30000-0x0000000002F5A000-memory.dmp
    Filesize

    168KB

    Download
  • memory/2796-1-0x0000000000ED0000-0x0000000000EFC000-memory.dmp
    Filesize

    176KB

    Download
  • memory/2796-4-0x0000000002F30000-0x0000000002F5A000-memory.dmp
    Filesize

    168KB

    Download
  • memory/3932-3-0x0000000000FD0000-0x0000000000FFA000-memory.dmp
    Filesize

    168KB

    Download
  • memory/3932-6-0x0000000000FD0000-0x0000000000FFA000-memory.dmp
    Filesize

    168KB

    Download
  • memory/3932-10-0x0000000000FD0000-0x0000000000FFA000-memory.dmp
    Filesize

    168KB

    Download
  • memory/3932-9-0x0000000000FD0000-0x0000000000FFA000-memory.dmp
    Filesize

    168KB

    Download
  • memory/3932-12-0x0000000000FD0000-0x0000000000FFA000-memory.dmp
    Filesize

    168KB

    Download
  • memory/3932-11-0x0000000000FD0000-0x0000000000FFA000-memory.dmp
    Filesize

    168KB

    Download
  • memory/3932-13-0x0000000000FD0000-0x0000000000FFA000-memory.dmp
    Filesize

    168KB

    Download
  • memory/3932-14-0x0000000000FD0000-0x0000000000FFA000-memory.dmp
    Filesize

    168KB

    Download