qakbot | b4da540a4ea5256861bd226b0461673a3da6d7fc195ddb50df59234f4903a576

General

Target

b4da540a4ea5256861bd226b0461673a3da6d7fc195ddb50df59234f4903a576.dll
Size

934KB
MD5

456fca45a858277d9837b058154600fe
SHA1

ce09f3d52f7628488db6fcbf26c4de933301455c
SHA256

b4da540a4ea5256861bd226b0461673a3da6d7fc195ddb50df59234f4903a576
SHA512

ab1a0b679b4d765fd04999f815d2d545725d4acbe9df9d9c34138c08c373c671b3509ec535269d59bc2c49e1d5f3596182da1c9c043c84c91232ba6c7fa1c28d

Score

10^/10

qakbot cullinan 1639333530 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639333530

C2

65.100.174.110:443

173.21.10.71:2222

140.82.49.12:443

190.73.3.148:2222

76.25.142.196:443

71.74.12.34:443

31.215.98.160:443

93.48.80.198:995

45.9.20.200:2211

41.228.22.180:443

109.12.111.14:443

63.143.92.99:995

120.150.218.241:995

94.60.254.81:443

86.148.6.51:443

218.101.110.3:995

216.238.71.31:443

207.246.112.221:443

216.238.72.121:443

216.238.71.31:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1512 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1528 schtasks.exe

pid	process
1512	regsvr32.exe

pid	process
1528	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bjyewuuiwhbf\c6a4f173 = f7eec2a8e9936b379cbc7b2f4b2842f64df1644e892deed6eaab5c93bdc65243c22ab1d567564112bc3cf3ed5fb6b75d959b0226bb29700fe0ef860d884f7252bd8521a96ee18fa69eecb3a8a3dbba601871809aa795825a39236fbef9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bjyewuuiwhbf\7e189616 = 5e58dfb99820f8f927241dcc9a08bece0359f1aebcd3c37ade98bac4bb8d7c4055a3877603a3c1ebc6695190f705a9105909da94bd32d092f74268077412df50b0fba88dcc7416dda977a13164880486f2d45afe19c916acbc73010a0408b6b0b4e0eb512f08f0657b49f8827491f452	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bjyewuuiwhbf\4b874658 = 715595ddba3f73141d8c5165b9e265db2923eaaeccc4003432c1ed7d6e4df2f90810ab46baa4b1a5abb089b99db842a176d93c90a3f6bcb399e2ddc2f56eb3931174f4c3d9ade395705689fd5c20d4943c9fbfb6c7a88a68b4a9bf7addfa9589	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bjyewuuiwhbf\34ce29ae = db3d113abaad380e6b0e9421cb6106f904ae002f47645ba0108f33f436cb066ae0485c2d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bjyewuuiwhbf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bjyewuuiwhbf\34ce29ae = db3d063abaad0dd6e48d65dd128e23	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bjyewuuiwhbf\151f9e0 = f8a875479b0fe78357233e3183205fd2f377752d7e30cbbc1e9a3e738ed1735758059c3bd15a7b43886bd9e432f12908e84c224b347edc5f3fac6caba90181f2cf63828df411857591210ac5d6a69d8fed62efe5fd09b0cbd8dae451f728608002bb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bjyewuuiwhbf\310d99c = 75537f624b09ae5f461f8153074134e0c6c6c695f63fc09b1d03c12e89444338bf90a053af96a928913cbf76bc124eb49c0af85be055a97edcbd049a12c29a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bjyewuuiwhbf\bbacbef9 = 18e5c19a9ced2c1a61eae395a4850ddfa5abb206d7f6cde948f3708a7374a51b22c0859f92ac251930fa7864294b9f936ee074d778ed76c620850960112dae3f51f1e14c7537e235d5b6429909d24fcaec498d55e8d49af9d51a0ac3558269217ba9bfa331da30c28d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Bjyewuuiwhbf\b9ed9e85 = 75161c7866f5aa01ae8ffd4e3dd33ee1498d18d235cb4731120519	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1688 regsvr32.exe
1512 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1688 regsvr32.exe
1512 regsvr32.exe

Suspicious use of FindShellTrayWindow 62 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe
1512	regsvr32.exe

Suspicious use of SendNotifyMessage 31 IoCs

Processes:

regsvr32.exe

pid	process
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1588 wrote to memory of 1688	1588	regsvr32.exe	regsvr32.exe
PID 1588 wrote to memory of 1688	1588	regsvr32.exe	regsvr32.exe
PID 1588 wrote to memory of 1688	1588	regsvr32.exe	regsvr32.exe
PID 1588 wrote to memory of 1688	1588	regsvr32.exe	regsvr32.exe
PID 1588 wrote to memory of 1688	1588	regsvr32.exe	regsvr32.exe
PID 1588 wrote to memory of 1688	1588	regsvr32.exe	regsvr32.exe
PID 1588 wrote to memory of 1688	1588	regsvr32.exe	regsvr32.exe
PID 1688 wrote to memory of 760	1688	regsvr32.exe	explorer.exe
PID 1688 wrote to memory of 760	1688	regsvr32.exe	explorer.exe
PID 1688 wrote to memory of 760	1688	regsvr32.exe	explorer.exe
PID 1688 wrote to memory of 760	1688	regsvr32.exe	explorer.exe
PID 1688 wrote to memory of 760	1688	regsvr32.exe	explorer.exe
PID 1688 wrote to memory of 760	1688	regsvr32.exe	explorer.exe
PID 760 wrote to memory of 1528	760	explorer.exe	schtasks.exe
PID 760 wrote to memory of 1528	760	explorer.exe	schtasks.exe
PID 760 wrote to memory of 1528	760	explorer.exe	schtasks.exe
PID 760 wrote to memory of 1528	760	explorer.exe	schtasks.exe
PID 1504 wrote to memory of 1632	1504	taskeng.exe	regsvr32.exe
PID 1504 wrote to memory of 1632	1504	taskeng.exe	regsvr32.exe
PID 1504 wrote to memory of 1632	1504	taskeng.exe	regsvr32.exe
PID 1504 wrote to memory of 1632	1504	taskeng.exe	regsvr32.exe
PID 1504 wrote to memory of 1632	1504	taskeng.exe	regsvr32.exe
PID 1632 wrote to memory of 1512	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1512	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1512	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1512	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1512	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1512	1632	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 1512	1632	regsvr32.exe	regsvr32.exe
PID 1512 wrote to memory of 968	1512	regsvr32.exe	explorer.exe
PID 1512 wrote to memory of 968	1512	regsvr32.exe	explorer.exe
PID 1512 wrote to memory of 968	1512	regsvr32.exe	explorer.exe
PID 1512 wrote to memory of 968	1512	regsvr32.exe	explorer.exe
PID 1512 wrote to memory of 968	1512	regsvr32.exe	explorer.exe
PID 1512 wrote to memory of 968	1512	regsvr32.exe	explorer.exe
PID 968 wrote to memory of 1740	968	explorer.exe	reg.exe
PID 968 wrote to memory of 1740	968	explorer.exe	reg.exe
PID 968 wrote to memory of 1740	968	explorer.exe	reg.exe
PID 968 wrote to memory of 1740	968	explorer.exe	reg.exe
PID 968 wrote to memory of 2036	968	explorer.exe	reg.exe
PID 968 wrote to memory of 2036	968	explorer.exe	reg.exe
PID 968 wrote to memory of 2036	968	explorer.exe	reg.exe
PID 968 wrote to memory of 2036	968	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b4da540a4ea5256861bd226b0461673a3da6d7fc195ddb50df59234f4903a576.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\b4da540a4ea5256861bd226b0461673a3da6d7fc195ddb50df59234f4903a576.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lnydjxmo /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\b4da540a4ea5256861bd226b0461673a3da6d7fc195ddb50df59234f4903a576.dll\"" /SC ONCE /Z /ST 14:20 /ET 14:32
4⤵
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\taskeng.exe
taskeng.exe {52F07838-1A81-43D6-A1B2-AD84F91268D2} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\b4da540a4ea5256861bd226b0461673a3da6d7fc195ddb50df59234f4903a576.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\b4da540a4ea5256861bd226b0461673a3da6d7fc195ddb50df59234f4903a576.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Xquifw" /d "0"
5⤵
PID:1740

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Dzwoaevculv" /d "0"
5⤵
PID:2036

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b4da540a4ea5256861bd226b0461673a3da6d7fc195ddb50df59234f4903a576.dll
MD5
456fca45a858277d9837b058154600fe

SHA1
ce09f3d52f7628488db6fcbf26c4de933301455c

SHA256
b4da540a4ea5256861bd226b0461673a3da6d7fc195ddb50df59234f4903a576

SHA512
ab1a0b679b4d765fd04999f815d2d545725d4acbe9df9d9c34138c08c373c671b3509ec535269d59bc2c49e1d5f3596182da1c9c043c84c91232ba6c7fa1c28d

Download Submit
\Users\Admin\AppData\Local\Temp\b4da540a4ea5256861bd226b0461673a3da6d7fc195ddb50df59234f4903a576.dll
MD5
456fca45a858277d9837b058154600fe

SHA1
ce09f3d52f7628488db6fcbf26c4de933301455c

SHA256
b4da540a4ea5256861bd226b0461673a3da6d7fc195ddb50df59234f4903a576

SHA512
ab1a0b679b4d765fd04999f815d2d545725d4acbe9df9d9c34138c08c373c671b3509ec535269d59bc2c49e1d5f3596182da1c9c043c84c91232ba6c7fa1c28d

Download Submit
memory/760-59-0x0000000000310000-0x0000000000312000-memory.dmp

Filesize
8KB

Download
memory/760-60-0x0000000000000000-mapping.dmp

Download
memory/760-62-0x0000000074451000-0x0000000074453000-memory.dmp

Filesize
8KB

Download
memory/760-64-0x0000000000360000-0x0000000000381000-memory.dmp

Filesize
132KB

Download
memory/968-76-0x0000000000310000-0x0000000000331000-memory.dmp

Filesize
132KB

Download
memory/968-72-0x0000000000000000-mapping.dmp

Download
memory/1512-75-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1512-68-0x0000000000000000-mapping.dmp

Download
memory/1528-63-0x0000000000000000-mapping.dmp

Download
memory/1588-54-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp

Filesize
8KB

Download
memory/1632-65-0x0000000000000000-mapping.dmp

Download
memory/1688-57-0x00000000001A0000-0x0000000000220000-memory.dmp

Filesize
512KB

Download
memory/1688-58-0x0000000010000000-0x00000000100F4000-memory.dmp

Filesize
976KB

Download
memory/1688-56-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1688-55-0x0000000000000000-mapping.dmp

Download
memory/1740-77-0x0000000000000000-mapping.dmp

Download
memory/2036-78-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads