qakbot | d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937

General

Target

latin.dll
Size

945KB
MD5

bb17bf13123596ba3065efc74d625a3c
SHA1

b589b0dee84e30e205f242a8d429b1e231b5ec5b
SHA256

d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937
SHA512

40d6bb5bb741b43a03969c40acafbc621281ad9f4fa23d3a90f07e30b01eda95227af6b96a20d48712f08b2252069e711842d71d3f1e95374db44fb7845ab427

Score

10^/10

qakbot cullinan 1639333530 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639333530

C2

65.100.174.110:443

173.21.10.71:2222

140.82.49.12:443

190.73.3.148:2222

76.25.142.196:443

71.74.12.34:443

31.215.98.160:443

93.48.80.198:995

45.9.20.200:2211

41.228.22.180:443

109.12.111.14:443

63.143.92.99:995

120.150.218.241:995

94.60.254.81:443

86.148.6.51:443

218.101.110.3:995

216.238.71.31:443

207.246.112.221:443

216.238.72.121:443

216.238.71.31:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3652 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1304 schtasks.exe

pid	process
3652	regsvr32.exe

pid	process
1304	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uqloykqvz	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uqloykqvz\f2378a44 = b02ded27f0d744090da29bbb1cf887a0d060ed820747b1816d2a2e49540a4272d4869e245fbcc708b10328889b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uqloykqvz\c7a85a0a = 1e0e7afe0f124e796ee2b64b38d3f303784bc9abd943a74daa78a24fab375e68af99cd639fd87b738f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uqloykqvz\5d5299 = c9c210e08dda55b03785cd3bb591cb4931bc17ceb8b7a51a3de95d2979c99b7d0480791adf7bb306aca69f5ff609f1029f8701f787ca86d01410e46a45d02eccf6678bdc2a33	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uqloykqvz\8d7ee5b2 = 7dbd509efc1fe949555b7f16484dda04b08b97163b3846772a599f52dde9bd70596b7bd2a1609bede97fec0c60fe1453785154fcd839b3d74786b5b012414b8345eddc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uqloykqvz\8d7ee5b2 = 7dbd479efc1fdc27d2112e3cd07eb148504ab0fa66b5e9901ff7bac808244afbb0609721af5e04b715e59fe99179	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uqloykqvz\b8e135fc = 26a207ebc7a00b041f7574280442d6a0e0934ca049311df210bfbfdbee1d67a45e2cc5cc19fe06a41515eb326ff93834760e1e8cb9b6390771d71d927d911448cee9a3069025d27ced733b4316b620c69f5e18ff7270408ae7924468d3ba87c3dd11da460a8b36df9f926a60f080329180d28e37272449944d7831bc49129b76c26bfa2eca99f6952111b4b0a80063da80468f0f40612ea5c12b0cd518a4a3ff2c7f49df2e469d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uqloykqvz\baa01580 = 595ada384950681d2ae01452d6cd0b149cb2bd4be2fe79a0a1a92343a9ade6f958bff03ca32a260c13ebada4d5b3aeed901e0e4346b8b83a2be0130bdc44ba7aa5272fa084d88619	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uqloykqvz\21c72e5 = 9f91ca9dc7ab0e97e5f73935295219ea7dd4c0d5934c673eed26d0b94b79cc7034d0038c944a2f0f31f8fe124a324ae2b7135b11e8bb383dfdb79a6b802987efb4243dc77a72d2c26cf491fe0bea040e6b37d90322d3e6071e2a1757d13af94743df2a90ae	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uqloykqvz\7f143d6f = e83dcce5b3808e06772031c9518a80d4706a5753de33a3db150af3d5	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

4084 regsvr32.exe
4084 regsvr32.exe
3652 regsvr32.exe
3652 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

4084 regsvr32.exe
3652 regsvr32.exe

pid	process
4084	regsvr32.exe
4084	regsvr32.exe
3652	regsvr32.exe
3652	regsvr32.exe

pid	process
4084	regsvr32.exe
3652	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3192 wrote to memory of 4084	3192	regsvr32.exe	regsvr32.exe
PID 3192 wrote to memory of 4084	3192	regsvr32.exe	regsvr32.exe
PID 3192 wrote to memory of 4084	3192	regsvr32.exe	regsvr32.exe
PID 4084 wrote to memory of 960	4084	regsvr32.exe	explorer.exe
PID 4084 wrote to memory of 960	4084	regsvr32.exe	explorer.exe
PID 4084 wrote to memory of 960	4084	regsvr32.exe	explorer.exe
PID 4084 wrote to memory of 960	4084	regsvr32.exe	explorer.exe
PID 4084 wrote to memory of 960	4084	regsvr32.exe	explorer.exe
PID 960 wrote to memory of 1304	960	explorer.exe	schtasks.exe
PID 960 wrote to memory of 1304	960	explorer.exe	schtasks.exe
PID 960 wrote to memory of 1304	960	explorer.exe	schtasks.exe
PID 3228 wrote to memory of 3652	3228	regsvr32.exe	regsvr32.exe
PID 3228 wrote to memory of 3652	3228	regsvr32.exe	regsvr32.exe
PID 3228 wrote to memory of 3652	3228	regsvr32.exe	regsvr32.exe
PID 3652 wrote to memory of 3556	3652	regsvr32.exe	explorer.exe
PID 3652 wrote to memory of 3556	3652	regsvr32.exe	explorer.exe
PID 3652 wrote to memory of 3556	3652	regsvr32.exe	explorer.exe
PID 3652 wrote to memory of 3556	3652	regsvr32.exe	explorer.exe
PID 3652 wrote to memory of 3556	3652	regsvr32.exe	explorer.exe
PID 3556 wrote to memory of 2812	3556	explorer.exe	reg.exe
PID 3556 wrote to memory of 2812	3556	explorer.exe	reg.exe
PID 3556 wrote to memory of 3852	3556	explorer.exe	reg.exe
PID 3556 wrote to memory of 3852	3556	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\latin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\latin.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lchkgohzof /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\latin.dll\"" /SC ONCE /Z /ST 12:03 /ET 12:15
      4⤵
      Creates scheduled task(s)
      PID:1304

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\latin.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\latin.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:3556
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ccqgim" /d "0"
      4⤵
      PID:2812
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ucaaulfc" /d "0"
      4⤵
      PID:3852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\latin.dll

MD5
bb17bf13123596ba3065efc74d625a3c

SHA1
b589b0dee84e30e205f242a8d429b1e231b5ec5b

SHA256
d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937

SHA512
40d6bb5bb741b43a03969c40acafbc621281ad9f4fa23d3a90f07e30b01eda95227af6b96a20d48712f08b2252069e711842d71d3f1e95374db44fb7845ab427

Download Submit
\Users\Admin\AppData\Local\Temp\latin.dll

MD5
bb17bf13123596ba3065efc74d625a3c

SHA1
b589b0dee84e30e205f242a8d429b1e231b5ec5b

SHA256
d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937

SHA512
40d6bb5bb741b43a03969c40acafbc621281ad9f4fa23d3a90f07e30b01eda95227af6b96a20d48712f08b2252069e711842d71d3f1e95374db44fb7845ab427

Download Submit
memory/960-121-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/960-118-0x0000000000000000-mapping.dmp

Download
memory/960-122-0x00000000004C0000-0x00000000004E1000-memory.dmp

Filesize
132KB

Download
memory/960-120-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/1304-119-0x0000000000000000-mapping.dmp

Download
memory/2812-128-0x0000000000000000-mapping.dmp

Download
memory/3556-127-0x0000000000000000-mapping.dmp

Download
memory/3556-130-0x0000000003170000-0x0000000003171000-memory.dmp

Filesize
4KB

Download
memory/3556-131-0x0000000003170000-0x0000000003171000-memory.dmp

Filesize
4KB

Download
memory/3556-132-0x0000000000A30000-0x0000000000A51000-memory.dmp

Filesize
132KB

Download
memory/3652-124-0x0000000000000000-mapping.dmp

Download
memory/3652-126-0x0000000002F80000-0x0000000002F81000-memory.dmp

Filesize
4KB

Download
memory/3852-129-0x0000000000000000-mapping.dmp

Download
memory/4084-115-0x0000000000000000-mapping.dmp

Download
memory/4084-117-0x0000000010000000-0x00000000100F5000-memory.dmp

Filesize
980KB

Download
memory/4084-116-0x0000000003370000-0x0000000003393000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads