qakbot | 5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53

General

Target

5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53.dll
Size

512KB
MD5

13dd38ab50726f4fe35fef1cdd2bac40
SHA1

4b1ae77144cc52db8d9bd9502d635d8eafaee563
SHA256

5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53
SHA512

361d45f9aaa85eb387f2e64bad1d2868a6635f851b1e4e15e79a5bfbfd15f7243ae1783ba06f2e2f6ebd2a0e425bbda0b774a10d4a117970c277d3a75d6e9359

Score

10^/10

qakbot cullinan 1639742517 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639742517

C2

50.238.6.36:443

92.167.4.71:2222

89.137.52.44:443

105.198.236.99:995

117.248.109.38:21

106.51.48.170:50001

120.150.218.241:995

190.73.3.148:2222

182.56.53.180:443

186.64.87.213:443

103.142.10.177:443

65.100.174.110:443

96.21.251.127:2222

24.95.61.62:443

194.36.28.26:443

182.191.92.203:995

41.228.22.180:443

63.143.92.99:995

41.200.112.42:443

103.143.8.71:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

968 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1668 schtasks.exe

pid	process
968	regsvr32.exe

pid	process
1668	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uoriidvok	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoriidvok\ea8a4f7b = 92f320ee70aabd3288e78a9deaddab1fb174308faea9cc3a54f8de5e29e3b2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoriidvok\dd54bf49 = 594e5930cdba63bb28540ac897f194b627d2e62e2efe63d239cb5d73b870090fbd542ba6754ac8e2f5ceafdf3ad105e1cac088631922b5aa16d7af63ff1444f322dacaf6bfb48683fbfb4dbb69ecb98070bbd8d1e69b18d1c16717ea2ab5a05146693e22b52d178865c4275b3e2f6490f548c73f53	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoriidvok\dd54bf49 = 594e4e30cdba569aa374267bb963581d8ad06f54319605e273ca725d89416bb6b24249d149dff1b86b3affbff17dadc66f784bbc2a72e65b594848f0af1553c043b4928f83e73271b2d0f532f117f03f82666d297f5897eaaff974c76fa119cd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoriidvok\e8cb6f07 = d20808f65968489d7c232e8a3a2b4167b85778e07075a9e8dbdf41d71d05d0bf54bc36ff33bc71d3295b63b940d5c2f37c817f4c7464a3fc14cb715ca6fe65bd11fe5883a6a097a939a99c0a77c046cc76dc36f17b32ff2d24247f2f014e7e39a17ca6d3b59e5cce4f905530e5bbc7e8954024358de1925a2504692dda24dc77	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoriidvok\5236281e = b5fec6b2f5d3ee698fb8b673e92cd74104dcd3bae70a9b00c27f9dc0c1b89fd54897a67cda26b8d8d16c4f3152874d4bcb1c0f79911acf83b2dba78075379aead8b2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoriidvok\2f3e6794 = fd7884700bf94ce7a8efc2f223c0cc1bfd54044494d20d35	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoriidvok\978200f1 = 65173069409c9032dcb34c1a19289a6f658e3e033da0bd07e2590d8369f3ff5435ebaa0c1e364a32c1c63120b275cb1408d58d7d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoriidvok\50770862 = a2a5d6aa6b7a042b66ee89416549f063e7b6d48a4c5c26a39cf0b463488513fc474e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Uoriidvok\a21dd0bf = 9242bee102dddbc8cdaa607aa097ea5979569451e4bbda902736192c013331eee79e1078b8afbef2960ec9474b	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1888 rundll32.exe
968 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1888 rundll32.exe
968 regsvr32.exe

pid	process
1888	rundll32.exe
968	regsvr32.exe

pid	process
1888	rundll32.exe
968	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1664 wrote to memory of 1888	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1888	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1888	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1888	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1888	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1888	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1888	1664	rundll32.exe	rundll32.exe
PID 1888 wrote to memory of 1324	1888	rundll32.exe	explorer.exe
PID 1888 wrote to memory of 1324	1888	rundll32.exe	explorer.exe
PID 1888 wrote to memory of 1324	1888	rundll32.exe	explorer.exe
PID 1888 wrote to memory of 1324	1888	rundll32.exe	explorer.exe
PID 1888 wrote to memory of 1324	1888	rundll32.exe	explorer.exe
PID 1888 wrote to memory of 1324	1888	rundll32.exe	explorer.exe
PID 1324 wrote to memory of 1668	1324	explorer.exe	schtasks.exe
PID 1324 wrote to memory of 1668	1324	explorer.exe	schtasks.exe
PID 1324 wrote to memory of 1668	1324	explorer.exe	schtasks.exe
PID 1324 wrote to memory of 1668	1324	explorer.exe	schtasks.exe
PID 1652 wrote to memory of 1148	1652	taskeng.exe	regsvr32.exe
PID 1652 wrote to memory of 1148	1652	taskeng.exe	regsvr32.exe
PID 1652 wrote to memory of 1148	1652	taskeng.exe	regsvr32.exe
PID 1652 wrote to memory of 1148	1652	taskeng.exe	regsvr32.exe
PID 1652 wrote to memory of 1148	1652	taskeng.exe	regsvr32.exe
PID 1148 wrote to memory of 968	1148	regsvr32.exe	regsvr32.exe
PID 1148 wrote to memory of 968	1148	regsvr32.exe	regsvr32.exe
PID 1148 wrote to memory of 968	1148	regsvr32.exe	regsvr32.exe
PID 1148 wrote to memory of 968	1148	regsvr32.exe	regsvr32.exe
PID 1148 wrote to memory of 968	1148	regsvr32.exe	regsvr32.exe
PID 1148 wrote to memory of 968	1148	regsvr32.exe	regsvr32.exe
PID 1148 wrote to memory of 968	1148	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 1484	968	regsvr32.exe	explorer.exe
PID 968 wrote to memory of 1484	968	regsvr32.exe	explorer.exe
PID 968 wrote to memory of 1484	968	regsvr32.exe	explorer.exe
PID 968 wrote to memory of 1484	968	regsvr32.exe	explorer.exe
PID 968 wrote to memory of 1484	968	regsvr32.exe	explorer.exe
PID 968 wrote to memory of 1484	968	regsvr32.exe	explorer.exe
PID 1484 wrote to memory of 1904	1484	explorer.exe	reg.exe
PID 1484 wrote to memory of 1904	1484	explorer.exe	reg.exe
PID 1484 wrote to memory of 1904	1484	explorer.exe	reg.exe
PID 1484 wrote to memory of 1904	1484	explorer.exe	reg.exe
PID 1484 wrote to memory of 588	1484	explorer.exe	reg.exe
PID 1484 wrote to memory of 588	1484	explorer.exe	reg.exe
PID 1484 wrote to memory of 588	1484	explorer.exe	reg.exe
PID 1484 wrote to memory of 588	1484	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vigmbbcm /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53.dll\"" /SC ONCE /Z /ST 08:02 /ET 08:14
4⤵
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\taskeng.exe
taskeng.exe {C91416A2-20F6-4DC6-B41D-D54DF9103AC9} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Aoidcuanwea" /d "0"
5⤵
PID:1904

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Tiuivepi" /d "0"
5⤵
PID:588

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53.dll
MD5
13dd38ab50726f4fe35fef1cdd2bac40

SHA1
4b1ae77144cc52db8d9bd9502d635d8eafaee563

SHA256
5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53

SHA512
361d45f9aaa85eb387f2e64bad1d2868a6635f851b1e4e15e79a5bfbfd15f7243ae1783ba06f2e2f6ebd2a0e425bbda0b774a10d4a117970c277d3a75d6e9359

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53.dll
MD5
13dd38ab50726f4fe35fef1cdd2bac40

SHA1
4b1ae77144cc52db8d9bd9502d635d8eafaee563

SHA256
5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53

SHA512
361d45f9aaa85eb387f2e64bad1d2868a6635f851b1e4e15e79a5bfbfd15f7243ae1783ba06f2e2f6ebd2a0e425bbda0b774a10d4a117970c277d3a75d6e9359

Download Submit
memory/588-89-0x0000000000000000-mapping.dmp

Download
memory/968-81-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/968-82-0x00000000006E0000-0x0000000000701000-memory.dmp

Filesize
132KB

Download
memory/968-80-0x00000000006E0000-0x0000000000701000-memory.dmp

Filesize
132KB

Download
memory/968-79-0x00000000006E0000-0x0000000000701000-memory.dmp

Filesize
132KB

Download
memory/968-77-0x00000000006E0000-0x0000000000701000-memory.dmp

Filesize
132KB

Download
memory/968-78-0x00000000006E0000-0x0000000000701000-memory.dmp

Filesize
132KB

Download
memory/968-76-0x0000000000630000-0x00000000006B4000-memory.dmp

Filesize
528KB

Download
memory/968-73-0x0000000000000000-mapping.dmp

Download
memory/1148-71-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download
memory/1148-70-0x0000000000000000-mapping.dmp

Download
memory/1324-69-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1324-67-0x0000000074A11000-0x0000000074A13000-memory.dmp

Filesize
8KB

Download
memory/1324-65-0x0000000000000000-mapping.dmp

Download
memory/1324-64-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/1484-90-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1484-84-0x0000000000000000-mapping.dmp

Download
memory/1668-68-0x0000000000000000-mapping.dmp

Download
memory/1888-62-0x0000000000810000-0x0000000000831000-memory.dmp

Filesize
132KB

Download
memory/1888-61-0x0000000000810000-0x0000000000831000-memory.dmp

Filesize
132KB

Download
memory/1888-59-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/1888-60-0x00000000003B0000-0x00000000003D1000-memory.dmp

Filesize
132KB

Download
memory/1888-57-0x0000000000810000-0x0000000000831000-memory.dmp

Filesize
132KB

Download
memory/1888-58-0x0000000000810000-0x0000000000831000-memory.dmp

Filesize
132KB

Download
memory/1888-63-0x0000000000810000-0x0000000000831000-memory.dmp

Filesize
132KB

Download
memory/1888-56-0x0000000000300000-0x0000000000384000-memory.dmp

Filesize
528KB

Download
memory/1888-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1888-54-0x0000000000000000-mapping.dmp

Download
memory/1904-88-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads