qakbot | 5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53

General

Target

5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53.dll
Size

512KB
MD5

13dd38ab50726f4fe35fef1cdd2bac40
SHA1

4b1ae77144cc52db8d9bd9502d635d8eafaee563
SHA256

5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53
SHA512

361d45f9aaa85eb387f2e64bad1d2868a6635f851b1e4e15e79a5bfbfd15f7243ae1783ba06f2e2f6ebd2a0e425bbda0b774a10d4a117970c277d3a75d6e9359

Score

10^/10

qakbot cullinan 1639742517 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639742517

C2

50.238.6.36:443

92.167.4.71:2222

89.137.52.44:443

105.198.236.99:995

117.248.109.38:21

106.51.48.170:50001

120.150.218.241:995

190.73.3.148:2222

182.56.53.180:443

186.64.87.213:443

103.142.10.177:443

65.100.174.110:443

96.21.251.127:2222

24.95.61.62:443

194.36.28.26:443

182.191.92.203:995

41.228.22.180:443

63.143.92.99:995

41.200.112.42:443

103.143.8.71:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1260 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

564 schtasks.exe

pid	process
1260	regsvr32.exe

pid	process
564	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kqtnyyhaqdrqc\104732c3 = 2ada9432463b98b9e50afba419db27870f45e6277246610e29b2d94c86b866493c0ab2a73657d57503d1964743822291	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kqtnyyhaqdrqc\25d8e28d = 606e59e3d96bb39b0205edfcec47a81422577fdf560f32453547d86c2a545d31b87bee7162a1272c85c4e2a6fb665c1ee16439eafd70d7bbb6ef847fa88bc7f4d551e7566d769465625e6822100d35fdb8d6120386847694e980a49c479e69901800ab9fc111b5dc0a056da02e9ebb46dbc01a8d229aadedc730e2c31ccafc2d540378669c9007e6be0eda641274426364374247d7f9819d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kqtnyyhaqdrqc\e22dea1e = 8fd7f7813b4fbf61baa2543d68a34cb50e87958741d69150130a9fb7ffefb53f756b934a677e2daf2751ceb86c091ced4e559bcd2c782206bea8be3b65bae45b97c0dd2561ff66d217cab90500753ce90ce89d025a85	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kqtnyyhaqdrqc\5a918d7b = 07ee4d8ffadad19e640027fb3d1cab67dfe82310c750a0690ccc548a831e0bd934fb8b68f0dc5be21731a81459fee368a24449afd16ffd89d868f15037ca00	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kqtnyyhaqdrqc\9d6485e8 = 2bb6fefcf3d15ecf14c1618d0f36dbb83079a53bc60e6c089c09f6ff255983277eb7fc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kqtnyyhaqdrqc\104732c3 = 2ada8332463badfc49911d8de18deef052663b4ce4865caa08d44a30894ad3d4e8c1a63a33be844635d1c7ec750bc3e8421fa97a4b5f2888bff265e9d9e2820fbceb0f677b	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kqtnyyhaqdrqc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kqtnyyhaqdrqc\9f25a594 = df5a6562240a9a5cf3fbcddde01b9c963fb74245eebb06db2c46aa6059c038	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kqtnyyhaqdrqc\6f0e5d35 = d232fa186248985b76811be5329e13245ae1d0115e9509b9ab2081821d4a6bea5063131ecc8748871c685bd8bf67dc55bc3b6a53dd70c2a2825951c0a026c0f7297571328a6db0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kqtnyyhaqdrqc\2799c2f1 = fab2a4182ce9c06aa4b239385f0ba053a2e0850e68b9bcf83c390863d1849841653250a000d8c5eaed1a9ab0587c6dc0beaa8a7526339eecfefd2a8d20efb789b55ae19d93f8696be72fc62c492f14766c51951970b526af5df615248b8e573393ef	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

904 rundll32.exe
1260 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

904 rundll32.exe
1260 regsvr32.exe

pid	process
904	rundll32.exe
1260	regsvr32.exe

pid	process
904	rundll32.exe
1260	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1668 wrote to memory of 904	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 904	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 904	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 904	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 904	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 904	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 904	1668	rundll32.exe	rundll32.exe
PID 904 wrote to memory of 1356	904	rundll32.exe	explorer.exe
PID 904 wrote to memory of 1356	904	rundll32.exe	explorer.exe
PID 904 wrote to memory of 1356	904	rundll32.exe	explorer.exe
PID 904 wrote to memory of 1356	904	rundll32.exe	explorer.exe
PID 904 wrote to memory of 1356	904	rundll32.exe	explorer.exe
PID 904 wrote to memory of 1356	904	rundll32.exe	explorer.exe
PID 1356 wrote to memory of 564	1356	explorer.exe	schtasks.exe
PID 1356 wrote to memory of 564	1356	explorer.exe	schtasks.exe
PID 1356 wrote to memory of 564	1356	explorer.exe	schtasks.exe
PID 1356 wrote to memory of 564	1356	explorer.exe	schtasks.exe
PID 1456 wrote to memory of 1392	1456	taskeng.exe	regsvr32.exe
PID 1456 wrote to memory of 1392	1456	taskeng.exe	regsvr32.exe
PID 1456 wrote to memory of 1392	1456	taskeng.exe	regsvr32.exe
PID 1456 wrote to memory of 1392	1456	taskeng.exe	regsvr32.exe
PID 1456 wrote to memory of 1392	1456	taskeng.exe	regsvr32.exe
PID 1392 wrote to memory of 1260	1392	regsvr32.exe	regsvr32.exe
PID 1392 wrote to memory of 1260	1392	regsvr32.exe	regsvr32.exe
PID 1392 wrote to memory of 1260	1392	regsvr32.exe	regsvr32.exe
PID 1392 wrote to memory of 1260	1392	regsvr32.exe	regsvr32.exe
PID 1392 wrote to memory of 1260	1392	regsvr32.exe	regsvr32.exe
PID 1392 wrote to memory of 1260	1392	regsvr32.exe	regsvr32.exe
PID 1392 wrote to memory of 1260	1392	regsvr32.exe	regsvr32.exe
PID 1260 wrote to memory of 1028	1260	regsvr32.exe	explorer.exe
PID 1260 wrote to memory of 1028	1260	regsvr32.exe	explorer.exe
PID 1260 wrote to memory of 1028	1260	regsvr32.exe	explorer.exe
PID 1260 wrote to memory of 1028	1260	regsvr32.exe	explorer.exe
PID 1260 wrote to memory of 1028	1260	regsvr32.exe	explorer.exe
PID 1260 wrote to memory of 1028	1260	regsvr32.exe	explorer.exe
PID 1028 wrote to memory of 1096	1028	explorer.exe	reg.exe
PID 1028 wrote to memory of 1096	1028	explorer.exe	reg.exe
PID 1028 wrote to memory of 1096	1028	explorer.exe	reg.exe
PID 1028 wrote to memory of 1096	1028	explorer.exe	reg.exe
PID 1028 wrote to memory of 624	1028	explorer.exe	reg.exe
PID 1028 wrote to memory of 624	1028	explorer.exe	reg.exe
PID 1028 wrote to memory of 624	1028	explorer.exe	reg.exe
PID 1028 wrote to memory of 624	1028	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xxoauhwek /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53.dll\"" /SC ONCE /Z /ST 09:02 /ET 09:14
4⤵
- Creates scheduled task(s)
PID:564

C:\Windows\system32\taskeng.exe
taskeng.exe {05CCE757-A961-48F2-84B8-0D2885D3C809} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Zacybpuzsj" /d "0"
5⤵
PID:1096

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Cipagap" /d "0"
5⤵
PID:624

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53.dll
MD5
13dd38ab50726f4fe35fef1cdd2bac40

SHA1
4b1ae77144cc52db8d9bd9502d635d8eafaee563

SHA256
5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53

SHA512
361d45f9aaa85eb387f2e64bad1d2868a6635f851b1e4e15e79a5bfbfd15f7243ae1783ba06f2e2f6ebd2a0e425bbda0b774a10d4a117970c277d3a75d6e9359

Download Submit
\Users\Admin\AppData\Local\Temp\5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53.dll
MD5
13dd38ab50726f4fe35fef1cdd2bac40

SHA1
4b1ae77144cc52db8d9bd9502d635d8eafaee563

SHA256
5b3d7ff4aab40fbaed4a1109a88a88f2583314718c5cc5eb37a7f219d61a1b53

SHA512
361d45f9aaa85eb387f2e64bad1d2868a6635f851b1e4e15e79a5bfbfd15f7243ae1783ba06f2e2f6ebd2a0e425bbda0b774a10d4a117970c277d3a75d6e9359

Download Submit
memory/564-68-0x0000000000000000-mapping.dmp

Download
memory/624-87-0x0000000000000000-mapping.dmp

Download
memory/904-61-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/904-60-0x00000000003C0000-0x00000000003E1000-memory.dmp

Filesize
132KB

Download
memory/904-59-0x00000000003C0000-0x00000000003E1000-memory.dmp

Filesize
132KB

Download
memory/904-62-0x0000000000340000-0x0000000000361000-memory.dmp

Filesize
132KB

Download
memory/904-57-0x00000000003C0000-0x00000000003E1000-memory.dmp

Filesize
132KB

Download
memory/904-63-0x00000000003C0000-0x00000000003E1000-memory.dmp

Filesize
132KB

Download
memory/904-58-0x00000000003C0000-0x00000000003E1000-memory.dmp

Filesize
132KB

Download
memory/904-56-0x00000000001E0000-0x0000000000264000-memory.dmp

Filesize
528KB

Download
memory/904-54-0x0000000000000000-mapping.dmp

Download
memory/904-55-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/1028-89-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1028-83-0x0000000000000000-mapping.dmp

Download
memory/1096-86-0x0000000000000000-mapping.dmp

Download
memory/1260-77-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1260-73-0x0000000000000000-mapping.dmp

Download
memory/1260-76-0x0000000000270000-0x00000000002F4000-memory.dmp

Filesize
528KB

Download
memory/1260-79-0x00000000003C0000-0x00000000003E1000-memory.dmp

Filesize
132KB

Download
memory/1260-80-0x00000000003C0000-0x00000000003E1000-memory.dmp

Filesize
132KB

Download
memory/1260-81-0x00000000003C0000-0x00000000003E1000-memory.dmp

Filesize
132KB

Download
memory/1260-88-0x00000000003C0000-0x00000000003E1000-memory.dmp

Filesize
132KB

Download
memory/1356-69-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1356-67-0x0000000074761000-0x0000000074763000-memory.dmp

Filesize
8KB

Download
memory/1356-65-0x0000000000000000-mapping.dmp

Download
memory/1356-64-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/1392-71-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Filesize
8KB

Download
memory/1392-70-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads