qakbot | 0ec97bf14e6897b8ecbff00cb58147374b922268c620210ff5fb5388333ecf45

General

Target

0ec97bf14e6897b8ecbff00cb58147374b922268c620210ff5fb5388333ecf45.dll
Size

512KB
MD5

5bbcf23f5cd1f796b5ac850983695553
SHA1

d54bb91c500d127c0a098c34ffbd1049d08757f5
SHA256

0ec97bf14e6897b8ecbff00cb58147374b922268c620210ff5fb5388333ecf45
SHA512

395a595eed9928b68849915e9b0db5c3aadd65b44e8a7bfcbcbefece993b67efbac89610c2269a06d3196afe6bd281a325a02d7831b5ef99b54e2423a20c2959

Score

10^/10

qakbot cullinan 1639742517 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639742517

C2

50.238.6.36:443

92.167.4.71:2222

89.137.52.44:443

105.198.236.99:995

117.248.109.38:21

106.51.48.170:50001

120.150.218.241:995

190.73.3.148:2222

182.56.53.180:443

186.64.87.213:443

103.142.10.177:443

65.100.174.110:443

96.21.251.127:2222

24.95.61.62:443

194.36.28.26:443

182.191.92.203:995

41.228.22.180:443

63.143.92.99:995

41.200.112.42:443

103.143.8.71:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

872 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1480 schtasks.exe

pid	process
872	regsvr32.exe

pid	process
1480	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kavamoqhtrgm\8c7f0e39 = dceb16f8201fc1f63ff60794991107fc097a1725c2e2253d7ae031f7d2e1318968	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kavamoqhtrgm\7e15d6e4 = b88df1217c95eea75e69a028a8b4bfc65b9cb7b1406de20097ad872bb84f17cb96f5bcca15a3000490b1f01e0aa59b7af86007d740b6a494a5faf9d6c73762ec0efe074499fc5b8cf5f6eaebc40c5dd116f05a170dcc8cbdae9e2af106	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kavamoqhtrgm\15cb912 = a4702c8cb7bb3afdb19b2d5900569d5a0943909839ee7549a736331eb8060b4709e13befcd80db861a6b196e9dc7ef037f6af6aefabf0cc6a8ca62ec779ea71b73107204331bdc27da6fa9c3cc6c844a35ff3e0dc37fdc78bc964c3e60e252a75c319d9c93c35854f6b72f2c21f2648d0df65f0831b97ccd8b960e3739f65c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kavamoqhtrgm\f33661cf = 322b8dba528f0b20df02b48d3d01	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kavamoqhtrgm\4b8a06aa = af6bc34b3b188d88d3cc7752260ce82b37e997a7f777be0ea077094c36abb3d806a64b0ee1623b42838b79126c8e343642999255ec5e141a21db88da0cd68eeecae3464928a1	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kavamoqhtrgm	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kavamoqhtrgm\15cb912 = a4703b8cb7bb0fa365432d1f7e8a39c68388cd0cc1380651ef0488e42b6140d5977803b2e3806266fa8390980adaf22528e098f0c1072c56c3b76920a8c65fc13db8aa02f5278c2420f9a6439bea18e60a48d50cc8be5b35ae757bb5e5f5cbd029a917a3647e15923e7c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kavamoqhtrgm\34c3695c = c3eb945ebddb6680ea44b947f146a8572f7ba099138d94f17c532b7c8df838c04006986496890590daf3032f3aca1559d55b2778e054d285b836ea65452a25bc87b750142a9e1b4994283c31c0f7be7c280aca303c1380a95456ae180ccdb0b45cb94e0d3bf35d281a637ee5d68b0f6f60a703c598368ff1bfceb6bdf150879c6610cedccbb6f5b374bcf22c07e4fd1e4dbc6374d44cd1454f896a02b4bc36f46e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kavamoqhtrgm\36824920 = c88549ab88d39559cc2619ea6fd2db19f38af59b1dbabf410027e96260798914c8cd99949250f17585a5a1d7190067b68b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Kavamoqhtrgm\8e3e2e45 = 3b893478a800b356878a792b3268c3d1b97762c9a224eb	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1848 rundll32.exe
872 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

1848 rundll32.exe
872 regsvr32.exe

pid	process
1848	rundll32.exe
872	regsvr32.exe

pid	process
1848	rundll32.exe
872	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1284 wrote to memory of 1848	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1848	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1848	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1848	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1848	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1848	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1848	1284	rundll32.exe	rundll32.exe
PID 1848 wrote to memory of 692	1848	rundll32.exe	explorer.exe
PID 1848 wrote to memory of 692	1848	rundll32.exe	explorer.exe
PID 1848 wrote to memory of 692	1848	rundll32.exe	explorer.exe
PID 1848 wrote to memory of 692	1848	rundll32.exe	explorer.exe
PID 1848 wrote to memory of 692	1848	rundll32.exe	explorer.exe
PID 1848 wrote to memory of 692	1848	rundll32.exe	explorer.exe
PID 692 wrote to memory of 1480	692	explorer.exe	schtasks.exe
PID 692 wrote to memory of 1480	692	explorer.exe	schtasks.exe
PID 692 wrote to memory of 1480	692	explorer.exe	schtasks.exe
PID 692 wrote to memory of 1480	692	explorer.exe	schtasks.exe
PID 1192 wrote to memory of 1012	1192	taskeng.exe	regsvr32.exe
PID 1192 wrote to memory of 1012	1192	taskeng.exe	regsvr32.exe
PID 1192 wrote to memory of 1012	1192	taskeng.exe	regsvr32.exe
PID 1192 wrote to memory of 1012	1192	taskeng.exe	regsvr32.exe
PID 1192 wrote to memory of 1012	1192	taskeng.exe	regsvr32.exe
PID 1012 wrote to memory of 872	1012	regsvr32.exe	regsvr32.exe
PID 1012 wrote to memory of 872	1012	regsvr32.exe	regsvr32.exe
PID 1012 wrote to memory of 872	1012	regsvr32.exe	regsvr32.exe
PID 1012 wrote to memory of 872	1012	regsvr32.exe	regsvr32.exe
PID 1012 wrote to memory of 872	1012	regsvr32.exe	regsvr32.exe
PID 1012 wrote to memory of 872	1012	regsvr32.exe	regsvr32.exe
PID 1012 wrote to memory of 872	1012	regsvr32.exe	regsvr32.exe
PID 872 wrote to memory of 1600	872	regsvr32.exe	explorer.exe
PID 872 wrote to memory of 1600	872	regsvr32.exe	explorer.exe
PID 872 wrote to memory of 1600	872	regsvr32.exe	explorer.exe
PID 872 wrote to memory of 1600	872	regsvr32.exe	explorer.exe
PID 872 wrote to memory of 1600	872	regsvr32.exe	explorer.exe
PID 872 wrote to memory of 1600	872	regsvr32.exe	explorer.exe
PID 1600 wrote to memory of 1744	1600	explorer.exe	reg.exe
PID 1600 wrote to memory of 1744	1600	explorer.exe	reg.exe
PID 1600 wrote to memory of 1744	1600	explorer.exe	reg.exe
PID 1600 wrote to memory of 1744	1600	explorer.exe	reg.exe
PID 1600 wrote to memory of 384	1600	explorer.exe	reg.exe
PID 1600 wrote to memory of 384	1600	explorer.exe	reg.exe
PID 1600 wrote to memory of 384	1600	explorer.exe	reg.exe
PID 1600 wrote to memory of 384	1600	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ec97bf14e6897b8ecbff00cb58147374b922268c620210ff5fb5388333ecf45.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ec97bf14e6897b8ecbff00cb58147374b922268c620210ff5fb5388333ecf45.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:692

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn asgbwouupo /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\0ec97bf14e6897b8ecbff00cb58147374b922268c620210ff5fb5388333ecf45.dll\"" /SC ONCE /Z /ST 13:02 /ET 13:14
4⤵
- Creates scheduled task(s)
PID:1480

C:\Windows\system32\taskeng.exe
taskeng.exe {95AFAD6D-6E48-4683-80C9-3656D64F0F36} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\0ec97bf14e6897b8ecbff00cb58147374b922268c620210ff5fb5388333ecf45.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1012

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\0ec97bf14e6897b8ecbff00cb58147374b922268c620210ff5fb5388333ecf45.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:872

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Uxvsuxeeywv" /d "0"
5⤵
PID:1744

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Zyzbyhtt" /d "0"
5⤵
PID:384

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0ec97bf14e6897b8ecbff00cb58147374b922268c620210ff5fb5388333ecf45.dll
MD5
5bbcf23f5cd1f796b5ac850983695553

SHA1
d54bb91c500d127c0a098c34ffbd1049d08757f5

SHA256
0ec97bf14e6897b8ecbff00cb58147374b922268c620210ff5fb5388333ecf45

SHA512
395a595eed9928b68849915e9b0db5c3aadd65b44e8a7bfcbcbefece993b67efbac89610c2269a06d3196afe6bd281a325a02d7831b5ef99b54e2423a20c2959

Download Submit
\Users\Admin\AppData\Local\Temp\0ec97bf14e6897b8ecbff00cb58147374b922268c620210ff5fb5388333ecf45.dll
MD5
5bbcf23f5cd1f796b5ac850983695553

SHA1
d54bb91c500d127c0a098c34ffbd1049d08757f5

SHA256
0ec97bf14e6897b8ecbff00cb58147374b922268c620210ff5fb5388333ecf45

SHA512
395a595eed9928b68849915e9b0db5c3aadd65b44e8a7bfcbcbefece993b67efbac89610c2269a06d3196afe6bd281a325a02d7831b5ef99b54e2423a20c2959

Download Submit
memory/384-88-0x0000000000000000-mapping.dmp

Download
memory/692-65-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/692-70-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/692-68-0x00000000742B1000-0x00000000742B3000-memory.dmp

Filesize
8KB

Download
memory/692-66-0x0000000000000000-mapping.dmp

Download
memory/872-78-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/872-80-0x0000000000260000-0x0000000000281000-memory.dmp

Filesize
132KB

Download
memory/872-89-0x0000000000260000-0x0000000000281000-memory.dmp

Filesize
132KB

Download
memory/872-82-0x0000000000260000-0x0000000000281000-memory.dmp

Filesize
132KB

Download
memory/872-81-0x0000000000260000-0x0000000000281000-memory.dmp

Filesize
132KB

Download
memory/872-79-0x0000000000260000-0x0000000000281000-memory.dmp

Filesize
132KB

Download
memory/872-77-0x0000000000AA0000-0x0000000000B24000-memory.dmp

Filesize
528KB

Download
memory/872-74-0x0000000000000000-mapping.dmp

Download
memory/1012-72-0x000007FEFB781000-0x000007FEFB783000-memory.dmp

Filesize
8KB

Download
memory/1012-71-0x0000000000000000-mapping.dmp

Download
memory/1480-69-0x0000000000000000-mapping.dmp

Download
memory/1600-84-0x0000000000000000-mapping.dmp

Download
memory/1600-90-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/1744-87-0x0000000000000000-mapping.dmp

Download
memory/1848-57-0x00000000003A0000-0x0000000000424000-memory.dmp

Filesize
528KB

Download
memory/1848-61-0x00000000004F0000-0x0000000000511000-memory.dmp

Filesize
132KB

Download
memory/1848-62-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/1848-60-0x00000000004F0000-0x0000000000511000-memory.dmp

Filesize
132KB

Download
memory/1848-63-0x00000000004A0000-0x00000000004C1000-memory.dmp

Filesize
132KB

Download
memory/1848-55-0x0000000000000000-mapping.dmp

Download
memory/1848-59-0x00000000004F0000-0x0000000000511000-memory.dmp

Filesize
132KB

Download
memory/1848-56-0x0000000075421000-0x0000000075423000-memory.dmp

Filesize
8KB

Download
memory/1848-64-0x00000000004F0000-0x0000000000511000-memory.dmp

Filesize
132KB

Download
memory/1848-58-0x00000000004F0000-0x0000000000511000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads