qakbot | 572c9105266e1390706b72023ad785e461fd8d908e4ca04e7e7599bd3fab12fc

General

Target

oel1.ocx.dll
Size

694KB
MD5

c9ae9aeb3efdf16c273d7631715255b7
SHA1

1fa1055cf79240644e5dba166e20c537e8828e4f
SHA256

572c9105266e1390706b72023ad785e461fd8d908e4ca04e7e7599bd3fab12fc
SHA512

e288bba8d0c2c97743ac83dc46ab7dfc16cb7b636fce305ae4010b5f6c9a3a40c06ab690a21205a3134a93442c3adf04a1893b9c9cfee38e9fe2a631dd86f8b8

Score

10^/10

qakbot cullinan 1639988898 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639988898

C2

32.221.229.7:443

140.82.49.12:443

24.152.219.253:995

182.56.99.126:443

76.169.147.192:32103

218.101.110.3:995

89.101.97.139:443

82.152.39.39:443

176.24.150.197:443

96.37.113.36:993

68.186.192.69:443

59.88.168.108:443

75.110.250.187:443

182.191.92.203:995

89.165.88.95:443

103.142.10.177:443

45.9.20.200:2211

24.95.61.62:443

194.36.28.26:443

78.101.82.198:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1184 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

804 schtasks.exe

pid	process
1184	regsvr32.exe

pid	process
804	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fdczhegghcabe\34546ea3 = fedc62596661231c32e222812c3ca4dd795b3ae450384d0a25ffc759381a55cce5af1210df912c6eb76156cf1535f373a71d0665e164	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fdczhegghcabe\1cbbeed = 6c8523fe97c6bbcd10b3340515b15b5d25daa21527dbb73e9405e433809ec3899c8967d3a107fe9b868f3afe8a17472c7012602664016dc01e4dd9ea2e7fd200eae19afca09805725b2dadfb5ec5e22f6bbd1f56328315c4278c7e4d9934460f3401e34ff6238bb4d8d970a1137462a69c27d59f308277300b4553948cd6d4e50212a2f60a16	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fdczhegghcabe\bb36f9f4 = 9ee52c727f4f5ae5a826161e6b7a9e2ee02f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fdczhegghcabe\7e82d11b = a21ef036969d982b10319f8a71fe673055c1a1a06446b4b4e466a9fae009a0cdab0b1201064bc0456491144b3cfc135a930114dabc0cc88a9d78d24b0ac7a3d693e0cbad28f9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fdczhegghcabe\b977d988 = 77e6ad1c03ea08716acab2ffb1c868a5599d497aba549c7c5c5b655dfd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fdczhegghcabe\4b1d0155 = ca89d27013f8f09252fe74a01a674f30ba6dcd051d487b02624120920bc087cd2886ad81f4bea4ad97c7b44375b9345feb5ae6c425af69c992f41db20f16ec57858c2a9fabd6b14693dd7621d3b9c14db03c	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fdczhegghcabe	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fdczhegghcabe\34546ea3 = fedc755966611616fe69d504c0ea59ea5e7063a57fa87246841b120424e887cdcf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fdczhegghcabe\38a9e91 = a7ddcd5bfaff0fa7139a59c0a04dc81968332dd780e7ec49fa72fb0baf98789b4199ddc7c36293190acc70dd4150435cc50793	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Fdczhegghcabe\c63eb67e = f4ee7fa5e87e243f7ec6d4f127dbf9ae4f30d4cc55d8adbeb76f15e8925208579f7ebcab5261e90c3577ce4d7881f16f9ceeda9e2d275eb67c9f8ad7805664d734b9f62723d7eb181632f80eba8ed597220dacd2d46b83d215f2e77a26d5c2b34ca9170faa015adfb61bcad20753c6ef	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1532 regsvr32.exe
1184 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1532 regsvr32.exe
1184 regsvr32.exe

pid	process
1532	regsvr32.exe
1184	regsvr32.exe

pid	process
1532	regsvr32.exe
1184	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1412 wrote to memory of 1532	1412	regsvr32.exe	regsvr32.exe
PID 1412 wrote to memory of 1532	1412	regsvr32.exe	regsvr32.exe
PID 1412 wrote to memory of 1532	1412	regsvr32.exe	regsvr32.exe
PID 1412 wrote to memory of 1532	1412	regsvr32.exe	regsvr32.exe
PID 1412 wrote to memory of 1532	1412	regsvr32.exe	regsvr32.exe
PID 1412 wrote to memory of 1532	1412	regsvr32.exe	regsvr32.exe
PID 1412 wrote to memory of 1532	1412	regsvr32.exe	regsvr32.exe
PID 1532 wrote to memory of 336	1532	regsvr32.exe	explorer.exe
PID 1532 wrote to memory of 336	1532	regsvr32.exe	explorer.exe
PID 1532 wrote to memory of 336	1532	regsvr32.exe	explorer.exe
PID 1532 wrote to memory of 336	1532	regsvr32.exe	explorer.exe
PID 1532 wrote to memory of 336	1532	regsvr32.exe	explorer.exe
PID 1532 wrote to memory of 336	1532	regsvr32.exe	explorer.exe
PID 336 wrote to memory of 804	336	explorer.exe	schtasks.exe
PID 336 wrote to memory of 804	336	explorer.exe	schtasks.exe
PID 336 wrote to memory of 804	336	explorer.exe	schtasks.exe
PID 336 wrote to memory of 804	336	explorer.exe	schtasks.exe
PID 1684 wrote to memory of 1504	1684	taskeng.exe	regsvr32.exe
PID 1684 wrote to memory of 1504	1684	taskeng.exe	regsvr32.exe
PID 1684 wrote to memory of 1504	1684	taskeng.exe	regsvr32.exe
PID 1684 wrote to memory of 1504	1684	taskeng.exe	regsvr32.exe
PID 1684 wrote to memory of 1504	1684	taskeng.exe	regsvr32.exe
PID 1504 wrote to memory of 1184	1504	regsvr32.exe	regsvr32.exe
PID 1504 wrote to memory of 1184	1504	regsvr32.exe	regsvr32.exe
PID 1504 wrote to memory of 1184	1504	regsvr32.exe	regsvr32.exe
PID 1504 wrote to memory of 1184	1504	regsvr32.exe	regsvr32.exe
PID 1504 wrote to memory of 1184	1504	regsvr32.exe	regsvr32.exe
PID 1504 wrote to memory of 1184	1504	regsvr32.exe	regsvr32.exe
PID 1504 wrote to memory of 1184	1504	regsvr32.exe	regsvr32.exe
PID 1184 wrote to memory of 1856	1184	regsvr32.exe	explorer.exe
PID 1184 wrote to memory of 1856	1184	regsvr32.exe	explorer.exe
PID 1184 wrote to memory of 1856	1184	regsvr32.exe	explorer.exe
PID 1184 wrote to memory of 1856	1184	regsvr32.exe	explorer.exe
PID 1184 wrote to memory of 1856	1184	regsvr32.exe	explorer.exe
PID 1184 wrote to memory of 1856	1184	regsvr32.exe	explorer.exe
PID 1856 wrote to memory of 1744	1856	explorer.exe	reg.exe
PID 1856 wrote to memory of 1744	1856	explorer.exe	reg.exe
PID 1856 wrote to memory of 1744	1856	explorer.exe	reg.exe
PID 1856 wrote to memory of 1744	1856	explorer.exe	reg.exe
PID 1856 wrote to memory of 1656	1856	explorer.exe	reg.exe
PID 1856 wrote to memory of 1656	1856	explorer.exe	reg.exe
PID 1856 wrote to memory of 1656	1856	explorer.exe	reg.exe
PID 1856 wrote to memory of 1656	1856	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\oel1.ocx.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\oel1.ocx.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:336
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cbiyfnk /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\oel1.ocx.dll\"" /SC ONCE /Z /ST 12:14 /ET 12:26
      4⤵
      Creates scheduled task(s)
      PID:804

C:\Windows\system32\taskeng.exe
taskeng.exe {0C565F0A-3453-468E-B317-BF1C0A31BCCA} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\oel1.ocx.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SysWOW64\regsvr32.exe
    -s "C:\Users\Admin\AppData\Local\Temp\oel1.ocx.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1856
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Retaivaeun" /d "0"
        5⤵
        
        PID:1744
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Wozfrzekm" /d "0"
        5⤵
        
        PID:1656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\oel1.ocx.dll

MD5
c9ae9aeb3efdf16c273d7631715255b7

SHA1
1fa1055cf79240644e5dba166e20c537e8828e4f

SHA256
572c9105266e1390706b72023ad785e461fd8d908e4ca04e7e7599bd3fab12fc

SHA512
e288bba8d0c2c97743ac83dc46ab7dfc16cb7b636fce305ae4010b5f6c9a3a40c06ab690a21205a3134a93442c3adf04a1893b9c9cfee38e9fe2a631dd86f8b8

Download Submit
\Users\Admin\AppData\Local\Temp\oel1.ocx.dll

MD5
c9ae9aeb3efdf16c273d7631715255b7

SHA1
1fa1055cf79240644e5dba166e20c537e8828e4f

SHA256
572c9105266e1390706b72023ad785e461fd8d908e4ca04e7e7599bd3fab12fc

SHA512
e288bba8d0c2c97743ac83dc46ab7dfc16cb7b636fce305ae4010b5f6c9a3a40c06ab690a21205a3134a93442c3adf04a1893b9c9cfee38e9fe2a631dd86f8b8

Download Submit
memory/336-62-0x0000000074D71000-0x0000000074D73000-memory.dmp

Filesize
8KB

Download
memory/336-64-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/336-59-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/336-60-0x0000000000000000-mapping.dmp

Download
memory/804-63-0x0000000000000000-mapping.dmp

Download
memory/1184-68-0x0000000000000000-mapping.dmp

Download
memory/1412-54-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

Filesize
8KB

Download
memory/1504-65-0x0000000000000000-mapping.dmp

Download
memory/1532-58-0x0000000010000000-0x000000001010D000-memory.dmp

Filesize
1.1MB

Download
memory/1532-57-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1532-56-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download
memory/1532-55-0x0000000000000000-mapping.dmp

Download
memory/1656-76-0x0000000000000000-mapping.dmp

Download
memory/1744-75-0x0000000000000000-mapping.dmp

Download
memory/1856-72-0x0000000000000000-mapping.dmp

Download
memory/1856-77-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads