qakbot | 09a43730c211e959383d8e63d1ab73a600ac0ea824db630c6b5389211943e24c

General

Target

6___.png.dll
Size

680KB
MD5

4a6014d9e9fdd08bb6f4b0164552c5ca
SHA1

12942084dc2d6f838532165406ca531ac409535c
SHA256

09a43730c211e959383d8e63d1ab73a600ac0ea824db630c6b5389211943e24c
SHA512

1ba2c344c0936bcd56c75bd63c02de4ae2b694fb1efdbafbb275d4c4329356deba0f2d074cbe2a2406d1b3889d1cd1c5f24812d14d31e778f0cba502a12b1e4e

Score

10^/10

qakbot cullinan 1639988898 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639988898

C2

32.221.229.7:443

140.82.49.12:443

24.152.219.253:995

182.56.99.126:443

76.169.147.192:32103

218.101.110.3:995

89.101.97.139:443

82.152.39.39:443

176.24.150.197:443

96.37.113.36:993

68.186.192.69:443

59.88.168.108:443

75.110.250.187:443

182.191.92.203:995

89.165.88.95:443

103.142.10.177:443

45.9.20.200:2211

24.95.61.62:443

194.36.28.26:443

78.101.82.198:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1648 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

872 schtasks.exe

pid	process
1648	regsvr32.exe

pid	process
872	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hmeyuyrosapote\2adc4b39 = 92075c22c41ce38d05cc57fdcf84f5d9ea5b821ac1beecd0ada148ba907582e2790f7cc1a72c684581d8bf733cace8fbbd92d50d1b2eab0ae39131ad0ca0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hmeyuyrosapote\92602c5c = 64503db9571a5421064215c8bc4bf40a58b1e01e1bfb6fac2cdb3f4e9755337ba27217007032b7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hmeyuyrosapote\559524cf = 108b0c59f2de52fc2eaa5b86cf9979e1b1293c54b4b85de63e4099eeb601325cb71a8f2d0b02dd82a25acada79756c5493be4167a42f7e0eaa69fab8a572e9db331ffd825a98806e6a40efd93dc750c3eb319b4e06a0fe2265	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Hmeyuyrosapote	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hmeyuyrosapote\d8b693e4 = 1d16e310acc8ddb47bc4d48fcbf284ccf496baf3ddf5b0f14805f6c1a799b973856ac491187f30f38e688d3f72e18a453e76c61109fff7c1032bf8d950423f1f2efcf9fd3d25c685ff2c8556bd3bad880fbd1abcdc68845097cbfcc6edd3850a67	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hmeyuyrosapote\57d404b3 = 025c0d683eeeae25bb599d614babd0da3b37d6d21aad683dc3b3a3b2319fcd235a2691107a20081a8e9c75f0c375f976f6dbe174a5db8e5a0a00bd93	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hmeyuyrosapote\a7fffc12 = a694f94109d218f8bd792d91a601a336337cd5e57e832ea00a4de71a73493d9089e49d952e624db3b66f546858b97c4540dc21ffa6d1d9eab38b7f66801c321886b11002e6916d17b4ea7523bbb06dfd36	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hmeyuyrosapote\d8b693e4 = 1d16f410acc8e8c7301780a799683043516bd26061c490f1080228c468d3d90f004a0ede942e00211fcbd5ec3c66e2f489f9f76b63e9d155ce5246fd98cab6509476124cbe3f9120453bfa44ab5d2d591ccc6cc57ae7ca38af50f1680975c64436bc2a3e74d4bcfa8574a1274135ebe1f618b26a0d78	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hmeyuyrosapote\ed2943aa = f7da6c852a74ba7a4eb6f6ddf3f092dbe35cf37c7d4ffdac6eca90d461ffd3506fb6355e351c62eb1f32ffa3d370b4df8cfd8fa7bcf20ff87b86ae124782acb710e97b50c18f4fa7f6c6e778630633d805f9096a909b10a6ccf34e791810cf3b1231f19b87286e137da05aec541e3066ae85b3a6ee09291d202b154fb8ebf88fed5edb7f7b5c4f10f35477ae0b8084	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Hmeyuyrosapote\ef6863d6 = ec4ea510c9ec30a7a122500c711413dbd6b9e2e5e08ec59b7f19fc20ea357945f8a877da3669540188514c09ba4bf972329493cdc40c9ecf0010442c39fce88dda5592f4da88f843da	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1724 regsvr32.exe
1648 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1724 regsvr32.exe
1648 regsvr32.exe

pid	process
1724	regsvr32.exe
1648	regsvr32.exe

pid	process
1724	regsvr32.exe
1648	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1796 wrote to memory of 1724	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1724	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1724	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1724	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1724	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1724	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1724	1796	regsvr32.exe	regsvr32.exe
PID 1724 wrote to memory of 1664	1724	regsvr32.exe	explorer.exe
PID 1724 wrote to memory of 1664	1724	regsvr32.exe	explorer.exe
PID 1724 wrote to memory of 1664	1724	regsvr32.exe	explorer.exe
PID 1724 wrote to memory of 1664	1724	regsvr32.exe	explorer.exe
PID 1724 wrote to memory of 1664	1724	regsvr32.exe	explorer.exe
PID 1724 wrote to memory of 1664	1724	regsvr32.exe	explorer.exe
PID 1664 wrote to memory of 872	1664	explorer.exe	schtasks.exe
PID 1664 wrote to memory of 872	1664	explorer.exe	schtasks.exe
PID 1664 wrote to memory of 872	1664	explorer.exe	schtasks.exe
PID 1664 wrote to memory of 872	1664	explorer.exe	schtasks.exe
PID 1044 wrote to memory of 1884	1044	taskeng.exe	regsvr32.exe
PID 1044 wrote to memory of 1884	1044	taskeng.exe	regsvr32.exe
PID 1044 wrote to memory of 1884	1044	taskeng.exe	regsvr32.exe
PID 1044 wrote to memory of 1884	1044	taskeng.exe	regsvr32.exe
PID 1044 wrote to memory of 1884	1044	taskeng.exe	regsvr32.exe
PID 1884 wrote to memory of 1648	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 1648	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 1648	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 1648	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 1648	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 1648	1884	regsvr32.exe	regsvr32.exe
PID 1884 wrote to memory of 1648	1884	regsvr32.exe	regsvr32.exe
PID 1648 wrote to memory of 1004	1648	regsvr32.exe	explorer.exe
PID 1648 wrote to memory of 1004	1648	regsvr32.exe	explorer.exe
PID 1648 wrote to memory of 1004	1648	regsvr32.exe	explorer.exe
PID 1648 wrote to memory of 1004	1648	regsvr32.exe	explorer.exe
PID 1648 wrote to memory of 1004	1648	regsvr32.exe	explorer.exe
PID 1648 wrote to memory of 1004	1648	regsvr32.exe	explorer.exe
PID 1004 wrote to memory of 1320	1004	explorer.exe	reg.exe
PID 1004 wrote to memory of 1320	1004	explorer.exe	reg.exe
PID 1004 wrote to memory of 1320	1004	explorer.exe	reg.exe
PID 1004 wrote to memory of 1320	1004	explorer.exe	reg.exe
PID 1004 wrote to memory of 1752	1004	explorer.exe	reg.exe
PID 1004 wrote to memory of 1752	1004	explorer.exe	reg.exe
PID 1004 wrote to memory of 1752	1004	explorer.exe	reg.exe
PID 1004 wrote to memory of 1752	1004	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6___.png.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\6___.png.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qehybfh /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\6___.png.dll\"" /SC ONCE /Z /ST 13:12 /ET 13:24
4⤵
- Creates scheduled task(s)
PID:872

C:\Windows\system32\taskeng.exe
taskeng.exe {0AE49395-D7CE-4CB0-87AF-8D654C52F6A2} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\6___.png.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\6___.png.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1004

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Hvekff" /d "0"
5⤵
PID:1320

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Sijimyc" /d "0"
5⤵
PID:1752

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6___.png.dll
MD5
4a6014d9e9fdd08bb6f4b0164552c5ca

SHA1
12942084dc2d6f838532165406ca531ac409535c

SHA256
09a43730c211e959383d8e63d1ab73a600ac0ea824db630c6b5389211943e24c

SHA512
1ba2c344c0936bcd56c75bd63c02de4ae2b694fb1efdbafbb275d4c4329356deba0f2d074cbe2a2406d1b3889d1cd1c5f24812d14d31e778f0cba502a12b1e4e

Download Submit
\Users\Admin\AppData\Local\Temp\6___.png.dll
MD5
4a6014d9e9fdd08bb6f4b0164552c5ca

SHA1
12942084dc2d6f838532165406ca531ac409535c

SHA256
09a43730c211e959383d8e63d1ab73a600ac0ea824db630c6b5389211943e24c

SHA512
1ba2c344c0936bcd56c75bd63c02de4ae2b694fb1efdbafbb275d4c4329356deba0f2d074cbe2a2406d1b3889d1cd1c5f24812d14d31e778f0cba502a12b1e4e

Download Submit
memory/872-63-0x0000000000000000-mapping.dmp

Download
memory/1004-77-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1004-72-0x0000000000000000-mapping.dmp

Download
memory/1320-75-0x0000000000000000-mapping.dmp

Download
memory/1648-68-0x0000000000000000-mapping.dmp

Download
memory/1664-64-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1664-60-0x0000000074E51000-0x0000000074E53000-memory.dmp

Filesize
8KB

Download
memory/1664-58-0x0000000000000000-mapping.dmp

Download
memory/1664-57-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/1724-61-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1724-62-0x0000000010000000-0x000000001010D000-memory.dmp

Filesize
1.1MB

Download
memory/1724-56-0x0000000076491000-0x0000000076493000-memory.dmp

Filesize
8KB

Download
memory/1724-55-0x0000000000000000-mapping.dmp

Download
memory/1752-76-0x0000000000000000-mapping.dmp

Download
memory/1796-54-0x000007FEFC451000-0x000007FEFC453000-memory.dmp

Filesize
8KB

Download
memory/1884-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads