qakbot | 09a43730c211e959383d8e63d1ab73a600ac0ea824db630c6b5389211943e24c

Analysis

max time kernel
131s
max time network
122s
platform
windows10_x64
resource
win10-en-20211208
submitted
20/12/2021, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6___.png.dll
Size 680KB
Sample211220-qemdeaafa4
SHA256 09a43730c211e959383d8e63d1ab73a600ac0ea824db630c6b5389211943e24c
MD5 4a6014d9e9fdd08bb6f4b0164552c5ca
SHA1 12942084dc2d6f838532165406ca531ac409535c
SHA512 1ba2c344c0936bcd56c75bd63c02de4ae2b694fb1efdbafbb275d4c4329356deba0f2d074cbe2a2406d1b3889d1cd1c5f24812d14d31e778f0cba502a12b1e4e
MD5 SHA1 SHA512

Score

10^/10

qakbot cullinan 1639988898 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639988898

32.221.229.7:443
140.82.49.12:443
24.152.219.253:995
182.56.99.126:443
76.169.147.192:32103
218.101.110.3:995
89.101.97.139:443
82.152.39.39:443
176.24.150.197:443
96.37.113.36:993
68.186.192.69:443
59.88.168.108:443
75.110.250.187:443
182.191.92.203:995
89.165.88.95:443
103.142.10.177:443
45.9.20.200:2211
24.95.61.62:443
194.36.28.26:443
78.101.82.198:2222
37.211.157.100:61202
70.163.1.219:443
31.215.99.73:443
103.143.8.71:6881
59.6.7.83:61200
63.153.187.104:443
14.96.79.22:61202
93.48.80.198:995
24.53.49.240:443
94.200.181.154:995
149.135.101.20:443
24.178.196.158:2222
209.210.95.228:32100
78.101.82.198:443
67.209.195.198:443
96.80.109.57:995
80.14.196.176:2222
38.70.253.226:2222
24.222.20.254:443
217.165.123.47:61200
74.15.2.252:2222
217.128.93.27:2222
102.65.38.67:443
190.73.3.148:2222
79.167.192.206:995
95.5.133.68:995
114.79.148.170:443
120.150.218.241:995
186.64.87.213:443
65.100.174.110:443
96.21.251.127:2222
136.232.34.70:443
63.143.92.99:995
136.143.11.232:443
39.49.27.10:995
111.125.245.116:995
41.228.22.180:443
217.164.247.241:2222
83.110.107.123:443
76.25.142.196:443
74.5.148.57:443
65.128.74.102:443
67.165.206.193:993
173.21.10.71:2222
71.74.12.34:443
94.60.254.81:443
23.233.146.92:443
73.151.236.31:443
79.160.207.214:443
213.120.26.24:443
89.137.52.44:443
75.188.35.168:443
109.12.111.14:443
106.51.48.170:50001
68.204.7.158:443
78.101.82.198:995
80.6.192.58:443
41.96.250.164:995
114.79.145.28:443
188.54.96.91:443
105.198.236.99:995
50.238.6.36:443
65.100.174.110:8443
70.51.134.181:2222
117.248.109.38:21
86.98.53.83:443
182.176.180.73:443
217.165.11.65:61200
103.143.8.71:995
50.237.134.22:995
187.189.86.168:443
100.1.119.41:443
2.178.67.97:61202
86.198.237.51:2222
88.253.171.236:995
73.171.4.177:443
40.134.247.125:995
72.252.201.34:995
190.39.205.165:443
187.172.146.123:443
92.167.4.71:2222
189.30.244.252:995
105.111.124.76:443
84.199.230.66:443
14.96.67.177:443
182.56.57.23:995
87.70.93.215:443
93.48.58.123:2222
73.5.119.219:443
75.169.58.229:32100
173.71.147.134:995
69.46.15.180:443
23.82.128.108:443
5.36.7.212:443
200.75.131.234:443
82.77.137.101:995
187.201.90.81:443
24.55.112.61:443
201.172.31.95:443
216.238.72.121:443
216.238.71.31:995
207.246.112.221:443
207.246.112.221:995
216.238.72.121:995
216.238.71.31:443
27.223.92.142:995
24.229.150.54:995
117.198.149.221:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Loads dropped DLL 1 IoCs

pid	Process
364	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2412	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\8fad43d6 = fb584dd50b00bd8568024f296282760664c270c033ce5e0f41fb8a75f5dfe35288b22a071838584f947c5ea9f957fd9400baacbc900a6c91eb31932b3f2a15f3cc21096254214d3f3f647c396f14b2a42d860d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\ba329398 = 05d82112dfda056df32fd9bde9e023ea08c513d5400a880f2ea4ba29860382e99d225fbe361227a95d9f3accc912ac871e9bc247dde2989349bdffe380086712cbff831705b64996837821ed6665dbcedf844d5ad2ad976fdbee105cc6d69785ced7227201eb5501f96e928320ca0c1093d9987d644a8fdfa4fc64b60f1eea63fecf9724adc1b19272fbee6429396d8033320b7945cfc4e4e61c4e6827cfae79d86fa6922d47c571d6ae8fb52559fce01181077b4ee4cff38239359995dd59b72c768b406876fcb50a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\b873b3e4 = 81f9ca0ab3545f2d7b5702d564a2baf1a083d4ee91a1e16fbe7da5bd12ab572e638f8371f9850e2fb50674332d415356cc7d1471e96ead8f500a7ef9db17c4b4516f25d5470ada0eccba4849808675a2e83d53e98b97d94fe176e49dc7e5d363141bcba2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\cfd481 = 793803b5e1452fb334a37be51036c68112303d0909be07fb8e0d2a9ed2af81c0a742430360cbbbc4c2fb4ec8359dca8ff92f8e1cb3c09fa7c716c509791f1242e7a857c634ec7bcf8a9f5d04db7aca707dfe8e32eb966fd6b3345d7fd1dbe36010f3d9d8d3a7650baec3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\28ef4fd = 12e54050c41dc657f332a5a36e359c1a8880ddb0ac692bab32015b5db2ed45d2500710753c3f40bc4e7d2118468be5450432f7f09aaf35a4ff2b53cdd94e97a69e69990dcec58264b78e08877f551c81eeff30ca537a85205ec76e7ea243535494b33e04	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\f0e42c20 = d0b625fe73e6f36ce6214930231a9ac460fe7073a7e0207f7d67ae965ff0731141195acf2f742a4de05aa7c8e4592bc489c63aabc347ca8b7132fa8da6c1776d40573ce682	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\8fad43d6 = fb585ad50b00886a9c015fee831149cc27a4a481efad795c092845f9245e8e028ef88e8f09f99af8c5f13ad7b3d914e186e63f3ca460446aaefcfab9c0b7d1bcb676789529cfbab0d3d267175a9e6ddab558a15ad8f0c5c88fc00950f5b5452fcd61b5d735dcd498	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\c57bfc6e = 5f66a9ce1935ed24bb18184c6c86a1def23fafa01061ef767956ff23b5631c593edfb1a0fe93643e409c54b4547f704c92575b132eb621cca7b4cfb10ca0686525b537cf0d0a3bd2c57971a72bda40572b9dcc7abe251db32e04c886	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\7dc79b0b = ea424a7f2173b0bb0f9f3cbd78934acb34a31deb173b2419c15d5cd96857b7d1c622	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2056	regsvr32.exe
2056	regsvr32.exe
364	regsvr32.exe
364	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2056	regsvr32.exe
364	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 2056	3208	regsvr32.exe	69
PID 3208 wrote to memory of 2056	3208	regsvr32.exe	69
PID 3208 wrote to memory of 2056	3208	regsvr32.exe	69
PID 2056 wrote to memory of 1828	2056	regsvr32.exe	70
PID 2056 wrote to memory of 1828	2056	regsvr32.exe	70
PID 2056 wrote to memory of 1828	2056	regsvr32.exe	70
PID 2056 wrote to memory of 1828	2056	regsvr32.exe	70
PID 2056 wrote to memory of 1828	2056	regsvr32.exe	70
PID 1828 wrote to memory of 2412	1828	explorer.exe	71
PID 1828 wrote to memory of 2412	1828	explorer.exe	71
PID 1828 wrote to memory of 2412	1828	explorer.exe	71
PID 3936 wrote to memory of 364	3936	regsvr32.exe	76
PID 3936 wrote to memory of 364	3936	regsvr32.exe	76
PID 3936 wrote to memory of 364	3936	regsvr32.exe	76
PID 364 wrote to memory of 1228	364	regsvr32.exe	77
PID 364 wrote to memory of 1228	364	regsvr32.exe	77
PID 364 wrote to memory of 1228	364	regsvr32.exe	77
PID 364 wrote to memory of 1228	364	regsvr32.exe	77
PID 364 wrote to memory of 1228	364	regsvr32.exe	77
PID 1228 wrote to memory of 616	1228	explorer.exe	78
PID 1228 wrote to memory of 616	1228	explorer.exe	78
PID 1228 wrote to memory of 3256	1228	explorer.exe	80
PID 1228 wrote to memory of 3256	1228	explorer.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6___.png.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6___.png.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jlmqqfwq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\6___.png.dll\"" /SC ONCE /Z /ST 12:04 /ET 12:16
      4⤵
      Creates scheduled task(s)
      PID:2412

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\6___.png.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\6___.png.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:364
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Mxloxiyktgl" /d "0"
      4⤵
      PID:616
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Brkwlvvzna" /d "0"
      4⤵
      PID:3256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-129-0x0000000000B10000-0x0000000000B11000-memory.dmp

Download

memory/1228-130-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/1828-119-0x00000000033C0000-0x00000000033E1000-memory.dmp

Download

memory/1828-121-0x00000000039B0000-0x00000000039B1000-memory.dmp

Download

memory/1828-122-0x00000000039B0000-0x00000000039B1000-memory.dmp

Download

memory/2056-117-0x0000000010000000-0x000000001010D000-memory.dmp

Download

memory/2056-116-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download