qakbot | 09a43730c211e959383d8e63d1ab73a600ac0ea824db630c6b5389211943e24c

General

Target

6___.png.dll
Size

680KB
MD5

4a6014d9e9fdd08bb6f4b0164552c5ca
SHA1

12942084dc2d6f838532165406ca531ac409535c
SHA256

09a43730c211e959383d8e63d1ab73a600ac0ea824db630c6b5389211943e24c
SHA512

1ba2c344c0936bcd56c75bd63c02de4ae2b694fb1efdbafbb275d4c4329356deba0f2d074cbe2a2406d1b3889d1cd1c5f24812d14d31e778f0cba502a12b1e4e

Score

10^/10

qakbot cullinan 1639988898 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639988898

C2

32.221.229.7:443

140.82.49.12:443

24.152.219.253:995

182.56.99.126:443

76.169.147.192:32103

218.101.110.3:995

89.101.97.139:443

82.152.39.39:443

176.24.150.197:443

96.37.113.36:993

68.186.192.69:443

59.88.168.108:443

75.110.250.187:443

182.191.92.203:995

89.165.88.95:443

103.142.10.177:443

45.9.20.200:2211

24.95.61.62:443

194.36.28.26:443

78.101.82.198:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

364 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2412 schtasks.exe

pid	process
364	regsvr32.exe

pid	process
2412	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\8fad43d6 = fb584dd50b00bd8568024f296282760664c270c033ce5e0f41fb8a75f5dfe35288b22a071838584f947c5ea9f957fd9400baacbc900a6c91eb31932b3f2a15f3cc21096254214d3f3f647c396f14b2a42d860d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\ba329398 = 05d82112dfda056df32fd9bde9e023ea08c513d5400a880f2ea4ba29860382e99d225fbe361227a95d9f3accc912ac871e9bc247dde2989349bdffe380086712cbff831705b64996837821ed6665dbcedf844d5ad2ad976fdbee105cc6d69785ced7227201eb5501f96e928320ca0c1093d9987d644a8fdfa4fc64b60f1eea63fecf9724adc1b19272fbee6429396d8033320b7945cfc4e4e61c4e6827cfae79d86fa6922d47c571d6ae8fb52559fce01181077b4ee4cff38239359995dd59b72c768b406876fcb50a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\b873b3e4 = 81f9ca0ab3545f2d7b5702d564a2baf1a083d4ee91a1e16fbe7da5bd12ab572e638f8371f9850e2fb50674332d415356cc7d1471e96ead8f500a7ef9db17c4b4516f25d5470ada0eccba4849808675a2e83d53e98b97d94fe176e49dc7e5d363141bcba2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\cfd481 = 793803b5e1452fb334a37be51036c68112303d0909be07fb8e0d2a9ed2af81c0a742430360cbbbc4c2fb4ec8359dca8ff92f8e1cb3c09fa7c716c509791f1242e7a857c634ec7bcf8a9f5d04db7aca707dfe8e32eb966fd6b3345d7fd1dbe36010f3d9d8d3a7650baec3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\28ef4fd = 12e54050c41dc657f332a5a36e359c1a8880ddb0ac692bab32015b5db2ed45d2500710753c3f40bc4e7d2118468be5450432f7f09aaf35a4ff2b53cdd94e97a69e69990dcec58264b78e08877f551c81eeff30ca537a85205ec76e7ea243535494b33e04	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\f0e42c20 = d0b625fe73e6f36ce6214930231a9ac460fe7073a7e0207f7d67ae965ff0731141195acf2f742a4de05aa7c8e4592bc489c63aabc347ca8b7132fa8da6c1776d40573ce682	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\8fad43d6 = fb585ad50b00886a9c015fee831149cc27a4a481efad795c092845f9245e8e028ef88e8f09f99af8c5f13ad7b3d914e186e63f3ca460446aaefcfab9c0b7d1bcb676789529cfbab0d3d267175a9e6ddab558a15ad8f0c5c88fc00950f5b5452fcd61b5d735dcd498	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\c57bfc6e = 5f66a9ce1935ed24bb18184c6c86a1def23fafa01061ef767956ff23b5631c593edfb1a0fe93643e409c54b4547f704c92575b132eb621cca7b4cfb10ca0686525b537cf0d0a3bd2c57971a72bda40572b9dcc7abe251db32e04c886	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oeoiaaxabpogx\7dc79b0b = ea424a7f2173b0bb0f9f3cbd78934acb34a31deb173b2419c15d5cd96857b7d1c622	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2056 regsvr32.exe
2056 regsvr32.exe
364 regsvr32.exe
364 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2056 regsvr32.exe
364 regsvr32.exe

pid	process
2056	regsvr32.exe
2056	regsvr32.exe
364	regsvr32.exe
364	regsvr32.exe

pid	process
2056	regsvr32.exe
364	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3208 wrote to memory of 2056	3208	regsvr32.exe	regsvr32.exe
PID 3208 wrote to memory of 2056	3208	regsvr32.exe	regsvr32.exe
PID 3208 wrote to memory of 2056	3208	regsvr32.exe	regsvr32.exe
PID 2056 wrote to memory of 1828	2056	regsvr32.exe	explorer.exe
PID 2056 wrote to memory of 1828	2056	regsvr32.exe	explorer.exe
PID 2056 wrote to memory of 1828	2056	regsvr32.exe	explorer.exe
PID 2056 wrote to memory of 1828	2056	regsvr32.exe	explorer.exe
PID 2056 wrote to memory of 1828	2056	regsvr32.exe	explorer.exe
PID 1828 wrote to memory of 2412	1828	explorer.exe	schtasks.exe
PID 1828 wrote to memory of 2412	1828	explorer.exe	schtasks.exe
PID 1828 wrote to memory of 2412	1828	explorer.exe	schtasks.exe
PID 3936 wrote to memory of 364	3936	regsvr32.exe	regsvr32.exe
PID 3936 wrote to memory of 364	3936	regsvr32.exe	regsvr32.exe
PID 3936 wrote to memory of 364	3936	regsvr32.exe	regsvr32.exe
PID 364 wrote to memory of 1228	364	regsvr32.exe	explorer.exe
PID 364 wrote to memory of 1228	364	regsvr32.exe	explorer.exe
PID 364 wrote to memory of 1228	364	regsvr32.exe	explorer.exe
PID 364 wrote to memory of 1228	364	regsvr32.exe	explorer.exe
PID 364 wrote to memory of 1228	364	regsvr32.exe	explorer.exe
PID 1228 wrote to memory of 616	1228	explorer.exe	reg.exe
PID 1228 wrote to memory of 616	1228	explorer.exe	reg.exe
PID 1228 wrote to memory of 3256	1228	explorer.exe	reg.exe
PID 1228 wrote to memory of 3256	1228	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6___.png.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3208

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\6___.png.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jlmqqfwq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\6___.png.dll\"" /SC ONCE /Z /ST 12:04 /ET 12:16
4⤵
- Creates scheduled task(s)
PID:2412

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\6___.png.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3936

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\6___.png.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:364

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Mxloxiyktgl" /d "0"
4⤵
PID:616

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Brkwlvvzna" /d "0"
4⤵
PID:3256

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6___.png.dll
MD5
4a6014d9e9fdd08bb6f4b0164552c5ca

SHA1
12942084dc2d6f838532165406ca531ac409535c

SHA256
09a43730c211e959383d8e63d1ab73a600ac0ea824db630c6b5389211943e24c

SHA512
1ba2c344c0936bcd56c75bd63c02de4ae2b694fb1efdbafbb275d4c4329356deba0f2d074cbe2a2406d1b3889d1cd1c5f24812d14d31e778f0cba502a12b1e4e

Download Submit
\Users\Admin\AppData\Local\Temp\6___.png.dll
MD5
4a6014d9e9fdd08bb6f4b0164552c5ca

SHA1
12942084dc2d6f838532165406ca531ac409535c

SHA256
09a43730c211e959383d8e63d1ab73a600ac0ea824db630c6b5389211943e24c

SHA512
1ba2c344c0936bcd56c75bd63c02de4ae2b694fb1efdbafbb275d4c4329356deba0f2d074cbe2a2406d1b3889d1cd1c5f24812d14d31e778f0cba502a12b1e4e

Download Submit
memory/364-124-0x0000000000000000-mapping.dmp

Download
memory/616-127-0x0000000000000000-mapping.dmp

Download
memory/1228-126-0x0000000000000000-mapping.dmp

Download
memory/1228-129-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/1228-130-0x0000000000520000-0x0000000000541000-memory.dmp

Filesize
132KB

Download
memory/1828-119-0x00000000033C0000-0x00000000033E1000-memory.dmp

Filesize
132KB

Download
memory/1828-121-0x00000000039B0000-0x00000000039B1000-memory.dmp

Filesize
4KB

Download
memory/1828-122-0x00000000039B0000-0x00000000039B1000-memory.dmp

Filesize
4KB

Download
memory/1828-118-0x0000000000000000-mapping.dmp

Download
memory/2056-117-0x0000000010000000-0x000000001010D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-116-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/2056-115-0x0000000000000000-mapping.dmp

Download
memory/2412-120-0x0000000000000000-mapping.dmp

Download
memory/3256-128-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads