qakbot | 41e4f5fbda2ad5c78e1095883de16afd78d763dfabd7fcaa30465d322942bd5c

General

Target

6__.png.dll
Size

680KB
MD5

9145d84eb68c63694d713b88574ef3fa
SHA1

0f50484c150f74e004deef479712626bffa1bc92
SHA256

41e4f5fbda2ad5c78e1095883de16afd78d763dfabd7fcaa30465d322942bd5c
SHA512

2bcf775eee099cea1381e8dc92c2ec01cb7ca2c37db8f413eac69fdf303d613633dba7c316705ebe38aacdb39779823ad733a442ec88bb8ec41a5f33e13e5fe8

Score

10^/10

qakbot cullinan 1639988898 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639988898

C2

32.221.229.7:443

140.82.49.12:443

24.152.219.253:995

182.56.99.126:443

76.169.147.192:32103

218.101.110.3:995

89.101.97.139:443

82.152.39.39:443

176.24.150.197:443

96.37.113.36:993

68.186.192.69:443

59.88.168.108:443

75.110.250.187:443

182.191.92.203:995

89.165.88.95:443

103.142.10.177:443

45.9.20.200:2211

24.95.61.62:443

194.36.28.26:443

78.101.82.198:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3492 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2520 schtasks.exe

pid	process
3492	regsvr32.exe

pid	process
2520	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dykdoaaypkkoe	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dykdoaaypkkoe\37afbd5c = 513fb7ead58e5e8aea05f753c4f4ffef8b07edf5963597925ca6961c	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dykdoaaypkkoe\2306d12 = db6b447f1579baf00c3c9ae0b80cb85bfd3e20740b1ce0605c902b85e133e0581ba0b9218eca582b5c517a5859765deb6311484d39a7719cf387e0084a49beb0ee8520b12b9146e23cb0ed8909f60cdf20d8f98e26820056fb4841826a65b4ee133ec32197a2857ebfd385e192f5e1a986d81c429228c8efb19b2de3228aede4fcb6b752849f524c382e0fcd6987b57fead72af34d40	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dykdoaaypkkoe\ba8c0a77 = a33fc3cc62f4affb9fc21d715614f493b048ac2d5de3d8b3f7855423839b2af0851f333960452a2b2c015bc7f7f7d69ca1a8c4b854ea468ac0505a2989f376	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dykdoaaypkkoe\37afbd5c = 513fa0ead58e6bcb20aab2482dd9573116175ae9c1306911dbde0b6cafd9ac58e28fdaaae9434c0eba2c7f3d61ef2bdd1f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dykdoaaypkkoe\714d6e = 0dea61c98d101ddb319d9dc8b70480d9d13115343cbd9e1a373314e41831a1653f5fd6b0f6ce150eaaa85a05c96b45e992517b94bee6bc19332ac8524105b0c20095319d336241dc96c4f11b9908	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dykdoaaypkkoe\b8cd2a0b = fbdbedb40d0de7e54f34cba8949145fa74ba2b9d68381fa26cdee7c695b7c1e49844514800c2e7dfe67de244d0f28e1510a532a726b45dfcdfd57237c151303ca9a8afc9f298e352	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dykdoaaypkkoe\c5c56581 = b69d532fe9f13c89c5b8711685095b9e425c48e4f7d5ce5f0c427fcb90825d942a9e89e16e6ff5fe1f59bdd286f84bc9db5003a91e0be3337d97d12206195c0b46	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dykdoaaypkkoe\7d7902e4 = 3c3cb8dde710015b560670c9e5caa3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dykdoaaypkkoe\48e6d2aa = 32983610285f9c958aed7344d3d2ea2ed6cbcf5b9fb8498d2ecc81	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2720 regsvr32.exe
2720 regsvr32.exe
3492 regsvr32.exe
3492 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2720 regsvr32.exe
3492 regsvr32.exe

pid	process
2720	regsvr32.exe
2720	regsvr32.exe
3492	regsvr32.exe
3492	regsvr32.exe

pid	process
2720	regsvr32.exe
3492	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 812 wrote to memory of 2720	812	regsvr32.exe	regsvr32.exe
PID 812 wrote to memory of 2720	812	regsvr32.exe	regsvr32.exe
PID 812 wrote to memory of 2720	812	regsvr32.exe	regsvr32.exe
PID 2720 wrote to memory of 2468	2720	regsvr32.exe	explorer.exe
PID 2720 wrote to memory of 2468	2720	regsvr32.exe	explorer.exe
PID 2720 wrote to memory of 2468	2720	regsvr32.exe	explorer.exe
PID 2720 wrote to memory of 2468	2720	regsvr32.exe	explorer.exe
PID 2720 wrote to memory of 2468	2720	regsvr32.exe	explorer.exe
PID 2468 wrote to memory of 2520	2468	explorer.exe	schtasks.exe
PID 2468 wrote to memory of 2520	2468	explorer.exe	schtasks.exe
PID 2468 wrote to memory of 2520	2468	explorer.exe	schtasks.exe
PID 2728 wrote to memory of 3492	2728	regsvr32.exe	regsvr32.exe
PID 2728 wrote to memory of 3492	2728	regsvr32.exe	regsvr32.exe
PID 2728 wrote to memory of 3492	2728	regsvr32.exe	regsvr32.exe
PID 3492 wrote to memory of 700	3492	regsvr32.exe	explorer.exe
PID 3492 wrote to memory of 700	3492	regsvr32.exe	explorer.exe
PID 3492 wrote to memory of 700	3492	regsvr32.exe	explorer.exe
PID 3492 wrote to memory of 700	3492	regsvr32.exe	explorer.exe
PID 3492 wrote to memory of 700	3492	regsvr32.exe	explorer.exe
PID 700 wrote to memory of 64	700	explorer.exe	reg.exe
PID 700 wrote to memory of 64	700	explorer.exe	reg.exe
PID 700 wrote to memory of 384	700	explorer.exe	reg.exe
PID 700 wrote to memory of 384	700	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6__.png.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:812

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\6__.png.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2720

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2468

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zgurljh /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\6__.png.dll\"" /SC ONCE /Z /ST 05:04 /ET 05:16
4⤵
- Creates scheduled task(s)
PID:2520

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\6__.png.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2728

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\6__.png.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3492

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:700

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Kovaa" /d "0"
4⤵
PID:64

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Idnddiepiiu" /d "0"
4⤵
PID:384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6__.png.dll
MD5
9145d84eb68c63694d713b88574ef3fa

SHA1
0f50484c150f74e004deef479712626bffa1bc92

SHA256
41e4f5fbda2ad5c78e1095883de16afd78d763dfabd7fcaa30465d322942bd5c

SHA512
2bcf775eee099cea1381e8dc92c2ec01cb7ca2c37db8f413eac69fdf303d613633dba7c316705ebe38aacdb39779823ad733a442ec88bb8ec41a5f33e13e5fe8

Download Submit
\Users\Admin\AppData\Local\Temp\6__.png.dll
MD5
9145d84eb68c63694d713b88574ef3fa

SHA1
0f50484c150f74e004deef479712626bffa1bc92

SHA256
41e4f5fbda2ad5c78e1095883de16afd78d763dfabd7fcaa30465d322942bd5c

SHA512
2bcf775eee099cea1381e8dc92c2ec01cb7ca2c37db8f413eac69fdf303d613633dba7c316705ebe38aacdb39779823ad733a442ec88bb8ec41a5f33e13e5fe8

Download Submit
memory/64-128-0x0000000000000000-mapping.dmp

Download
memory/384-129-0x0000000000000000-mapping.dmp

Download
memory/700-127-0x0000000000000000-mapping.dmp

Download
memory/700-132-0x0000000000800000-0x0000000000821000-memory.dmp

Filesize
132KB

Download
memory/700-130-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/700-131-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/2468-120-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2468-121-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2468-122-0x0000000003490000-0x00000000034B1000-memory.dmp

Filesize
132KB

Download
memory/2468-118-0x0000000000000000-mapping.dmp

Download
memory/2520-119-0x0000000000000000-mapping.dmp

Download
memory/2720-117-0x0000000010000000-0x000000001010D000-memory.dmp

Filesize
1.1MB

Download
memory/2720-116-0x0000000000C00000-0x0000000000D4A000-memory.dmp

Filesize
1.3MB

Download
memory/2720-115-0x0000000000000000-mapping.dmp

Download
memory/3492-126-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/3492-124-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads