qakbot | 22f345ba27d3495383c1a92887b4f326be7a2c2dc5e8a5cc7941fbc8f6e3b2fa

General

Target

6.png.dll
Size

680KB
MD5

323dcf59cfca1412a4856d05fbd5a086
SHA1

8cec7202dc5f3f4c7959e59f03bee5044e31427e
SHA256

22f345ba27d3495383c1a92887b4f326be7a2c2dc5e8a5cc7941fbc8f6e3b2fa
SHA512

31314eeff7180a3ffff468183240015098cfbf0ec299c4d975e3456ddd111372016851faccbcaf164fabafa55c9983e747cc53c0e5730ac7c3a88f39dcfd8913

Score

10^/10

qakbot cullinan 1639988898 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639988898

C2

32.221.229.7:443

140.82.49.12:443

24.152.219.253:995

182.56.99.126:443

76.169.147.192:32103

218.101.110.3:995

89.101.97.139:443

82.152.39.39:443

176.24.150.197:443

96.37.113.36:993

68.186.192.69:443

59.88.168.108:443

75.110.250.187:443

182.191.92.203:995

89.165.88.95:443

103.142.10.177:443

45.9.20.200:2211

24.95.61.62:443

194.36.28.26:443

78.101.82.198:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2024 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

940 schtasks.exe

pid	process
2024	regsvr32.exe

pid	process
940	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vkcqyzlcuoil	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vkcqyzlcuoil\c43400a7 = f302c3c28c80d8e89dbdcbeec28a0bb1167655f9cd4d40bc72c712e19352f54905a8eebf95	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vkcqyzlcuoil\1802848 = 53c401f39a46f706d61f6c8fadad5696b7087b4c6f0ca12f1b9b4b52ec55c63c25f6d1775cafe3daadb9a297a6fb131a0dd6dbd3e2b81795ffc66b20a321060ff62ebc0a3ea1adda05d044a2fa71fe3a211ef8872f48b96d4b40f5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vkcqyzlcuoil\c67520db = b349f5d90cc41f7997257b3750c114a737c83466b4be53909d9f9b22daa0dcfe3ff48ebed3f91dbf6b08083b94155867f26cdb74dd776c2b76ad6924bc2c6512e0f62e64cf4bdc8500	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vkcqyzlcuoil\341ff806 = f44d3737a3b7b7018d4b7a9c9f8b65fac5458e29142c28907d9f79e69fed5435669b0b2e406870b869cd1516e58479ddc760f154a5d52ffe0ea982300b39ebf7964d480b5e4937f40df28b1c0cbc107a48df4adbba1680a3ed1042a9215d10a2e642318e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vkcqyzlcuoil\4b5697f0 = c5a5ddbafe3c74851d8e5aca964cfeaeeb2335ffde17f1da64758342c8930496172630c121522f7ae2711ed4bdf0230f9e5607125e1ab6710579be2e3a449430aea2b5c52e7b4243638281	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vkcqyzlcuoil\4b5697f0 = c5a5cabafe3c4159dcf9301237f2fa75b21e4865b3d682757d8ff1ab0730f06ce3aa2341a92e79347ae9fd7328d2894af7938498283d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vkcqyzlcuoil\7ec947be = 3d50f04e7aa250f4a27f96eec422a29a3d9815e587d41198cd408b0cd0c472aa931794d7d5424f39575ab802943acd643971a6fbd355d7bcb2d4a7488afdb7b2fdf2a50b303dc865143aac9fac171d10f2465e68587ddf098a4d25e1b44f495e7fd862aab760ccc76d34d4200e650df740a589840048cdde4bb67b4d1310763f621a2eb5e097e78435e70670bf0d28d86eb9be85a3a5a7e3e6ec889b6fc5776fed4fdf334f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vkcqyzlcuoil\7c8867c2 = 386a74fb4f0a583e996c4862ff54e16902f11bb1481bfb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Vkcqyzlcuoil\b93c4f2d = 1a80b9a7ec62a1464d8fe430c9d30216931e55c95ec17e4eede8468097b167bf48ffad6edbafbdb1be5b	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1916 regsvr32.exe
2024 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1916 regsvr32.exe
2024 regsvr32.exe

pid	process
1916	regsvr32.exe
2024	regsvr32.exe

pid	process
1916	regsvr32.exe
2024	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1788 wrote to memory of 1916	1788	regsvr32.exe	regsvr32.exe
PID 1788 wrote to memory of 1916	1788	regsvr32.exe	regsvr32.exe
PID 1788 wrote to memory of 1916	1788	regsvr32.exe	regsvr32.exe
PID 1788 wrote to memory of 1916	1788	regsvr32.exe	regsvr32.exe
PID 1788 wrote to memory of 1916	1788	regsvr32.exe	regsvr32.exe
PID 1788 wrote to memory of 1916	1788	regsvr32.exe	regsvr32.exe
PID 1788 wrote to memory of 1916	1788	regsvr32.exe	regsvr32.exe
PID 1916 wrote to memory of 544	1916	regsvr32.exe	explorer.exe
PID 1916 wrote to memory of 544	1916	regsvr32.exe	explorer.exe
PID 1916 wrote to memory of 544	1916	regsvr32.exe	explorer.exe
PID 1916 wrote to memory of 544	1916	regsvr32.exe	explorer.exe
PID 1916 wrote to memory of 544	1916	regsvr32.exe	explorer.exe
PID 1916 wrote to memory of 544	1916	regsvr32.exe	explorer.exe
PID 544 wrote to memory of 940	544	explorer.exe	schtasks.exe
PID 544 wrote to memory of 940	544	explorer.exe	schtasks.exe
PID 544 wrote to memory of 940	544	explorer.exe	schtasks.exe
PID 544 wrote to memory of 940	544	explorer.exe	schtasks.exe
PID 1328 wrote to memory of 1680	1328	taskeng.exe	regsvr32.exe
PID 1328 wrote to memory of 1680	1328	taskeng.exe	regsvr32.exe
PID 1328 wrote to memory of 1680	1328	taskeng.exe	regsvr32.exe
PID 1328 wrote to memory of 1680	1328	taskeng.exe	regsvr32.exe
PID 1328 wrote to memory of 1680	1328	taskeng.exe	regsvr32.exe
PID 1680 wrote to memory of 2024	1680	regsvr32.exe	regsvr32.exe
PID 1680 wrote to memory of 2024	1680	regsvr32.exe	regsvr32.exe
PID 1680 wrote to memory of 2024	1680	regsvr32.exe	regsvr32.exe
PID 1680 wrote to memory of 2024	1680	regsvr32.exe	regsvr32.exe
PID 1680 wrote to memory of 2024	1680	regsvr32.exe	regsvr32.exe
PID 1680 wrote to memory of 2024	1680	regsvr32.exe	regsvr32.exe
PID 1680 wrote to memory of 2024	1680	regsvr32.exe	regsvr32.exe
PID 2024 wrote to memory of 1148	2024	regsvr32.exe	explorer.exe
PID 2024 wrote to memory of 1148	2024	regsvr32.exe	explorer.exe
PID 2024 wrote to memory of 1148	2024	regsvr32.exe	explorer.exe
PID 2024 wrote to memory of 1148	2024	regsvr32.exe	explorer.exe
PID 2024 wrote to memory of 1148	2024	regsvr32.exe	explorer.exe
PID 2024 wrote to memory of 1148	2024	regsvr32.exe	explorer.exe
PID 1148 wrote to memory of 1696	1148	explorer.exe	reg.exe
PID 1148 wrote to memory of 1696	1148	explorer.exe	reg.exe
PID 1148 wrote to memory of 1696	1148	explorer.exe	reg.exe
PID 1148 wrote to memory of 1696	1148	explorer.exe	reg.exe
PID 1148 wrote to memory of 1792	1148	explorer.exe	reg.exe
PID 1148 wrote to memory of 1792	1148	explorer.exe	reg.exe
PID 1148 wrote to memory of 1792	1148	explorer.exe	reg.exe
PID 1148 wrote to memory of 1792	1148	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6.png.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\6.png.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn frgggvw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\6.png.dll\"" /SC ONCE /Z /ST 13:13 /ET 13:25
4⤵
- Creates scheduled task(s)
PID:940

C:\Windows\system32\taskeng.exe
taskeng.exe {6CB32C0F-540D-48F5-92F2-9C695F676EE6} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\6.png.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\6.png.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Xknlguepajyx" /d "0"
5⤵
PID:1696

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ygfiuo" /d "0"
5⤵
PID:1792

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6.png.dll
MD5
323dcf59cfca1412a4856d05fbd5a086

SHA1
8cec7202dc5f3f4c7959e59f03bee5044e31427e

SHA256
22f345ba27d3495383c1a92887b4f326be7a2c2dc5e8a5cc7941fbc8f6e3b2fa

SHA512
31314eeff7180a3ffff468183240015098cfbf0ec299c4d975e3456ddd111372016851faccbcaf164fabafa55c9983e747cc53c0e5730ac7c3a88f39dcfd8913

Download Submit
\Users\Admin\AppData\Local\Temp\6.png.dll
MD5
323dcf59cfca1412a4856d05fbd5a086

SHA1
8cec7202dc5f3f4c7959e59f03bee5044e31427e

SHA256
22f345ba27d3495383c1a92887b4f326be7a2c2dc5e8a5cc7941fbc8f6e3b2fa

SHA512
31314eeff7180a3ffff468183240015098cfbf0ec299c4d975e3456ddd111372016851faccbcaf164fabafa55c9983e747cc53c0e5730ac7c3a88f39dcfd8913

Download Submit
memory/544-64-0x0000000000350000-0x0000000000371000-memory.dmp

Filesize
132KB

Download
memory/544-59-0x0000000000380000-0x0000000000382000-memory.dmp

Filesize
8KB

Download
memory/544-60-0x0000000000000000-mapping.dmp

Download
memory/544-62-0x0000000074331000-0x0000000074333000-memory.dmp

Filesize
8KB

Download
memory/940-63-0x0000000000000000-mapping.dmp

Download
memory/1148-77-0x0000000000310000-0x0000000000331000-memory.dmp

Filesize
132KB

Download
memory/1148-72-0x0000000000000000-mapping.dmp

Download
memory/1680-65-0x0000000000000000-mapping.dmp

Download
memory/1696-75-0x0000000000000000-mapping.dmp

Download
memory/1788-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/1792-76-0x0000000000000000-mapping.dmp

Download
memory/1916-58-0x0000000010000000-0x000000001010D000-memory.dmp

Filesize
1.1MB

Download
memory/1916-57-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1916-56-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1916-55-0x0000000000000000-mapping.dmp

Download
memory/2024-68-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads