qakbot | 5293642902c17934ac5d239f3e3d78256e7d40d0467fca2c7a4ffc5556743f79

General

Target

5293642902c17934ac5d239f3e3d78256e7d40d0467fca2c7a4ffc5556743f79.dll
Size

680KB
MD5

bb96feaa236ef3d7da3ec44fd6ae2703
SHA1

81467f8b8e6a1461f536d599a8285961ed32c7a2
SHA256

5293642902c17934ac5d239f3e3d78256e7d40d0467fca2c7a4ffc5556743f79
SHA512

7f27590227e68f283678d8487e5eb952fab97ec2d365c1648aa188e7b764647898789304fb94f724eaf8ea284223e30702da9a9c11b5984424a58d369212fff0

Score

10^/10

qakbot cullinan 1639988898 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639988898

C2

32.221.229.7:443

140.82.49.12:443

24.152.219.253:995

182.56.99.126:443

76.169.147.192:32103

218.101.110.3:995

89.101.97.139:443

82.152.39.39:443

176.24.150.197:443

96.37.113.36:993

68.186.192.69:443

59.88.168.108:443

75.110.250.187:443

182.191.92.203:995

89.165.88.95:443

103.142.10.177:443

45.9.20.200:2211

24.95.61.62:443

194.36.28.26:443

78.101.82.198:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1648 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

988 schtasks.exe

pid	process
1648	regsvr32.exe

pid	process
988	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wjqzlunvd\9cffab81 = f89fa3dafd81d55862f0ebad8c50c02fbe280c25d63430bb2ee00720ef39f9f514646bbba1265783f18d65eeb575d7754bbae7566077a3095777c14201e0c47b180bf35afe2dcb7ccd4680d1778b0f29741872	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wjqzlunvd\e1f7e40b = 40eef839d69c275c08d51947b9059214f4a218415babb0c02d8a4cdd57372fc6d2ed44f07c12dacb5d98feafd8e6fb29036bc5d3e0b9df1ee4bb52ec394cbbd56b3d3bb69d1e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wjqzlunvd\594b836e = 18624d4a207129cbffe603912c7e35733f178dde3b3fca	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wjqzlunvd\6cd45320 = 6bb0f4225a17efdca3b01e39ae7e25b86111aa094984cb84845a8a288c996a5da6abb750dfc40e5d836ab5f5219ffe0b9e3de2290e75b3fc006b991014202cdb166c4319b09c0487f05d701f3f076ad006df	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wjqzlunvd\139d3cd6 = 0b0cc7d5184f50559f3d69a23c7cbd36b5c36246462433d5b63e70d745206bf856e1c1892ac7496ef95a4e682235efa9262de3206595e9d17771771e4e2eb756049f04d18a63b98dab9f52e483988624ca6a6bf64bc75f7e1c2dd3d76a8585d430dd8cba6edd17	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Wjqzlunvd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wjqzlunvd\139d3cd6 = 0b0cd0d5184f65c87ccf8a797a17907ffab79bcde288ccf93a43f711ac031c735d0a01cc6acc217efdbd240741bfd562a7e298f88ab488263b2f9d377d030e8f9cc7faa8f1b3c27fa29ec058f194c9c342c4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wjqzlunvd\2602ec98 = e393a811ddb94087cc6e32ebba493c9eb11ce335d78129cebb9dab68f4a4da10637ff0e15e7c4a19839f5b15d926610088e6f04fca65f8764c8b879181c486bf8cf6527c7b744c8907a358dc9e9f16004d1d322dca28a3aa763ca4d3505ebc2f2f4a7c14b0795511c7c9aa18fa48c2c6ee7a019c2eb5d0dfa5571ac5cea4a8a29f71dfffe740e523fb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wjqzlunvd\2443cce4 = 4f7923b4960086d6cf586301d840eb0606	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wjqzlunvd\9ebe8bfd = 6d52182b26c40cff9eda4bd56213950fd23864eda410b84b0817ef5a27252d1d45ff2a9ef5a88e985c0db8db7efda7f00a7c994eb74bb9b6b1b03293561d73c0348ff277283de02d211620af75d09e7129160e9f5391137311f9a15b5631827ee94a78fbd2052dc94733dda4000598	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1088 regsvr32.exe
1648 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1088 regsvr32.exe
1648 regsvr32.exe

pid	process
1088	regsvr32.exe
1648	regsvr32.exe

pid	process
1088	regsvr32.exe
1648	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1532 wrote to memory of 1088	1532	regsvr32.exe	regsvr32.exe
PID 1532 wrote to memory of 1088	1532	regsvr32.exe	regsvr32.exe
PID 1532 wrote to memory of 1088	1532	regsvr32.exe	regsvr32.exe
PID 1532 wrote to memory of 1088	1532	regsvr32.exe	regsvr32.exe
PID 1532 wrote to memory of 1088	1532	regsvr32.exe	regsvr32.exe
PID 1532 wrote to memory of 1088	1532	regsvr32.exe	regsvr32.exe
PID 1532 wrote to memory of 1088	1532	regsvr32.exe	regsvr32.exe
PID 1088 wrote to memory of 1256	1088	regsvr32.exe	explorer.exe
PID 1088 wrote to memory of 1256	1088	regsvr32.exe	explorer.exe
PID 1088 wrote to memory of 1256	1088	regsvr32.exe	explorer.exe
PID 1088 wrote to memory of 1256	1088	regsvr32.exe	explorer.exe
PID 1088 wrote to memory of 1256	1088	regsvr32.exe	explorer.exe
PID 1088 wrote to memory of 1256	1088	regsvr32.exe	explorer.exe
PID 1256 wrote to memory of 988	1256	explorer.exe	schtasks.exe
PID 1256 wrote to memory of 988	1256	explorer.exe	schtasks.exe
PID 1256 wrote to memory of 988	1256	explorer.exe	schtasks.exe
PID 1256 wrote to memory of 988	1256	explorer.exe	schtasks.exe
PID 1480 wrote to memory of 1852	1480	taskeng.exe	regsvr32.exe
PID 1480 wrote to memory of 1852	1480	taskeng.exe	regsvr32.exe
PID 1480 wrote to memory of 1852	1480	taskeng.exe	regsvr32.exe
PID 1480 wrote to memory of 1852	1480	taskeng.exe	regsvr32.exe
PID 1480 wrote to memory of 1852	1480	taskeng.exe	regsvr32.exe
PID 1852 wrote to memory of 1648	1852	regsvr32.exe	regsvr32.exe
PID 1852 wrote to memory of 1648	1852	regsvr32.exe	regsvr32.exe
PID 1852 wrote to memory of 1648	1852	regsvr32.exe	regsvr32.exe
PID 1852 wrote to memory of 1648	1852	regsvr32.exe	regsvr32.exe
PID 1852 wrote to memory of 1648	1852	regsvr32.exe	regsvr32.exe
PID 1852 wrote to memory of 1648	1852	regsvr32.exe	regsvr32.exe
PID 1852 wrote to memory of 1648	1852	regsvr32.exe	regsvr32.exe
PID 1648 wrote to memory of 1484	1648	regsvr32.exe	explorer.exe
PID 1648 wrote to memory of 1484	1648	regsvr32.exe	explorer.exe
PID 1648 wrote to memory of 1484	1648	regsvr32.exe	explorer.exe
PID 1648 wrote to memory of 1484	1648	regsvr32.exe	explorer.exe
PID 1648 wrote to memory of 1484	1648	regsvr32.exe	explorer.exe
PID 1648 wrote to memory of 1484	1648	regsvr32.exe	explorer.exe
PID 1484 wrote to memory of 1400	1484	explorer.exe	reg.exe
PID 1484 wrote to memory of 1400	1484	explorer.exe	reg.exe
PID 1484 wrote to memory of 1400	1484	explorer.exe	reg.exe
PID 1484 wrote to memory of 1400	1484	explorer.exe	reg.exe
PID 1484 wrote to memory of 1020	1484	explorer.exe	reg.exe
PID 1484 wrote to memory of 1020	1484	explorer.exe	reg.exe
PID 1484 wrote to memory of 1020	1484	explorer.exe	reg.exe
PID 1484 wrote to memory of 1020	1484	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5293642902c17934ac5d239f3e3d78256e7d40d0467fca2c7a4ffc5556743f79.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\5293642902c17934ac5d239f3e3d78256e7d40d0467fca2c7a4ffc5556743f79.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lgyeapeeod /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\5293642902c17934ac5d239f3e3d78256e7d40d0467fca2c7a4ffc5556743f79.dll\"" /SC ONCE /Z /ST 14:41 /ET 14:53
4⤵
- Creates scheduled task(s)
PID:988

C:\Windows\system32\taskeng.exe
taskeng.exe {8BDB6264-E00A-4D61-9E7B-05273FCA4046} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\5293642902c17934ac5d239f3e3d78256e7d40d0467fca2c7a4ffc5556743f79.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\5293642902c17934ac5d239f3e3d78256e7d40d0467fca2c7a4ffc5556743f79.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ipetyffiqbs" /d "0"
5⤵
PID:1400

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ecejjjv" /d "0"
5⤵
PID:1020

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5293642902c17934ac5d239f3e3d78256e7d40d0467fca2c7a4ffc5556743f79.dll
MD5
bb96feaa236ef3d7da3ec44fd6ae2703

SHA1
81467f8b8e6a1461f536d599a8285961ed32c7a2

SHA256
5293642902c17934ac5d239f3e3d78256e7d40d0467fca2c7a4ffc5556743f79

SHA512
7f27590227e68f283678d8487e5eb952fab97ec2d365c1648aa188e7b764647898789304fb94f724eaf8ea284223e30702da9a9c11b5984424a58d369212fff0

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\5293642902c17934ac5d239f3e3d78256e7d40d0467fca2c7a4ffc5556743f79.dll
MD5
bb96feaa236ef3d7da3ec44fd6ae2703

SHA1
81467f8b8e6a1461f536d599a8285961ed32c7a2

SHA256
5293642902c17934ac5d239f3e3d78256e7d40d0467fca2c7a4ffc5556743f79

SHA512
7f27590227e68f283678d8487e5eb952fab97ec2d365c1648aa188e7b764647898789304fb94f724eaf8ea284223e30702da9a9c11b5984424a58d369212fff0

Download Submit
memory/988-63-0x0000000000000000-mapping.dmp

Download
memory/1020-77-0x0000000000000000-mapping.dmp

Download
memory/1088-58-0x0000000010000000-0x000000001010D000-memory.dmp

Filesize
1.1MB

Download
memory/1088-57-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1088-55-0x0000000000000000-mapping.dmp

Download
memory/1088-56-0x0000000076C61000-0x0000000076C63000-memory.dmp

Filesize
8KB

Download
memory/1256-64-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1256-60-0x0000000000000000-mapping.dmp

Download
memory/1256-59-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/1256-62-0x0000000074D51000-0x0000000074D53000-memory.dmp

Filesize
8KB

Download
memory/1400-76-0x0000000000000000-mapping.dmp

Download
memory/1484-72-0x0000000000000000-mapping.dmp

Download
memory/1484-78-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1532-54-0x000007FEFC321000-0x000007FEFC323000-memory.dmp

Filesize
8KB

Download
memory/1648-68-0x0000000000000000-mapping.dmp

Download
memory/1852-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads