qakbot | a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5

General

Target

a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5.dll
Size

685KB
MD5

781823a03957354ed18496b681da67c5
SHA1

93e44480a649acce9399543967aa0d2e96e79ef3
SHA256

a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5
SHA512

f59c2e7c346f29c8ba6a56818362cb95d04b3c40abd6e4dd98d3ec59093a15f210c9f2d327d3e23570113ba45eb5359678f634b60e7027f9611777f36120bd5c

Score

10^/10

qakbot cullinan 1639988898 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639988898

C2

32.221.229.7:443

140.82.49.12:443

24.152.219.253:995

182.56.99.126:443

76.169.147.192:32103

218.101.110.3:995

89.101.97.139:443

82.152.39.39:443

176.24.150.197:443

96.37.113.36:993

68.186.192.69:443

59.88.168.108:443

75.110.250.187:443

182.191.92.203:995

89.165.88.95:443

103.142.10.177:443

45.9.20.200:2211

24.95.61.62:443

194.36.28.26:443

78.101.82.198:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1332 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

884 schtasks.exe

pid	process
1332	regsvr32.exe

pid	process
884	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zwctgmsnv\60afbf68 = 1e1cefc7b080b3c316ef7f4b14e880c1d08a7f77a17625d432aa4d7370c3687f340d9f922cf292f3890706ff4cc7e780a147d22efacc3f154554	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zwctgmsnv\55306f26 = f3bd19cffdaef3260c5979ca82d841e1c98ba8adb1977d39ac897fd674dab452266ccf6654cec27f2197a01fb24494770b08835d4a693f0dcc8f88e92e38d67ec8623ee40e4a871828645230e4e5a4db98aa3b1113d20a3f76838a38fe1e0632c1fa2446b5bd435ef552fe9be1fb95d1d259f2fd35	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zwctgmsnv\92c567b5 = 59280cabf31b0b150d1cb75c454a0403ef363d21cf42e1999b18f1aa6aefcfb02ec54c98c2c054e4bf4fdd62e023f9680123fa3893be5128	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zwctgmsnv\ed8c0843 = a0423ce015bd9bc60ff176a157488d2176bbcc692b0a0f8123bc7e2bd8e6be2378160105e955	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zwctgmsnv\60afbf68 = 1e1cf8c7b080861ec7a6b1b4886ca4dfcaae36ec99b6cd4d922557abf8e874cad8ad16354ee149906332d28ff1af761cde9621bfd186f5257e74c52aa9cebeeb529a431278771beeac3771926607ef	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Zwctgmsnv	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zwctgmsnv\57714f5a = a7c1beae5f3f2089a4b6f1d56688	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zwctgmsnv\efcd283f = d329b48f4a44d981b10a1743200d7d4355249aca05e609e716aa0778665bd5551ec1d9995110ae63d12ff5b6234aef769e0657884447f3542118c43d4ede8843d14f97f1ba7ae77691b9a8b069154520287bb267468a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zwctgmsnv\2a7900d0 = 487351dff010112011fa142d119a3a006bff78585874c7ff519e0a503ff3f093b2720833ce693b355d2c49b092a5933af6bb9b49fb548134575c69bf6d0cd031776816c1af03	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Zwctgmsnv\1fe6d09e = 73e0cd85a4ffe39db891a8f16154f55b1f03dad66f155d7272311dff8fea22e7d58d1791db47ad76b9257b42	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1564 regsvr32.exe
1332 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1564 regsvr32.exe
1332 regsvr32.exe

pid	process
1564	regsvr32.exe
1332	regsvr32.exe

pid	process
1564	regsvr32.exe
1332	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1528 wrote to memory of 1564	1528	regsvr32.exe	regsvr32.exe
PID 1528 wrote to memory of 1564	1528	regsvr32.exe	regsvr32.exe
PID 1528 wrote to memory of 1564	1528	regsvr32.exe	regsvr32.exe
PID 1528 wrote to memory of 1564	1528	regsvr32.exe	regsvr32.exe
PID 1528 wrote to memory of 1564	1528	regsvr32.exe	regsvr32.exe
PID 1528 wrote to memory of 1564	1528	regsvr32.exe	regsvr32.exe
PID 1528 wrote to memory of 1564	1528	regsvr32.exe	regsvr32.exe
PID 1564 wrote to memory of 592	1564	regsvr32.exe	explorer.exe
PID 1564 wrote to memory of 592	1564	regsvr32.exe	explorer.exe
PID 1564 wrote to memory of 592	1564	regsvr32.exe	explorer.exe
PID 1564 wrote to memory of 592	1564	regsvr32.exe	explorer.exe
PID 1564 wrote to memory of 592	1564	regsvr32.exe	explorer.exe
PID 1564 wrote to memory of 592	1564	regsvr32.exe	explorer.exe
PID 592 wrote to memory of 884	592	explorer.exe	schtasks.exe
PID 592 wrote to memory of 884	592	explorer.exe	schtasks.exe
PID 592 wrote to memory of 884	592	explorer.exe	schtasks.exe
PID 592 wrote to memory of 884	592	explorer.exe	schtasks.exe
PID 1544 wrote to memory of 1404	1544	taskeng.exe	regsvr32.exe
PID 1544 wrote to memory of 1404	1544	taskeng.exe	regsvr32.exe
PID 1544 wrote to memory of 1404	1544	taskeng.exe	regsvr32.exe
PID 1544 wrote to memory of 1404	1544	taskeng.exe	regsvr32.exe
PID 1544 wrote to memory of 1404	1544	taskeng.exe	regsvr32.exe
PID 1404 wrote to memory of 1332	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1332	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1332	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1332	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1332	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1332	1404	regsvr32.exe	regsvr32.exe
PID 1404 wrote to memory of 1332	1404	regsvr32.exe	regsvr32.exe
PID 1332 wrote to memory of 1208	1332	regsvr32.exe	explorer.exe
PID 1332 wrote to memory of 1208	1332	regsvr32.exe	explorer.exe
PID 1332 wrote to memory of 1208	1332	regsvr32.exe	explorer.exe
PID 1332 wrote to memory of 1208	1332	regsvr32.exe	explorer.exe
PID 1332 wrote to memory of 1208	1332	regsvr32.exe	explorer.exe
PID 1332 wrote to memory of 1208	1332	regsvr32.exe	explorer.exe
PID 1208 wrote to memory of 1976	1208	explorer.exe	reg.exe
PID 1208 wrote to memory of 1976	1208	explorer.exe	reg.exe
PID 1208 wrote to memory of 1976	1208	explorer.exe	reg.exe
PID 1208 wrote to memory of 1976	1208	explorer.exe	reg.exe
PID 1208 wrote to memory of 832	1208	explorer.exe	reg.exe
PID 1208 wrote to memory of 832	1208	explorer.exe	reg.exe
PID 1208 wrote to memory of 832	1208	explorer.exe	reg.exe
PID 1208 wrote to memory of 832	1208	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1564

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn eysbgohooc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5.dll\"" /SC ONCE /Z /ST 20:02 /ET 20:14
4⤵
- Creates scheduled task(s)
PID:884

C:\Windows\system32\taskeng.exe
taskeng.exe {45F693B0-B25E-47C4-8799-7413179AFE55} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ayequprahm" /d "0"
5⤵
PID:1976

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Rtmik" /d "0"
5⤵
PID:832

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5.dll
MD5
781823a03957354ed18496b681da67c5

SHA1
93e44480a649acce9399543967aa0d2e96e79ef3

SHA256
a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5

SHA512
f59c2e7c346f29c8ba6a56818362cb95d04b3c40abd6e4dd98d3ec59093a15f210c9f2d327d3e23570113ba45eb5359678f634b60e7027f9611777f36120bd5c

Download Submit
\Users\Admin\AppData\Local\Temp\a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5.dll
MD5
781823a03957354ed18496b681da67c5

SHA1
93e44480a649acce9399543967aa0d2e96e79ef3

SHA256
a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5

SHA512
f59c2e7c346f29c8ba6a56818362cb95d04b3c40abd6e4dd98d3ec59093a15f210c9f2d327d3e23570113ba45eb5359678f634b60e7027f9611777f36120bd5c

Download Submit
memory/592-59-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/592-60-0x0000000000000000-mapping.dmp

Download
memory/592-62-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/592-64-0x00000000000C0000-0x00000000000E1000-memory.dmp

Filesize
132KB

Download
memory/832-76-0x0000000000000000-mapping.dmp

Download
memory/884-63-0x0000000000000000-mapping.dmp

Download
memory/1208-77-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1208-72-0x0000000000000000-mapping.dmp

Download
memory/1332-68-0x0000000000000000-mapping.dmp

Download
memory/1404-65-0x0000000000000000-mapping.dmp

Download
memory/1528-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download
memory/1564-58-0x0000000010000000-0x000000001010D000-memory.dmp

Filesize
1.1MB

Download
memory/1564-57-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1564-56-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1564-55-0x0000000000000000-mapping.dmp

Download
memory/1976-75-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads