qakbot | a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5

General

Target

a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5.dll
Size

685KB
MD5

781823a03957354ed18496b681da67c5
SHA1

93e44480a649acce9399543967aa0d2e96e79ef3
SHA256

a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5
SHA512

f59c2e7c346f29c8ba6a56818362cb95d04b3c40abd6e4dd98d3ec59093a15f210c9f2d327d3e23570113ba45eb5359678f634b60e7027f9611777f36120bd5c

Score

10^/10

qakbot cullinan 1639988898 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639988898

C2

32.221.229.7:443

140.82.49.12:443

24.152.219.253:995

182.56.99.126:443

76.169.147.192:32103

218.101.110.3:995

89.101.97.139:443

82.152.39.39:443

176.24.150.197:443

96.37.113.36:993

68.186.192.69:443

59.88.168.108:443

75.110.250.187:443

182.191.92.203:995

89.165.88.95:443

103.142.10.177:443

45.9.20.200:2211

24.95.61.62:443

194.36.28.26:443

78.101.82.198:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3256 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

748 schtasks.exe

pid	process
3256	regsvr32.exe

pid	process
748	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iujxjfzgv\523be2c = 8e5061405e3454d56dba26f212c466794a79665afc712a93e893e2c2b58eb792e238ab25254b7218a3b7	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iujxjfzgv	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iujxjfzgv\7a6ad1da = 0ad3d6c7ab5c75edc0c0102d7b65881975e8ac5ffe0df8c873a8858570b1c8b145503c25fa925713cd4c387a1858502edb2814831c3e35b00293ad59048c5ef27db3f5445c78bae12a810bd7a0262563386e23ebd4439a2050ca50949680c94c81ffe3a8b7d30470c07c822419aca38277ca468cd9f8ca791dbec9f383d6bd5c14e8ed4a11cf4a8781285f5e24981977d792ad9e958c39f1be2cdfef3916dda8f447ea01420f13863f9e4aed6e316070c0de759542d9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iujxjfzgv\c09796c3 = 2403d9ba347071f6e38bf9d6e702f004e70aa74f8c24807e09c3278246f6ef4945b4120a5582abc77497758aebeae4d4b559d9bc305de675d4a0274a0ad0cfd0ae6b51446c9eeec88310fb5d7756	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iujxjfzgv\bd9fd949 = 9d665f56ca6ac3dcfdff1e9940ae69caeabfbb7d19c8055eee4313e6e6bb3879c22f039abb6f81b20ca76b7a2186796d4e61a7187c53556aa6e7a714558d7506304ab4f527f56bca1c501721f5dc1a151b12e06e54036d43d75b4ee6cf462f6f48859cf4fdc2a07c7f09	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iujxjfzgv\c2d6b6bf = af3db4e92362265435c23dc90b37bba8d646770cb031646d8fb223f7af6487cb5a2557b6736b454fb1be46babbcbc78d1e736ea27b5fd866dc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iujxjfzgv\30bc6e62 = dcd11a582a6628026731ff2bee8546225a0d478acd42c613ce3a9a58993e73169697491b139c1d6aee974c80af74e06ab8cd90b957c8bc04f363be4e62a1ad99776c0183d53fec1bd8d2ebc1e39bf19d659c9af5da301b486fa48c0c4f53e79d68517dc5d7622a61e625e2656d421d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iujxjfzgv\4ff50194 = 04d6b7cb28989958a3aa0710de1e135c1060617a2cf7df090ddfe23359f48b674c7a58f9df36834769d01a8bc905772c2b6858cf2fd8cf8068639e2a8f77	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iujxjfzgv\4ff50194 = 04d6a0cb2898acfa08d3c98517da33a48ac1202ef285a5eff6ca150b88bc5c6477ebf3e597c7f4fa83	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Iujxjfzgv\782bf1a6 = d71e7802191250d60d212b81f189bccf22a9617c312d70e0c5a3aac6c92a1ec6e545c5ef5b8f706744cba3	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3828 regsvr32.exe
3828 regsvr32.exe
3256 regsvr32.exe
3256 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3828 regsvr32.exe
3256 regsvr32.exe

pid	process
3828	regsvr32.exe
3828	regsvr32.exe
3256	regsvr32.exe
3256	regsvr32.exe

pid	process
3828	regsvr32.exe
3256	regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3648 wrote to memory of 3828	3648	regsvr32.exe	regsvr32.exe
PID 3648 wrote to memory of 3828	3648	regsvr32.exe	regsvr32.exe
PID 3648 wrote to memory of 3828	3648	regsvr32.exe	regsvr32.exe
PID 3828 wrote to memory of 3292	3828	regsvr32.exe	explorer.exe
PID 3828 wrote to memory of 3292	3828	regsvr32.exe	explorer.exe
PID 3828 wrote to memory of 3292	3828	regsvr32.exe	explorer.exe
PID 3828 wrote to memory of 3292	3828	regsvr32.exe	explorer.exe
PID 3828 wrote to memory of 3292	3828	regsvr32.exe	explorer.exe
PID 3292 wrote to memory of 748	3292	explorer.exe	schtasks.exe
PID 3292 wrote to memory of 748	3292	explorer.exe	schtasks.exe
PID 3292 wrote to memory of 748	3292	explorer.exe	schtasks.exe
PID 3260 wrote to memory of 3256	3260	regsvr32.exe	regsvr32.exe
PID 3260 wrote to memory of 3256	3260	regsvr32.exe	regsvr32.exe
PID 3260 wrote to memory of 3256	3260	regsvr32.exe	regsvr32.exe
PID 3256 wrote to memory of 424	3256	regsvr32.exe	explorer.exe
PID 3256 wrote to memory of 424	3256	regsvr32.exe	explorer.exe
PID 3256 wrote to memory of 424	3256	regsvr32.exe	explorer.exe
PID 3256 wrote to memory of 424	3256	regsvr32.exe	explorer.exe
PID 3256 wrote to memory of 424	3256	regsvr32.exe	explorer.exe
PID 424 wrote to memory of 652	424	explorer.exe	reg.exe
PID 424 wrote to memory of 652	424	explorer.exe	reg.exe
PID 424 wrote to memory of 356	424	explorer.exe	reg.exe
PID 424 wrote to memory of 356	424	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3292
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn tmfeeuxslg /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5.dll\"" /SC ONCE /Z /ST 12:03 /ET 12:15
      4⤵
      Creates scheduled task(s)
      PID:748

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\SysWOW64\regsvr32.exe
  -s "C:\Users\Admin\AppData\Local\Temp\a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:424
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Aptnt" /d "0"
      4⤵
      PID:652
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Yngqruhxoom" /d "0"
      4⤵
      PID:356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5.dll

MD5
781823a03957354ed18496b681da67c5

SHA1
93e44480a649acce9399543967aa0d2e96e79ef3

SHA256
a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5

SHA512
f59c2e7c346f29c8ba6a56818362cb95d04b3c40abd6e4dd98d3ec59093a15f210c9f2d327d3e23570113ba45eb5359678f634b60e7027f9611777f36120bd5c

Download Submit
\Users\Admin\AppData\Local\Temp\a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5.dll

MD5
781823a03957354ed18496b681da67c5

SHA1
93e44480a649acce9399543967aa0d2e96e79ef3

SHA256
a16598e74ed90656b79854e63d44baab1ebb6db2bb180c3ea8495095de34e9e5

SHA512
f59c2e7c346f29c8ba6a56818362cb95d04b3c40abd6e4dd98d3ec59093a15f210c9f2d327d3e23570113ba45eb5359678f634b60e7027f9611777f36120bd5c

Download Submit
memory/356-128-0x0000000000000000-mapping.dmp

Download
memory/424-131-0x0000000002E50000-0x0000000002E71000-memory.dmp

Filesize
132KB

Download
memory/424-130-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/424-129-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/424-126-0x0000000000000000-mapping.dmp

Download
memory/652-127-0x0000000000000000-mapping.dmp

Download
memory/748-120-0x0000000000000000-mapping.dmp

Download
memory/3256-124-0x0000000000000000-mapping.dmp

Download
memory/3292-122-0x00000000029F0000-0x00000000029F1000-memory.dmp

Filesize
4KB

Download
memory/3292-121-0x00000000029F0000-0x00000000029F1000-memory.dmp

Filesize
4KB

Download
memory/3292-119-0x0000000000360000-0x0000000000381000-memory.dmp

Filesize
132KB

Download
memory/3292-118-0x0000000000000000-mapping.dmp

Download
memory/3828-115-0x0000000000000000-mapping.dmp

Download
memory/3828-117-0x0000000010000000-0x000000001010D000-memory.dmp

Filesize
1.1MB

Download
memory/3828-116-0x00000000029A0000-0x00000000029A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads