qakbot | d7ebf4872795a274ac86598fd2cbcad77b8cf9ddf81b854d7b480901f7f3b236

General

Target

second_stage3.bin.dll
Size

665KB
MD5

f92528a71e6f367c39195d12bc9d30c4
SHA1

1d5795de9f36d216d842c79af28d7f8d245f733e
SHA256

d7ebf4872795a274ac86598fd2cbcad77b8cf9ddf81b854d7b480901f7f3b236
SHA512

f9f61831c5d3126af97ea708b4729254412705792625755348e3286f5b60f6ee6ddc2fdc518ab543afef1067b728fa26e3614daf5b86a18ec450c3eeed36cf7a

Score

10^/10

qakbot cullinan 1640084934 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640084934

C2

95.5.133.68:995

188.159.122.122:443

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

109.12.111.14:443

14.96.72.249:61202

93.48.80.198:995

45.9.20.200:2211

24.95.61.62:443

79.167.192.206:995

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

114.79.148.170:443

63.153.187.104:443

103.143.8.71:6881

24.53.49.240:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3228 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1164 schtasks.exe

pid	process
3228	regsvr32.exe

pid	process
1164	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oztcsmes\1dc9516c = ee24b9a705836082f996c7ad87bf60d42e4ec2a7bcd7572a844f50d92bb72a7cfe5bb38bfd3c28c1585985c9da66687ba9de	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oztcsmes\a5753609 = 75d36f91baeb388c634ea8788434709577b263b6b119ba1b5e3d34d159ed5e4220674c2d7b1204365fabcdfc0a58fa7bf8d1fee36a1defcf1d54c6b57db184b0245a8599e035fa3fc95a159a03afcda2aac82028df707188079f7faa7eccfd97e74f97f8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oztcsmes\d87d7983 = 9af322f6c5083df487cf0a1b7f2ceb5f0b5b7f82a4df0bdbb56b5af06d67b313d609d6baf8726fe19d3d6df36d62bb01078288ef7c38244e3a245917420d38e3f8d44c09746b75ce58	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oztcsmes\60c11ee6 = 6b1394e7c06f21498e94a7f8c4382d4d48ea9d992cd2db2efd07b00208f3b48be1bc862a19fac04d713b851d5314960328eead860fb4dac95a6067a9b8060e33e0611fe5dbd18df28090bf010acdfee7a3ef004e58669c7686d1fc	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oztcsmes\2a17a15e = f02958d53d7e07d0bc861f33e21df71ad8978e4c26dab6e062db6ff68da04bd04149273af22598b35a2e51e8b3f1494e26466f27fb2a27f77e3c13d08d6e8a701a8c64604571f417e63cd2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oztcsmes\1f887110 = 81d68f7db13217b42b0222adf7fe0ade2ce9cd69249d5ae1edc7705b02a1d65a81a4378d884fdffa3cb8c9f94da359dc136c1e33394f150247bd923a406bbe06fac77b8b2cc30a6baf3d5683d579da02e89398d938e0d2c064909cd076d734778928290ca794c196865252c27a8502e374f28181bd4bc9af	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oztcsmes\555ecea8 = 09d3b21541093b1c986e257e0978642ed6488fe9d5	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oztcsmes\2a17a15e = f0294fd53d7e325c0e44c333b3279c8a370df7c43de24e9e1b4ed5598ba6bf331cf829e31a8ee9866bad7cbbd94c6f860b682b58d2adfa48ca49a598ac3a4d248128a51c2e7e29c4a18a70367b5667c538c73123d4e8f475dfc79a6a6592f4dc	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oztcsmes	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Oztcsmes\a7341675 = ff9c2114a6e04752f1808acee3790816af8e638c791c92929b2c4161c0b4467f4eedd06561c81e4549655557c41433883ffe00856dea7ece290e573d	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
1560	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe
3228	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1560 regsvr32.exe
3228 regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3728 wrote to memory of 1560	3728	regsvr32.exe	regsvr32.exe
PID 3728 wrote to memory of 1560	3728	regsvr32.exe	regsvr32.exe
PID 3728 wrote to memory of 1560	3728	regsvr32.exe	regsvr32.exe
PID 1560 wrote to memory of 3264	1560	regsvr32.exe	explorer.exe
PID 1560 wrote to memory of 3264	1560	regsvr32.exe	explorer.exe
PID 1560 wrote to memory of 3264	1560	regsvr32.exe	explorer.exe
PID 1560 wrote to memory of 3264	1560	regsvr32.exe	explorer.exe
PID 1560 wrote to memory of 3264	1560	regsvr32.exe	explorer.exe
PID 3264 wrote to memory of 1164	3264	explorer.exe	schtasks.exe
PID 3264 wrote to memory of 1164	3264	explorer.exe	schtasks.exe
PID 3264 wrote to memory of 1164	3264	explorer.exe	schtasks.exe
PID 1220 wrote to memory of 3228	1220	regsvr32.exe	regsvr32.exe
PID 1220 wrote to memory of 3228	1220	regsvr32.exe	regsvr32.exe
PID 1220 wrote to memory of 3228	1220	regsvr32.exe	regsvr32.exe
PID 3228 wrote to memory of 732	3228	regsvr32.exe	explorer.exe
PID 3228 wrote to memory of 732	3228	regsvr32.exe	explorer.exe
PID 3228 wrote to memory of 732	3228	regsvr32.exe	explorer.exe
PID 3228 wrote to memory of 732	3228	regsvr32.exe	explorer.exe
PID 3228 wrote to memory of 732	3228	regsvr32.exe	explorer.exe
PID 732 wrote to memory of 2436	732	explorer.exe	reg.exe
PID 732 wrote to memory of 2436	732	explorer.exe	reg.exe
PID 732 wrote to memory of 652	732	explorer.exe	reg.exe
PID 732 wrote to memory of 652	732	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\second_stage3.bin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3728

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\second_stage3.bin.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3264

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jvmhhwjvt /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\second_stage3.bin.dll\"" /SC ONCE /Z /ST 06:18 /ET 06:30
4⤵
- Creates scheduled task(s)
PID:1164

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\second_stage3.bin.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\second_stage3.bin.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3228

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ywxgyvedapab" /d "0"
4⤵
PID:2436

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Seliu" /d "0"
4⤵
PID:652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\second_stage3.bin.dll
MD5
f92528a71e6f367c39195d12bc9d30c4

SHA1
1d5795de9f36d216d842c79af28d7f8d245f733e

SHA256
d7ebf4872795a274ac86598fd2cbcad77b8cf9ddf81b854d7b480901f7f3b236

SHA512
f9f61831c5d3126af97ea708b4729254412705792625755348e3286f5b60f6ee6ddc2fdc518ab543afef1067b728fa26e3614daf5b86a18ec450c3eeed36cf7a

Download Submit
\Users\Admin\AppData\Local\Temp\second_stage3.bin.dll
MD5
f92528a71e6f367c39195d12bc9d30c4

SHA1
1d5795de9f36d216d842c79af28d7f8d245f733e

SHA256
d7ebf4872795a274ac86598fd2cbcad77b8cf9ddf81b854d7b480901f7f3b236

SHA512
f9f61831c5d3126af97ea708b4729254412705792625755348e3286f5b60f6ee6ddc2fdc518ab543afef1067b728fa26e3614daf5b86a18ec450c3eeed36cf7a

Download Submit
memory/652-131-0x0000000000000000-mapping.dmp

Download
memory/732-133-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/732-134-0x00000000030A0000-0x00000000030C1000-memory.dmp

Filesize
132KB

Download
memory/732-132-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/732-129-0x0000000000000000-mapping.dmp

Download
memory/1164-121-0x0000000000000000-mapping.dmp

Download
memory/1560-118-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1560-116-0x0000000002DB0000-0x0000000002E2B000-memory.dmp

Filesize
492KB

Download
memory/1560-115-0x0000000000000000-mapping.dmp

Download
memory/1560-117-0x00000000047C0000-0x000000000494E000-memory.dmp

Filesize
1.6MB

Download
memory/2436-130-0x0000000000000000-mapping.dmp

Download
memory/3228-125-0x0000000000000000-mapping.dmp

Download
memory/3228-128-0x0000000003760000-0x00000000038EE000-memory.dmp

Filesize
1.6MB

Download
memory/3228-127-0x00000000036E0000-0x000000000375B000-memory.dmp

Filesize
492KB

Download
memory/3264-123-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/3264-122-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/3264-120-0x0000000002D10000-0x0000000002D31000-memory.dmp

Filesize
132KB

Download
memory/3264-119-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads