qakbot | 51d70923262547a309804afdc7bfae67b67132903d5ee6722cc940a1db1e2374

General

Target

51d70923262547a309804afdc7bfae67b67132903d5ee6722cc940a1db1e2374.dll
Size

680KB
MD5

3e447e7ca26f49af35e9318a64f144c4
SHA1

93ce18cf1e4fac9f13e00c478c0624d04f57bcf7
SHA256

51d70923262547a309804afdc7bfae67b67132903d5ee6722cc940a1db1e2374
SHA512

b0672c686de1a27aefab95227bd79e11d8e0542e393b59c1bf4ba1fd939f593c472f1121a618e74cbe96580bec347046064903c2aa1b3cfd93b0d8098cd1491e

Score

10^/10

qakbot cullinan 1639988898 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639988898

C2

32.221.229.7:443

140.82.49.12:443

24.152.219.253:995

182.56.99.126:443

76.169.147.192:32103

218.101.110.3:995

89.101.97.139:443

82.152.39.39:443

176.24.150.197:443

96.37.113.36:993

68.186.192.69:443

59.88.168.108:443

75.110.250.187:443

182.191.92.203:995

89.165.88.95:443

103.142.10.177:443

45.9.20.200:2211

24.95.61.62:443

194.36.28.26:443

78.101.82.198:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1560 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

584 schtasks.exe

pid	process
1560	regsvr32.exe

pid	process
584	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qaoamioffkay\ad827531 = 7a4d07c0ab9b790a7a834e0acf8b98107bb74f6a5dde09e9522f3b4cb1a2e408ba9dad05fdf35e34f3355b5cd3759be58dfcb623a8dd163d69da7da3a65657b5e6a6fe7d1853573c3ae1f5b93d6cd43bccf39c777c0f12909f0a2d09987cda6c0c1a7215a11ac213019feb4bb5c6f3ea5ec0b0da486c2c1fb5f63665714008689ba79e6a6014fa27fb0c19f99cf118c8e3a481a5931389fc94d261c19b790da254a15bd2f1dec5dc37569f1e657e25e4de806b4ee801924961c435ef579ef9abf96abd77838b61a9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qaoamioffkay\177f3228 = 802f99ba7b124347648bca7e9048240913	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qaoamioffkay\6a777da2 = a6d3365c38e36c79953107a5c7a85b6dc9b25f651ebbdf031d3d96ff0eac7ba927d7f28d5f64ca17a7b69c92fbb2db570eef2b811253451f524ec8e4f90122f8a8bf995f89da8cef11ed0159	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qaoamioffkay\e754ca89 = bee9cf87edbb7928b34333879e53b3edc20c3f1223742666f28f0b8667e9aad744eb0fa1c867e665d3	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Qaoamioffkay	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qaoamioffkay\981da57f = 6df891e2a8f6fed2298f793b7e7f717588e7962cd79973befa813943e999f368f2d110972b8802c41b44ceeb0cc7a8a84e76fb9fc2e5abfb83dc8ae25184803af95afd3c4d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qaoamioffkay\afc3554d = f80b6b97df2e2d37077bfc1ca39cc5e3c64696dbe840589c83de	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qaoamioffkay\d2cb1ac7 = a2a13c381cfe366282deee875cfb00af198b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qaoamioffkay\153e1254 = 379918b4fc172ed0bc28caf49b4aea1482f64a7bdc782bd68ad3c048b46c96a5deb03ac01382199e2f1be1e2aa5954edaead0dc68a5e1e09621316018883814769d41fb2c81dc33f1cf8a1dc06f2f2f9f36434fd7caf854684dfe6e91983f052a2fb400e38e6b14680c8ad15260a44ebcab6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Qaoamioffkay\981da57f = 6df886e2a8f6cbd0e75fcba11c51ada3f512135392a3e3dd39190fc58588de066af90baaa159eecbc1764deaaf6dfab5565e0a62ad62f820b375994600a2b438f7c52753d9b50ec9acc54e9bec4311d47c5cb74ce639e358eeb2	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1580 regsvr32.exe
1560 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1580 regsvr32.exe
1560 regsvr32.exe

pid	process
1580	regsvr32.exe
1560	regsvr32.exe

pid	process
1580	regsvr32.exe
1560	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 748 wrote to memory of 1580	748	regsvr32.exe	regsvr32.exe
PID 748 wrote to memory of 1580	748	regsvr32.exe	regsvr32.exe
PID 748 wrote to memory of 1580	748	regsvr32.exe	regsvr32.exe
PID 748 wrote to memory of 1580	748	regsvr32.exe	regsvr32.exe
PID 748 wrote to memory of 1580	748	regsvr32.exe	regsvr32.exe
PID 748 wrote to memory of 1580	748	regsvr32.exe	regsvr32.exe
PID 748 wrote to memory of 1580	748	regsvr32.exe	regsvr32.exe
PID 1580 wrote to memory of 1920	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 1920	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 1920	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 1920	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 1920	1580	regsvr32.exe	explorer.exe
PID 1580 wrote to memory of 1920	1580	regsvr32.exe	explorer.exe
PID 1920 wrote to memory of 584	1920	explorer.exe	schtasks.exe
PID 1920 wrote to memory of 584	1920	explorer.exe	schtasks.exe
PID 1920 wrote to memory of 584	1920	explorer.exe	schtasks.exe
PID 1920 wrote to memory of 584	1920	explorer.exe	schtasks.exe
PID 1928 wrote to memory of 796	1928	taskeng.exe	regsvr32.exe
PID 1928 wrote to memory of 796	1928	taskeng.exe	regsvr32.exe
PID 1928 wrote to memory of 796	1928	taskeng.exe	regsvr32.exe
PID 1928 wrote to memory of 796	1928	taskeng.exe	regsvr32.exe
PID 1928 wrote to memory of 796	1928	taskeng.exe	regsvr32.exe
PID 796 wrote to memory of 1560	796	regsvr32.exe	regsvr32.exe
PID 796 wrote to memory of 1560	796	regsvr32.exe	regsvr32.exe
PID 796 wrote to memory of 1560	796	regsvr32.exe	regsvr32.exe
PID 796 wrote to memory of 1560	796	regsvr32.exe	regsvr32.exe
PID 796 wrote to memory of 1560	796	regsvr32.exe	regsvr32.exe
PID 796 wrote to memory of 1560	796	regsvr32.exe	regsvr32.exe
PID 796 wrote to memory of 1560	796	regsvr32.exe	regsvr32.exe
PID 1560 wrote to memory of 984	1560	regsvr32.exe	explorer.exe
PID 1560 wrote to memory of 984	1560	regsvr32.exe	explorer.exe
PID 1560 wrote to memory of 984	1560	regsvr32.exe	explorer.exe
PID 1560 wrote to memory of 984	1560	regsvr32.exe	explorer.exe
PID 1560 wrote to memory of 984	1560	regsvr32.exe	explorer.exe
PID 1560 wrote to memory of 984	1560	regsvr32.exe	explorer.exe
PID 984 wrote to memory of 1324	984	explorer.exe	reg.exe
PID 984 wrote to memory of 1324	984	explorer.exe	reg.exe
PID 984 wrote to memory of 1324	984	explorer.exe	reg.exe
PID 984 wrote to memory of 1324	984	explorer.exe	reg.exe
PID 984 wrote to memory of 2028	984	explorer.exe	reg.exe
PID 984 wrote to memory of 2028	984	explorer.exe	reg.exe
PID 984 wrote to memory of 2028	984	explorer.exe	reg.exe
PID 984 wrote to memory of 2028	984	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\51d70923262547a309804afdc7bfae67b67132903d5ee6722cc940a1db1e2374.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\51d70923262547a309804afdc7bfae67b67132903d5ee6722cc940a1db1e2374.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kuhhorfc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\51d70923262547a309804afdc7bfae67b67132903d5ee6722cc940a1db1e2374.dll\"" /SC ONCE /Z /ST 08:02 /ET 08:14
4⤵
- Creates scheduled task(s)
PID:584

C:\Windows\system32\taskeng.exe
taskeng.exe {11984B8E-BCA5-4B28-9CE3-51C0D35E92DD} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\51d70923262547a309804afdc7bfae67b67132903d5ee6722cc940a1db1e2374.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\51d70923262547a309804afdc7bfae67b67132903d5ee6722cc940a1db1e2374.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Yafooyfuemts" /d "0"
5⤵
PID:1324

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Fsdwytuuzyn" /d "0"
5⤵
PID:2028

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\51d70923262547a309804afdc7bfae67b67132903d5ee6722cc940a1db1e2374.dll
MD5
3e447e7ca26f49af35e9318a64f144c4

SHA1
93ce18cf1e4fac9f13e00c478c0624d04f57bcf7

SHA256
51d70923262547a309804afdc7bfae67b67132903d5ee6722cc940a1db1e2374

SHA512
b0672c686de1a27aefab95227bd79e11d8e0542e393b59c1bf4ba1fd939f593c472f1121a618e74cbe96580bec347046064903c2aa1b3cfd93b0d8098cd1491e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\51d70923262547a309804afdc7bfae67b67132903d5ee6722cc940a1db1e2374.dll
MD5
3e447e7ca26f49af35e9318a64f144c4

SHA1
93ce18cf1e4fac9f13e00c478c0624d04f57bcf7

SHA256
51d70923262547a309804afdc7bfae67b67132903d5ee6722cc940a1db1e2374

SHA512
b0672c686de1a27aefab95227bd79e11d8e0542e393b59c1bf4ba1fd939f593c472f1121a618e74cbe96580bec347046064903c2aa1b3cfd93b0d8098cd1491e

Download Submit
memory/584-63-0x0000000000000000-mapping.dmp

Download
memory/748-53-0x000007FEFB571000-0x000007FEFB573000-memory.dmp

Filesize
8KB

Download
memory/796-64-0x0000000000000000-mapping.dmp

Download
memory/984-77-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/984-71-0x0000000000000000-mapping.dmp

Download
memory/1324-75-0x0000000000000000-mapping.dmp

Download
memory/1560-67-0x0000000000000000-mapping.dmp

Download
memory/1580-56-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/1580-57-0x0000000010000000-0x000000001010D000-memory.dmp

Filesize
1.1MB

Download
memory/1580-55-0x00000000754B1000-0x00000000754B3000-memory.dmp

Filesize
8KB

Download
memory/1580-54-0x0000000000000000-mapping.dmp

Download
memory/1920-62-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/1920-61-0x0000000073F71000-0x0000000073F73000-memory.dmp

Filesize
8KB

Download
memory/1920-59-0x0000000000000000-mapping.dmp

Download
memory/1920-58-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/2028-76-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads