qakbot | 7c57821e67aec88b242a4524ec8f48f85f6db3fc0ce72704bb3b93fbeabe5b1a

General

Target

dal1.ocx.dll
Size

665KB
MD5

6ea29fdd234a3e8bd1998837ae583e05
SHA1

6a16ee910b2d02232d428661c05003f7fdae4e20
SHA256

7c57821e67aec88b242a4524ec8f48f85f6db3fc0ce72704bb3b93fbeabe5b1a
SHA512

e87596b582c9b5dda974aedc5eddb60b5ec6a86c4ebdfefe11be5727df2c594944eb5f19ec6e2e2ee7b903dcf72699fde43df8a0b84c141591e44560414736a2

Score

10^/10

qakbot cullinan 1640084934 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640084934

C2

95.5.133.68:995

188.159.122.122:443

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

109.12.111.14:443

14.96.72.249:61202

93.48.80.198:995

45.9.20.200:2211

24.95.61.62:443

79.167.192.206:995

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

114.79.148.170:443

63.153.187.104:443

103.143.8.71:6881

24.53.49.240:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1128 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1400 schtasks.exe

pid	process
1128	regsvr32.exe

pid	process
1400	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lzzvljcqixxa\1524f666 = 6e130f1843d328ac48b186f9a18d088c6419773b4decab64a03e70c9b2efbe2e32b170221a8fc41f24066b252f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lzzvljcqixxa\d2d1fef5 = 5fc55eafc552f3346c01357793d6a981b70fd88a71272bd0192c71ab1a45113bf34c2e333ec7aa	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lzzvljcqixxa	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lzzvljcqixxa\6a6d9990 = 0a4ed1d0f12b1b83f0ec7cde74ac801d41a05bfa37b1132dded6946dce702101cce0ad2d7698cde9bbfbf0b10adde414a06fcc9a8753cdb503fbdb40c48bcc8e54aeaee0adfc18eef4dcffb82f3b4e72e8718da231f44abe0653a5cfc1b80caaa5a11fdc102dc3341f465cc8b200eceb1fe4059ca0d1ee5d35738c995dd44ace3bd2e54a1cd6f15b7dea583e849dae97042667bb4c7718984f7930adc832f9c48911958092fb6ea17719c463b49a2a081151b094dfaba6c5e221725c55	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lzzvljcqixxa\d090de89 = 30ed7b10d97a9319b0611ac489f0e1a7078df7d6cff8579ee4a8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lzzvljcqixxa\ad989103 = e1616ca29421ce9f6a6dd2a22e267f64c817e9ab54a29c836376e70a5c310035a4d33b6559c87bf604e53134d1feeb19873087ddc8c3f8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lzzvljcqixxa\5ff249de = 7e2a1b6d2c6f86158392f084bdc178270c93e6b498692cd775c759fadfe8b76376fc20bff40c4112278099577c578ed5d1ba77fac1247cc7abd7af8d2f57f3755a0370ca6a882409f70b800e0727b957813d2650912d1b33ad	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lzzvljcqixxa\682cb9ec = 8d9c7b8a93556159e3680523d560c76becc2e85ff0325598f1135cfc4b7c76f6618f07389465e974ccff4d35acbf9bd083120692eab77f7bff1506744fc82ce69a662612df63ca4dae074031bdb4bbb1b9c30794e34059275a94	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lzzvljcqixxa\20bb2628 = 7b0f480301bcc97a8da26436d0e5324a7feef387d932dc6c42653b07498fb7a0ff65fd7618b0e515f3ef1423daaf46446f8f8c9e5ca7e6a8c1c6aad327b97d0ed883166f2e4dcbb8b30368a3b960bf4c6d1bc66da09ea6694aa497aea89481b2c37e353ac16332	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Lzzvljcqixxa\5ff249de = 7e2a0c6d2c6fb3c08bb8aee9763698f478e757280d05167d828d477bca69f121d05a02f6e27b4ba2eff6a6cc0c686d4eab8cc15fd54b857637ea6fe9c55c3a44b357dcaffc87b4a66de660bd1019c0853732b292228bfabc71e3c18cb2ed4f49132f31d4159bb02516119bcd90ef	explorer.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1632	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe
1128	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1632 regsvr32.exe
1128 regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1080 wrote to memory of 1632	1080	regsvr32.exe	regsvr32.exe
PID 1080 wrote to memory of 1632	1080	regsvr32.exe	regsvr32.exe
PID 1080 wrote to memory of 1632	1080	regsvr32.exe	regsvr32.exe
PID 1080 wrote to memory of 1632	1080	regsvr32.exe	regsvr32.exe
PID 1080 wrote to memory of 1632	1080	regsvr32.exe	regsvr32.exe
PID 1080 wrote to memory of 1632	1080	regsvr32.exe	regsvr32.exe
PID 1080 wrote to memory of 1632	1080	regsvr32.exe	regsvr32.exe
PID 1632 wrote to memory of 680	1632	regsvr32.exe	explorer.exe
PID 1632 wrote to memory of 680	1632	regsvr32.exe	explorer.exe
PID 1632 wrote to memory of 680	1632	regsvr32.exe	explorer.exe
PID 1632 wrote to memory of 680	1632	regsvr32.exe	explorer.exe
PID 1632 wrote to memory of 680	1632	regsvr32.exe	explorer.exe
PID 1632 wrote to memory of 680	1632	regsvr32.exe	explorer.exe
PID 680 wrote to memory of 1400	680	explorer.exe	schtasks.exe
PID 680 wrote to memory of 1400	680	explorer.exe	schtasks.exe
PID 680 wrote to memory of 1400	680	explorer.exe	schtasks.exe
PID 680 wrote to memory of 1400	680	explorer.exe	schtasks.exe
PID 1604 wrote to memory of 1032	1604	taskeng.exe	regsvr32.exe
PID 1604 wrote to memory of 1032	1604	taskeng.exe	regsvr32.exe
PID 1604 wrote to memory of 1032	1604	taskeng.exe	regsvr32.exe
PID 1604 wrote to memory of 1032	1604	taskeng.exe	regsvr32.exe
PID 1604 wrote to memory of 1032	1604	taskeng.exe	regsvr32.exe
PID 1032 wrote to memory of 1128	1032	regsvr32.exe	regsvr32.exe
PID 1032 wrote to memory of 1128	1032	regsvr32.exe	regsvr32.exe
PID 1032 wrote to memory of 1128	1032	regsvr32.exe	regsvr32.exe
PID 1032 wrote to memory of 1128	1032	regsvr32.exe	regsvr32.exe
PID 1032 wrote to memory of 1128	1032	regsvr32.exe	regsvr32.exe
PID 1032 wrote to memory of 1128	1032	regsvr32.exe	regsvr32.exe
PID 1032 wrote to memory of 1128	1032	regsvr32.exe	regsvr32.exe
PID 1128 wrote to memory of 832	1128	regsvr32.exe	explorer.exe
PID 1128 wrote to memory of 832	1128	regsvr32.exe	explorer.exe
PID 1128 wrote to memory of 832	1128	regsvr32.exe	explorer.exe
PID 1128 wrote to memory of 832	1128	regsvr32.exe	explorer.exe
PID 1128 wrote to memory of 832	1128	regsvr32.exe	explorer.exe
PID 1128 wrote to memory of 832	1128	regsvr32.exe	explorer.exe
PID 832 wrote to memory of 1044	832	explorer.exe	reg.exe
PID 832 wrote to memory of 1044	832	explorer.exe	reg.exe
PID 832 wrote to memory of 1044	832	explorer.exe	reg.exe
PID 832 wrote to memory of 1044	832	explorer.exe	reg.exe
PID 832 wrote to memory of 1096	832	explorer.exe	reg.exe
PID 832 wrote to memory of 1096	832	explorer.exe	reg.exe
PID 832 wrote to memory of 1096	832	explorer.exe	reg.exe
PID 832 wrote to memory of 1096	832	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dal1.ocx.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\dal1.ocx.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vnlelmlv /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\dal1.ocx.dll\"" /SC ONCE /Z /ST 17:16 /ET 17:28
4⤵
- Creates scheduled task(s)
PID:1400

C:\Windows\system32\taskeng.exe
taskeng.exe {F33557EC-FA75-437B-968D-EB527A7C11E7} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\dal1.ocx.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\dal1.ocx.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:832

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Emogdr" /d "0"
5⤵
PID:1044

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Zumqss" /d "0"
5⤵
PID:1096

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dal1.ocx.dll
MD5
6ea29fdd234a3e8bd1998837ae583e05

SHA1
6a16ee910b2d02232d428661c05003f7fdae4e20

SHA256
7c57821e67aec88b242a4524ec8f48f85f6db3fc0ce72704bb3b93fbeabe5b1a

SHA512
e87596b582c9b5dda974aedc5eddb60b5ec6a86c4ebdfefe11be5727df2c594944eb5f19ec6e2e2ee7b903dcf72699fde43df8a0b84c141591e44560414736a2

Download Submit
\Users\Admin\AppData\Local\Temp\dal1.ocx.dll
MD5
6ea29fdd234a3e8bd1998837ae583e05

SHA1
6a16ee910b2d02232d428661c05003f7fdae4e20

SHA256
7c57821e67aec88b242a4524ec8f48f85f6db3fc0ce72704bb3b93fbeabe5b1a

SHA512
e87596b582c9b5dda974aedc5eddb60b5ec6a86c4ebdfefe11be5727df2c594944eb5f19ec6e2e2ee7b903dcf72699fde43df8a0b84c141591e44560414736a2

Download Submit
memory/680-64-0x0000000000000000-mapping.dmp

Download
memory/680-68-0x0000000000100000-0x0000000000121000-memory.dmp

Filesize
132KB

Download
memory/680-66-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download
memory/680-63-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download
memory/832-86-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/832-79-0x0000000000000000-mapping.dmp

Download
memory/1032-69-0x0000000000000000-mapping.dmp

Download
memory/1044-82-0x0000000000000000-mapping.dmp

Download
memory/1080-55-0x000007FEFC0E1000-0x000007FEFC0E3000-memory.dmp

Filesize
8KB

Download
memory/1096-83-0x0000000000000000-mapping.dmp

Download
memory/1128-75-0x00000000004A0000-0x0000000000542000-memory.dmp

Filesize
648KB

Download
memory/1128-72-0x0000000000000000-mapping.dmp

Download
memory/1128-77-0x0000000000C90000-0x0000000000D0B000-memory.dmp

Filesize
492KB

Download
memory/1128-85-0x00000000004A0000-0x0000000000542000-memory.dmp

Filesize
648KB

Download
memory/1128-84-0x0000000000D10000-0x0000000000E90000-memory.dmp

Filesize
1.5MB

Download
memory/1400-67-0x0000000000000000-mapping.dmp

Download
memory/1632-61-0x0000000000C00000-0x0000000000D80000-memory.dmp

Filesize
1.5MB

Download
memory/1632-62-0x00000000008B0000-0x0000000000930000-memory.dmp

Filesize
512KB

Download
memory/1632-58-0x00000000008B0000-0x0000000000930000-memory.dmp

Filesize
512KB

Download
memory/1632-57-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1632-60-0x0000000000B80000-0x0000000000BFB000-memory.dmp

Filesize
492KB

Download
memory/1632-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads