qakbot | 7c57821e67aec88b242a4524ec8f48f85f6db3fc0ce72704bb3b93fbeabe5b1a

General

Target

dal1.ocx.dll
Size

665KB
MD5

6ea29fdd234a3e8bd1998837ae583e05
SHA1

6a16ee910b2d02232d428661c05003f7fdae4e20
SHA256

7c57821e67aec88b242a4524ec8f48f85f6db3fc0ce72704bb3b93fbeabe5b1a
SHA512

e87596b582c9b5dda974aedc5eddb60b5ec6a86c4ebdfefe11be5727df2c594944eb5f19ec6e2e2ee7b903dcf72699fde43df8a0b84c141591e44560414736a2

Score

10^/10

qakbot cullinan 1640084934 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640084934

C2

95.5.133.68:995

188.159.122.122:443

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

109.12.111.14:443

14.96.72.249:61202

93.48.80.198:995

45.9.20.200:2211

24.95.61.62:443

79.167.192.206:995

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

114.79.148.170:443

63.153.187.104:443

103.143.8.71:6881

24.53.49.240:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 2 IoCs

Processes:

regsvr32.exe

pid process

3324 regsvr32.exe
3324 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

780 schtasks.exe

pid	process
3324	regsvr32.exe
3324	regsvr32.exe

pid	process
780	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uwdioyybmhmly\db19d32e = 612e2c2fa5ab3430610fd6d1e2fee09de8cd4e54f6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uwdioyybmhmly\1cecdbbd = 52185745a1c5d13eecf69487dfc42b1ddf3fabd9268335569c4738118d138767b90f3439d3b0975c57c1cf1393962dd681a392501b4d79208660a3d362d2d0c06c1efd391111f0fedd74	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uwdioyybmhmly	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uwdioyybmhmly\91cf6c96 = 75caea25d63668c2f8926b399494deadfd52c23499f0b0779fdb98fe377c51508fa3456564b13fa18cfe68653afec0a005628314ac4824ffa4dcc0dbd71b2a38	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uwdioyybmhmly\a450bcd8 = b259864f347cba3939c050878885e51a54f8de248210b649cfd7d98d671be5b7e429651a6dd3b4cb0834db7596d8a4bd77ce727c0999bf650777bd9811814229ac4773be1912461f237087a87dc5b5260e9ac707ea084e65d5d7a5aabd42c11d6a5047e8df66829eafa1f4c5c553fe83d0d84d30ae39a15ebcba634a45353cd2bb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uwdioyybmhmly\a6119ca4 = 2f834aecd51dbc592c10b5f0a422049ff0f8d45d4124bba634a4e324f5490109aba6d95e424ca5a671829a40ff2b0409df8a4a346fff957830c96354dc2e44f21116cf29a621fd074539aaa6d6547e7a19052b0b9e59a2b00c95c086	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uwdioyybmhmly\1eadfbc1 = 4465655ba42b77693d857cf4707fe04de47e501ddafa6c2389b848741eaff69147deb7088edd137dcf36b048e5ae9fce472b5e53699da7c79e4cfd71191706839ce01bbeac460295e4508dba1212b033107c7bf4ec9514bdacc698f616b8181ef7a04ecce575eec7b8c3c0ee9331c77e6b84	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uwdioyybmhmly\63a5b44b = d7802bafe21d2f5fe199336a46f57e48220f9b229134b8159b46590d77aa7bd58b76866c297c3be70b39ebf5881defa31aad9157e83b5b44802f903c1daab72217ebcb0dce6d935ec964f0b1293995a3d3a1632f22513f44ea739a682058ca6c660b68f332fe649d61cc3230d9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uwdioyybmhmly\91cf6c96 = 75cafd25d6365d75cb0a3be206f20844a4359f1ac5df0bea9c494ebf8ec4c1803d4f6a386e6092bd0d45c846242adab62d5c3d0c2eb0dce2ce0c89ae1917bfb545f1da2b334af8af5d9f42b350733e81430ef31cbf	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Uwdioyybmhmly\ee860360 = 91aae740644fd63a8366dbf0475b63229cef9f88523e6acf514a84f27789bb6f2830773a2856061ab623	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe
3324	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3664 regsvr32.exe
3324 regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3672 wrote to memory of 3664	3672	regsvr32.exe	regsvr32.exe
PID 3672 wrote to memory of 3664	3672	regsvr32.exe	regsvr32.exe
PID 3672 wrote to memory of 3664	3672	regsvr32.exe	regsvr32.exe
PID 3664 wrote to memory of 428	3664	regsvr32.exe	explorer.exe
PID 3664 wrote to memory of 428	3664	regsvr32.exe	explorer.exe
PID 3664 wrote to memory of 428	3664	regsvr32.exe	explorer.exe
PID 3664 wrote to memory of 428	3664	regsvr32.exe	explorer.exe
PID 3664 wrote to memory of 428	3664	regsvr32.exe	explorer.exe
PID 428 wrote to memory of 780	428	explorer.exe	schtasks.exe
PID 428 wrote to memory of 780	428	explorer.exe	schtasks.exe
PID 428 wrote to memory of 780	428	explorer.exe	schtasks.exe
PID 3268 wrote to memory of 3324	3268	regsvr32.exe	regsvr32.exe
PID 3268 wrote to memory of 3324	3268	regsvr32.exe	regsvr32.exe
PID 3268 wrote to memory of 3324	3268	regsvr32.exe	regsvr32.exe
PID 3324 wrote to memory of 648	3324	regsvr32.exe	explorer.exe
PID 3324 wrote to memory of 648	3324	regsvr32.exe	explorer.exe
PID 3324 wrote to memory of 648	3324	regsvr32.exe	explorer.exe
PID 3324 wrote to memory of 648	3324	regsvr32.exe	explorer.exe
PID 3324 wrote to memory of 648	3324	regsvr32.exe	explorer.exe
PID 648 wrote to memory of 916	648	explorer.exe	reg.exe
PID 648 wrote to memory of 916	648	explorer.exe	reg.exe
PID 648 wrote to memory of 1036	648	explorer.exe	reg.exe
PID 648 wrote to memory of 1036	648	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dal1.ocx.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3672

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\dal1.ocx.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3664

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:428

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ctmhdcbyi /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\dal1.ocx.dll\"" /SC ONCE /Z /ST 12:03 /ET 12:15
4⤵
- Creates scheduled task(s)
PID:780

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\dal1.ocx.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3268

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\dal1.ocx.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3324

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ayiavqr" /d "0"
4⤵
PID:916

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Xkknrduvoxz" /d "0"
4⤵
PID:1036

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dal1.ocx.dll
MD5
6ea29fdd234a3e8bd1998837ae583e05

SHA1
6a16ee910b2d02232d428661c05003f7fdae4e20

SHA256
7c57821e67aec88b242a4524ec8f48f85f6db3fc0ce72704bb3b93fbeabe5b1a

SHA512
e87596b582c9b5dda974aedc5eddb60b5ec6a86c4ebdfefe11be5727df2c594944eb5f19ec6e2e2ee7b903dcf72699fde43df8a0b84c141591e44560414736a2

Download Submit
\Users\Admin\AppData\Local\Temp\dal1.ocx.dll
MD5
6ea29fdd234a3e8bd1998837ae583e05

SHA1
6a16ee910b2d02232d428661c05003f7fdae4e20

SHA256
7c57821e67aec88b242a4524ec8f48f85f6db3fc0ce72704bb3b93fbeabe5b1a

SHA512
e87596b582c9b5dda974aedc5eddb60b5ec6a86c4ebdfefe11be5727df2c594944eb5f19ec6e2e2ee7b903dcf72699fde43df8a0b84c141591e44560414736a2

Download Submit
\Users\Admin\AppData\Local\Temp\dal1.ocx.dll
MD5
6ea29fdd234a3e8bd1998837ae583e05

SHA1
6a16ee910b2d02232d428661c05003f7fdae4e20

SHA256
7c57821e67aec88b242a4524ec8f48f85f6db3fc0ce72704bb3b93fbeabe5b1a

SHA512
e87596b582c9b5dda974aedc5eddb60b5ec6a86c4ebdfefe11be5727df2c594944eb5f19ec6e2e2ee7b903dcf72699fde43df8a0b84c141591e44560414736a2

Download Submit
memory/428-123-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/428-121-0x0000000000000000-mapping.dmp

Download
memory/428-124-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/428-125-0x0000000000340000-0x0000000000361000-memory.dmp

Filesize
132KB

Download
memory/648-135-0x0000000000000000-mapping.dmp

Download
memory/648-138-0x00000000005A0000-0x00000000005C1000-memory.dmp

Filesize
132KB

Download
memory/648-140-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/648-139-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/780-122-0x0000000000000000-mapping.dmp

Download
memory/916-136-0x0000000000000000-mapping.dmp

Download
memory/1036-137-0x0000000000000000-mapping.dmp

Download
memory/3324-127-0x0000000000000000-mapping.dmp

Download
memory/3324-134-0x0000000000AA0000-0x0000000000BEA000-memory.dmp

Filesize
1.3MB

Download
memory/3324-133-0x0000000002EA0000-0x000000000302E000-memory.dmp

Filesize
1.6MB

Download
memory/3324-132-0x0000000000E10000-0x0000000000E8B000-memory.dmp

Filesize
492KB

Download
memory/3664-115-0x0000000000000000-mapping.dmp

Download
memory/3664-120-0x0000000000550000-0x000000000069A000-memory.dmp

Filesize
1.3MB

Download
memory/3664-119-0x00000000042A0000-0x000000000442E000-memory.dmp

Filesize
1.6MB

Download
memory/3664-118-0x0000000000B60000-0x0000000000BDB000-memory.dmp

Filesize
492KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads