qakbot | aa21435483b574ac37d79590b911e8f9a16c4070e1adc469edf181e8741ae04e

General

Target

aa21435483b574ac37d79590b911e8f9a16c4070e1adc469edf181e8741ae04e.dll
Size

644KB
MD5

3eedd64cd4c298a96324d564a466d80f
SHA1

6e62e726800e6cb7b37aa6cd7c9c75f0f9aea143
SHA256

aa21435483b574ac37d79590b911e8f9a16c4070e1adc469edf181e8741ae04e
SHA512

5e3dfaf1d203fb9d7172ec37846eedb4d98fb5205fa6d177435172719a153e7a1ef6c33edef2504b47e2fc5b6ea0c31112af4c6836de8f236d4fb62c61993720

Score

10^/10

qakbot cullinan 1640084934 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640084934

C2

95.5.133.68:995

188.159.122.122:443

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

109.12.111.14:443

14.96.72.249:61202

93.48.80.198:995

45.9.20.200:2211

24.95.61.62:443

79.167.192.206:995

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

114.79.148.170:443

63.153.187.104:443

103.143.8.71:6881

24.53.49.240:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 2 IoCs

Processes:

regsvr32.exe

pid process

616 regsvr32.exe
616 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

832 schtasks.exe

pid	process
616	regsvr32.exe
616	regsvr32.exe

pid	process
832	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dqiozlwp\2ded3f05 = f401c90a3ed7ba138419ac5f7b7df2f387f06fe89f0f4543e447db6aa4b50d47d672480fb577445f2087b4401427addef56705c5727b5faedd1e0c7e411d5c78c4dc0ebdb9	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dqiozlwp	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dqiozlwp\95515860 = fbad9c24a748782174486f9749bd5f41f4e5173ebbfe3971acccbb07b54f3291ef501970d267f423aad766499fc567259e2f01ee6bcb60bbe0f309161fb2773c909cfb0debf94a88ab4b383b8d425be15cf2d60c65a3a4abf7a0b559a56201dfea8322493bb0bb1c2ef037764062d21a386e5a75a216fa2942d879b2ddb4c6393f18aed989c3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dqiozlwp\9710781c = 123fde30fa4bfd56230f374bf85d01d8b463fc6b3727301b82a3da677c093bb5b3ee0a97a682be0b3c0bbd733c2a2db78503d9734fe797ea5cb69b23468b560bd5127ae283fde84804e576ef4742ac	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dqiozlwp\2fac1f79 = 6032d9f43761e4e1f82724cad0ad1e86cc8c66c5dcadbb70d75e2d8f3b9b25fb5d10ba3f34ac396ebe6d93931acc8dd4710574dfc75332f50958e4a97ba72b0b9b2d409fddcbadc7c68fe7466ce47c4c66fd5cd9b3b516dfa94b8d064149e59007	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dqiozlwp\a0ce882e = 942bc2cd2169413627596337bdba3be3eaa75fc5926c79af383c0ef541ab2421849322be6ee5cbb8b046f59aedaf1a26cd131558d3452c821dc3ec4185cfcc5b28	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dqiozlwp\a0ce882e = 942bd5cd216974ba548287d8a4e7645574ed9e52d5d77909fdbf506854062b880cd9af5cc927e1cd545d198a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dqiozlwp\52a450f3 = be9a2dd66e55dc55de4879e98b0935f5a519fb9db77c82	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dqiozlwp\ea183796 = f86b5fecaddc97d1d62a5b84d17bd3f526306999e7c41e159ad29651e9c6efd93d6110749a8f431314d81f089bb83086693983fb11a2aa09efb27d24f49184abaa89679f40fd8e9208562318cf5580c49a6ff1496eb931a81b1f2019b971fdee04376d6ec0cb1ff4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dqiozlwp\df87e7d8 = b556f60ab61ae15b7bc9f6503616b66d330c401cfcb48a1b5d7903cf653186855512ff51426072dc8b8945a9d6ee286b75f47212352eeff7ff24accd	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
4024	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe
616	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

4024 regsvr32.exe
616 regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 3764 wrote to memory of 4024	3764	regsvr32.exe	regsvr32.exe
PID 3764 wrote to memory of 4024	3764	regsvr32.exe	regsvr32.exe
PID 3764 wrote to memory of 4024	3764	regsvr32.exe	regsvr32.exe
PID 4024 wrote to memory of 1360	4024	regsvr32.exe	explorer.exe
PID 4024 wrote to memory of 1360	4024	regsvr32.exe	explorer.exe
PID 4024 wrote to memory of 1360	4024	regsvr32.exe	explorer.exe
PID 4024 wrote to memory of 1360	4024	regsvr32.exe	explorer.exe
PID 4024 wrote to memory of 1360	4024	regsvr32.exe	explorer.exe
PID 1360 wrote to memory of 832	1360	explorer.exe	schtasks.exe
PID 1360 wrote to memory of 832	1360	explorer.exe	schtasks.exe
PID 1360 wrote to memory of 832	1360	explorer.exe	schtasks.exe
PID 3228 wrote to memory of 616	3228	regsvr32.exe	regsvr32.exe
PID 3228 wrote to memory of 616	3228	regsvr32.exe	regsvr32.exe
PID 3228 wrote to memory of 616	3228	regsvr32.exe	regsvr32.exe
PID 616 wrote to memory of 692	616	regsvr32.exe	explorer.exe
PID 616 wrote to memory of 692	616	regsvr32.exe	explorer.exe
PID 616 wrote to memory of 692	616	regsvr32.exe	explorer.exe
PID 616 wrote to memory of 692	616	regsvr32.exe	explorer.exe
PID 616 wrote to memory of 692	616	regsvr32.exe	explorer.exe
PID 692 wrote to memory of 2212	692	explorer.exe	reg.exe
PID 692 wrote to memory of 2212	692	explorer.exe	reg.exe
PID 692 wrote to memory of 956	692	explorer.exe	reg.exe
PID 692 wrote to memory of 956	692	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\aa21435483b574ac37d79590b911e8f9a16c4070e1adc469edf181e8741ae04e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3764

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\aa21435483b574ac37d79590b911e8f9a16c4070e1adc469edf181e8741ae04e.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4024

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pdqvswvn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\aa21435483b574ac37d79590b911e8f9a16c4070e1adc469edf181e8741ae04e.dll\"" /SC ONCE /Z /ST 06:18 /ET 06:30
4⤵
- Creates scheduled task(s)
PID:832

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\aa21435483b574ac37d79590b911e8f9a16c4070e1adc469edf181e8741ae04e.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3228

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\aa21435483b574ac37d79590b911e8f9a16c4070e1adc469edf181e8741ae04e.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:616

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:692

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Suaecgkji" /d "0"
4⤵
PID:2212

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Yeuthi" /d "0"
4⤵
PID:956

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aa21435483b574ac37d79590b911e8f9a16c4070e1adc469edf181e8741ae04e.dll
MD5
3eedd64cd4c298a96324d564a466d80f

SHA1
6e62e726800e6cb7b37aa6cd7c9c75f0f9aea143

SHA256
aa21435483b574ac37d79590b911e8f9a16c4070e1adc469edf181e8741ae04e

SHA512
5e3dfaf1d203fb9d7172ec37846eedb4d98fb5205fa6d177435172719a153e7a1ef6c33edef2504b47e2fc5b6ea0c31112af4c6836de8f236d4fb62c61993720

Download Submit
\Users\Admin\AppData\Local\Temp\aa21435483b574ac37d79590b911e8f9a16c4070e1adc469edf181e8741ae04e.dll
MD5
3eedd64cd4c298a96324d564a466d80f

SHA1
6e62e726800e6cb7b37aa6cd7c9c75f0f9aea143

SHA256
aa21435483b574ac37d79590b911e8f9a16c4070e1adc469edf181e8741ae04e

SHA512
5e3dfaf1d203fb9d7172ec37846eedb4d98fb5205fa6d177435172719a153e7a1ef6c33edef2504b47e2fc5b6ea0c31112af4c6836de8f236d4fb62c61993720

Download Submit
\Users\Admin\AppData\Local\Temp\aa21435483b574ac37d79590b911e8f9a16c4070e1adc469edf181e8741ae04e.dll
MD5
3eedd64cd4c298a96324d564a466d80f

SHA1
6e62e726800e6cb7b37aa6cd7c9c75f0f9aea143

SHA256
aa21435483b574ac37d79590b911e8f9a16c4070e1adc469edf181e8741ae04e

SHA512
5e3dfaf1d203fb9d7172ec37846eedb4d98fb5205fa6d177435172719a153e7a1ef6c33edef2504b47e2fc5b6ea0c31112af4c6836de8f236d4fb62c61993720

Download Submit
memory/616-132-0x00000000026D0000-0x000000000281A000-memory.dmp

Filesize
1.3MB

Download
memory/616-131-0x0000000003050000-0x00000000031DE000-memory.dmp

Filesize
1.6MB

Download
memory/616-125-0x0000000000000000-mapping.dmp

Download
memory/616-130-0x0000000002FD0000-0x000000000304B000-memory.dmp

Filesize
492KB

Download
memory/692-138-0x0000000003930000-0x0000000003931000-memory.dmp

Filesize
4KB

Download
memory/692-137-0x0000000003930000-0x0000000003931000-memory.dmp

Filesize
4KB

Download
memory/692-134-0x0000000003020000-0x0000000003041000-memory.dmp

Filesize
132KB

Download
memory/692-133-0x0000000000000000-mapping.dmp

Download
memory/832-121-0x0000000000000000-mapping.dmp

Download
memory/956-136-0x0000000000000000-mapping.dmp

Download
memory/1360-123-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/1360-119-0x0000000000000000-mapping.dmp

Download
memory/1360-122-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/1360-120-0x0000000000740000-0x0000000000761000-memory.dmp

Filesize
132KB

Download
memory/2212-135-0x0000000000000000-mapping.dmp

Download
memory/4024-116-0x0000000004EE0000-0x0000000004F5B000-memory.dmp

Filesize
492KB

Download
memory/4024-115-0x0000000000000000-mapping.dmp

Download
memory/4024-118-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4024-117-0x0000000004F60000-0x00000000050EE000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads