qakbot | f4671690ddeb683f87d12173b47d33d1ec18cb4b8c7e300397ee76b214d92cc7

General

Target

f4671690ddeb683f87d12173b47d33d1ec18cb4b8c7e300397ee76b214d92cc7.dll
Size

680KB
MD5

bc77db5e71744abff1ee82e51524fbe2
SHA1

95ea877d90b180c21e18ff0862c56e34f6423e29
SHA256

f4671690ddeb683f87d12173b47d33d1ec18cb4b8c7e300397ee76b214d92cc7
SHA512

b77e7a056c87461ec2677c598ae26c6ed8f99f7ea3274bdc8b6e069a06a7222b70482e8db57fbfba6c6ead997cf76d88cbeb3f0c10eeeaaab43a0e41c2d197b0

Score

10^/10

qakbot cullinan 1639988898 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639988898

C2

32.221.229.7:443

140.82.49.12:443

24.152.219.253:995

182.56.99.126:443

76.169.147.192:32103

218.101.110.3:995

89.101.97.139:443

82.152.39.39:443

176.24.150.197:443

96.37.113.36:993

68.186.192.69:443

59.88.168.108:443

75.110.250.187:443

182.191.92.203:995

89.165.88.95:443

103.142.10.177:443

45.9.20.200:2211

24.95.61.62:443

194.36.28.26:443

78.101.82.198:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1776 regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1548 schtasks.exe

pid	process
1776	regsvr32.exe

pid	process
1548	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiiyvopnavrz\449cda57 = 7f57de4b8496d7f119fdec662008d4a3e57e83be43c54cc8f961e39e37f98c6ff5d988a5c8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiiyvopnavrz\71030a19 = d3f188680238ecf41a66ed3316b294d316d13b4bff038c2b0f48f81960704f846622bc55b7bc033f3548708c239f21212fde9157f876d716d37fd72d279ad8f4c3fae6a021063f19c0e41b239dc9ddedb69bf2e473bc1ceab6beb82f25c9727ea00fd6d9c344a349e6dd2f41efa8391a8bb2ab8041d4b4a4a740c571c312d7cdcee57144be611ba32676aa28766f0e37e6e3b88a07d6c27d8a3c5fd379a8918c41cdcc67421399bef2f1e2246dd8c6417b24d61724df	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiiyvopnavrz\73422a65 = 7fb6ecd2ed33d57636b942e33b7e8dc914962c6a69caf5ae1e75cd964381c42538b854365071ba2732bbab516bc59a4b2193f5d3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiiyvopnavrz\c9bf6d7c = 8f97580f2ff43789f997480c38b1cc7479e41fdec64816ffce1159a721	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiiyvopnavrz\449cda57 = 7f57c94b8496e2ff3d3b075cd6224067798629ef904d42404b1d7c473d906e519a5ceb98284aca4b5490c5bbbf29409a4930ddc6d84b939127d3	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiiyvopnavrz	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiiyvopnavrz\cbfe4d00 = e3bcd7bb53d509cd2ec4e8ca03845b8cad0dec5ad6043df6cc2af26ed834000cd27157e5e249217a8cceedcd63974f17512d6e98e96d2b39369a3e9ea8e7884b36f344644f5721a6e355807864c80e6c2fd3e6b02daaf0b2181741c5c5931d0873df50caa4cd	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiiyvopnavrz\b6f6028a = ffc460123ee3f40f2f3f20f9c4e11890f95616456893c28018a86dfb946a8c50e2fdef2e40fa88ef028050cf89364b5b597cf7998d1538bf27b5788701c8e7cb0617eb38d1cbc0472aed	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiiyvopnavrz\e4a65ef = ee21ff5d5375f4783177e5784a5dd12f7262b6f601f093990261ed20a7e905b06381083cdde6c08b314386a1aadb00d56bf040289e6496b152de558a50cb90b7e6f9560c0c4a05e7d53e56749e0a58616662393e0236852b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Tiiyvopnavrz\3bd5b5a1 = 2d1ff184ffac72b5dd93846514352bc64fcdf15fbc17a73aaa32b2e70d7bac635ca71c7ea866a2bac3d8772591e52e08ed7472364cc6cb6788ceb0ba8052ffa0f92ed861e5704aa64909a2f013e3	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

844 regsvr32.exe
1776 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

844 regsvr32.exe
1776 regsvr32.exe

pid	process
844	regsvr32.exe
1776	regsvr32.exe

pid	process
844	regsvr32.exe
1776	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1316 wrote to memory of 844	1316	regsvr32.exe	regsvr32.exe
PID 1316 wrote to memory of 844	1316	regsvr32.exe	regsvr32.exe
PID 1316 wrote to memory of 844	1316	regsvr32.exe	regsvr32.exe
PID 1316 wrote to memory of 844	1316	regsvr32.exe	regsvr32.exe
PID 1316 wrote to memory of 844	1316	regsvr32.exe	regsvr32.exe
PID 1316 wrote to memory of 844	1316	regsvr32.exe	regsvr32.exe
PID 1316 wrote to memory of 844	1316	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 1452	844	regsvr32.exe	explorer.exe
PID 844 wrote to memory of 1452	844	regsvr32.exe	explorer.exe
PID 844 wrote to memory of 1452	844	regsvr32.exe	explorer.exe
PID 844 wrote to memory of 1452	844	regsvr32.exe	explorer.exe
PID 844 wrote to memory of 1452	844	regsvr32.exe	explorer.exe
PID 844 wrote to memory of 1452	844	regsvr32.exe	explorer.exe
PID 1452 wrote to memory of 1548	1452	explorer.exe	schtasks.exe
PID 1452 wrote to memory of 1548	1452	explorer.exe	schtasks.exe
PID 1452 wrote to memory of 1548	1452	explorer.exe	schtasks.exe
PID 1452 wrote to memory of 1548	1452	explorer.exe	schtasks.exe
PID 1320 wrote to memory of 1508	1320	taskeng.exe	regsvr32.exe
PID 1320 wrote to memory of 1508	1320	taskeng.exe	regsvr32.exe
PID 1320 wrote to memory of 1508	1320	taskeng.exe	regsvr32.exe
PID 1320 wrote to memory of 1508	1320	taskeng.exe	regsvr32.exe
PID 1320 wrote to memory of 1508	1320	taskeng.exe	regsvr32.exe
PID 1508 wrote to memory of 1776	1508	regsvr32.exe	regsvr32.exe
PID 1508 wrote to memory of 1776	1508	regsvr32.exe	regsvr32.exe
PID 1508 wrote to memory of 1776	1508	regsvr32.exe	regsvr32.exe
PID 1508 wrote to memory of 1776	1508	regsvr32.exe	regsvr32.exe
PID 1508 wrote to memory of 1776	1508	regsvr32.exe	regsvr32.exe
PID 1508 wrote to memory of 1776	1508	regsvr32.exe	regsvr32.exe
PID 1508 wrote to memory of 1776	1508	regsvr32.exe	regsvr32.exe
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	explorer.exe
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	explorer.exe
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	explorer.exe
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	explorer.exe
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	explorer.exe
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	explorer.exe
PID 1896 wrote to memory of 1728	1896	explorer.exe	reg.exe
PID 1896 wrote to memory of 1728	1896	explorer.exe	reg.exe
PID 1896 wrote to memory of 1728	1896	explorer.exe	reg.exe
PID 1896 wrote to memory of 1728	1896	explorer.exe	reg.exe
PID 1896 wrote to memory of 1660	1896	explorer.exe	reg.exe
PID 1896 wrote to memory of 1660	1896	explorer.exe	reg.exe
PID 1896 wrote to memory of 1660	1896	explorer.exe	reg.exe
PID 1896 wrote to memory of 1660	1896	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f4671690ddeb683f87d12173b47d33d1ec18cb4b8c7e300397ee76b214d92cc7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\f4671690ddeb683f87d12173b47d33d1ec18cb4b8c7e300397ee76b214d92cc7.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn gmybkms /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\f4671690ddeb683f87d12173b47d33d1ec18cb4b8c7e300397ee76b214d92cc7.dll\"" /SC ONCE /Z /ST 17:28 /ET 17:40
4⤵
- Creates scheduled task(s)
PID:1548

C:\Windows\system32\taskeng.exe
taskeng.exe {FB63865C-9B94-4C18-B9CC-7B29B99112DC} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1320

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\f4671690ddeb683f87d12173b47d33d1ec18cb4b8c7e300397ee76b214d92cc7.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\f4671690ddeb683f87d12173b47d33d1ec18cb4b8c7e300397ee76b214d92cc7.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Bvekhtw" /d "0"
5⤵
PID:1728

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Itowhpcwxbw" /d "0"
5⤵
PID:1660

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f4671690ddeb683f87d12173b47d33d1ec18cb4b8c7e300397ee76b214d92cc7.dll
MD5
bc77db5e71744abff1ee82e51524fbe2

SHA1
95ea877d90b180c21e18ff0862c56e34f6423e29

SHA256
f4671690ddeb683f87d12173b47d33d1ec18cb4b8c7e300397ee76b214d92cc7

SHA512
b77e7a056c87461ec2677c598ae26c6ed8f99f7ea3274bdc8b6e069a06a7222b70482e8db57fbfba6c6ead997cf76d88cbeb3f0c10eeeaaab43a0e41c2d197b0

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\f4671690ddeb683f87d12173b47d33d1ec18cb4b8c7e300397ee76b214d92cc7.dll
MD5
bc77db5e71744abff1ee82e51524fbe2

SHA1
95ea877d90b180c21e18ff0862c56e34f6423e29

SHA256
f4671690ddeb683f87d12173b47d33d1ec18cb4b8c7e300397ee76b214d92cc7

SHA512
b77e7a056c87461ec2677c598ae26c6ed8f99f7ea3274bdc8b6e069a06a7222b70482e8db57fbfba6c6ead997cf76d88cbeb3f0c10eeeaaab43a0e41c2d197b0

Download Submit
memory/844-55-0x0000000000000000-mapping.dmp

Download
memory/844-56-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/844-57-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/844-58-0x0000000010000000-0x000000001010D000-memory.dmp

Filesize
1.1MB

Download
memory/1316-54-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp

Filesize
8KB

Download
memory/1452-60-0x0000000000000000-mapping.dmp

Download
memory/1452-64-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1452-62-0x0000000074611000-0x0000000074613000-memory.dmp

Filesize
8KB

Download
memory/1452-59-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/1508-65-0x0000000000000000-mapping.dmp

Download
memory/1548-63-0x0000000000000000-mapping.dmp

Download
memory/1660-77-0x0000000000000000-mapping.dmp

Download
memory/1728-76-0x0000000000000000-mapping.dmp

Download
memory/1776-68-0x0000000000000000-mapping.dmp

Download
memory/1896-72-0x0000000000000000-mapping.dmp

Download
memory/1896-78-0x0000000000110000-0x0000000000131000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads