qakbot | 6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af

General

Target

6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af.dll
Size

1.8MB
MD5

6b2ec3d016e1af6251de01aea64fa06e
SHA1

eaf200e511f149be10df8b9297195cdb67e7aa86
SHA256

6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af
SHA512

7d275458fed368cb3200744c7c1af8bfa392730a8c0fc1fa5e9b3d02a886f60605b4f9db82f5b501cb9e5818f612e3b77d1a47f1d5b2fecb1bb209aa952a0770

Score

10^/10

qakbot cullinan 1640170781 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

C2

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1896 regsvr32.exe

pid	process
1896	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1532 schtasks.exe

pid	process
1532	schtasks.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vdrueotrhmyxfx\bd5042f5 = 1594b443ccaeba9263d064974b664b6eaed945b78e748c9bc6db7b8cb73738a31951dd60212571f1747aa3	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vdrueotrhmyxfx\bf116289 = aa0243e72801373c6a0bdeec4c8cb1a313e121ed9cb7648cf90da3797daa41c5c5a161a675115e9e30605c930a1f79bcad4b90684c456cf994dab3cb5d3d9c1f2fea759bf3ccaa7015acb18671e3dcefc21378d029cc0f2a1006cd755889a5f2e5cb5c4ec7ba5ed1f2a184950a	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vdrueotrhmyxfx\4d7bba54 = d128086c821385e8bdf40e18fe6cb700b7f775b6d47a2980ee90fad47f36e1dda0e7c77d1724e36a699feac77a415ea8a3e4c45eccd06af628e156e214851c7c52e5ce86c2228a121b72dd77c97e45a1095e33e50efb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vdrueotrhmyxfx\3232d5a2 = 0cc492b21839e6cc0b7a1e2f934d730a6939c18aa78784e992b826e07d185480453dd295eb1a9adccf45f2861eb6e962ff7bbac81518966084feee899cff3ee8	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vdrueotrhmyxfx	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vdrueotrhmyxfx\3232d5a2 = 0cc485b21839d3b96f676e688e91f1aa68c40c2424d5aacc02a8d304f00b797a35aa395d49513a15dcdaf2	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vdrueotrhmyxfx\c0580d7f = b79256f963410e220f5bb358bf69061365b2a0e9a45fecb5aa7f02251de547e622135cef941089c1fefed35bb43df47469608bdb4c9571a73cec15dfdd1049c866b5e5306b57225cb9d1314f130afbffc162111c94a724f6a85391e7e0	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vdrueotrhmyxfx\78e46a1a = 35eb8a3b36487d3c91005c2b371f505a893146725ae6686a92b463893a7b5b2ba12c315d3b16b8e4cb770dee	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vdrueotrhmyxfx\7ad05ec = bdf3ace01621237052e9672adb92b24904b217e9b9602306a63cd73c465a109404f21cdc2ba25be95a6dcefe3e7aadad5f38d392f463328c575e97f39f0deb237df835c5765aac1d29ea820c8d46194ed087ab87ce62fbea1f959983d3f658e24556f14542bd0df45d26260d3c205ef33b6580fbdac2d54a310de6a3fcca2719da3c0b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Vdrueotrhmyxfx\5ec2590 = 58526370aa50c1990a74f7cec26c3f7f00060bbb68416e3b3284852788e15242f7239abcde4189984c984614b9d736a372711e4ef566855ce486a7270d489f3338f77f6b9ee1c3f1008991f83b9df829d71ed28276d0816a893cab	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1688 regsvr32.exe
1896 regsvr32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1688 regsvr32.exe
1896 regsvr32.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe
1896	regsvr32.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

regsvr32.exe

pid	process
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe
1688	regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1588 wrote to memory of 1688	1588	regsvr32.exe	regsvr32.exe
PID 1588 wrote to memory of 1688	1588	regsvr32.exe	regsvr32.exe
PID 1588 wrote to memory of 1688	1588	regsvr32.exe	regsvr32.exe
PID 1588 wrote to memory of 1688	1588	regsvr32.exe	regsvr32.exe
PID 1588 wrote to memory of 1688	1588	regsvr32.exe	regsvr32.exe
PID 1588 wrote to memory of 1688	1588	regsvr32.exe	regsvr32.exe
PID 1588 wrote to memory of 1688	1588	regsvr32.exe	regsvr32.exe
PID 1688 wrote to memory of 428	1688	regsvr32.exe	explorer.exe
PID 1688 wrote to memory of 428	1688	regsvr32.exe	explorer.exe
PID 1688 wrote to memory of 428	1688	regsvr32.exe	explorer.exe
PID 1688 wrote to memory of 428	1688	regsvr32.exe	explorer.exe
PID 1688 wrote to memory of 428	1688	regsvr32.exe	explorer.exe
PID 1688 wrote to memory of 428	1688	regsvr32.exe	explorer.exe
PID 428 wrote to memory of 1532	428	explorer.exe	schtasks.exe
PID 428 wrote to memory of 1532	428	explorer.exe	schtasks.exe
PID 428 wrote to memory of 1532	428	explorer.exe	schtasks.exe
PID 428 wrote to memory of 1532	428	explorer.exe	schtasks.exe
PID 1508 wrote to memory of 984	1508	taskeng.exe	regsvr32.exe
PID 1508 wrote to memory of 984	1508	taskeng.exe	regsvr32.exe
PID 1508 wrote to memory of 984	1508	taskeng.exe	regsvr32.exe
PID 1508 wrote to memory of 984	1508	taskeng.exe	regsvr32.exe
PID 1508 wrote to memory of 984	1508	taskeng.exe	regsvr32.exe
PID 984 wrote to memory of 1896	984	regsvr32.exe	regsvr32.exe
PID 984 wrote to memory of 1896	984	regsvr32.exe	regsvr32.exe
PID 984 wrote to memory of 1896	984	regsvr32.exe	regsvr32.exe
PID 984 wrote to memory of 1896	984	regsvr32.exe	regsvr32.exe
PID 984 wrote to memory of 1896	984	regsvr32.exe	regsvr32.exe
PID 984 wrote to memory of 1896	984	regsvr32.exe	regsvr32.exe
PID 984 wrote to memory of 1896	984	regsvr32.exe	regsvr32.exe
PID 1896 wrote to memory of 1764	1896	regsvr32.exe	explorer.exe
PID 1896 wrote to memory of 1764	1896	regsvr32.exe	explorer.exe
PID 1896 wrote to memory of 1764	1896	regsvr32.exe	explorer.exe
PID 1896 wrote to memory of 1764	1896	regsvr32.exe	explorer.exe
PID 1896 wrote to memory of 1764	1896	regsvr32.exe	explorer.exe
PID 1896 wrote to memory of 1764	1896	regsvr32.exe	explorer.exe
PID 1764 wrote to memory of 580	1764	explorer.exe	reg.exe
PID 1764 wrote to memory of 580	1764	explorer.exe	reg.exe
PID 1764 wrote to memory of 580	1764	explorer.exe	reg.exe
PID 1764 wrote to memory of 580	1764	explorer.exe	reg.exe
PID 1764 wrote to memory of 1964	1764	explorer.exe	reg.exe
PID 1764 wrote to memory of 1964	1764	explorer.exe	reg.exe
PID 1764 wrote to memory of 1964	1764	explorer.exe	reg.exe
PID 1764 wrote to memory of 1964	1764	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:428

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn affmxazkw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af.dll\"" /SC ONCE /Z /ST 16:08 /ET 16:20
4⤵
- Creates scheduled task(s)
PID:1532

C:\Windows\system32\taskeng.exe
taskeng.exe {6368F6E2-4BF3-49D2-AE98-5064DFAAEFD8} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af.dll"
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Tzmiajx" /d "0"
5⤵
PID:580

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Wftxhrnodpk" /d "0"
5⤵
PID:1964

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af.dll
MD5
6b2ec3d016e1af6251de01aea64fa06e

SHA1
eaf200e511f149be10df8b9297195cdb67e7aa86

SHA256
6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af

SHA512
7d275458fed368cb3200744c7c1af8bfa392730a8c0fc1fa5e9b3d02a886f60605b4f9db82f5b501cb9e5818f612e3b77d1a47f1d5b2fecb1bb209aa952a0770

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
MD5
d3721dd4a0eb5cac6936cc3804e76f10

SHA1
a6fa5f2bdf9600b4f812aed4ea3ac91abd53e9b0

SHA256
695b072c3fc2b773dbd688ea9846cbfc5c72ad434467d1a2f4d87f154c2f5f9d

SHA512
8cb519f0fa237ffce547938cd5f9361e32fe160f96d777b04bbfe6d63a5a651873ee0050882debc2fe657fe1f849e29029f260761c0afd2c669d4b2d652626cf

Download Submit
\Users\Admin\AppData\Local\Temp\6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af.dll
MD5
6b2ec3d016e1af6251de01aea64fa06e

SHA1
eaf200e511f149be10df8b9297195cdb67e7aa86

SHA256
6a53f9c28498cb4c08026f369248a2b4ba3279c891e1869fc7239e25a0ac20af

SHA512
7d275458fed368cb3200744c7c1af8bfa392730a8c0fc1fa5e9b3d02a886f60605b4f9db82f5b501cb9e5818f612e3b77d1a47f1d5b2fecb1bb209aa952a0770

Download Submit
memory/428-64-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/428-59-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/428-60-0x0000000000000000-mapping.dmp

Download
memory/428-62-0x0000000074611000-0x0000000074613000-memory.dmp

Filesize
8KB

Download
memory/580-77-0x0000000000000000-mapping.dmp

Download
memory/984-65-0x0000000000000000-mapping.dmp

Download
memory/1532-63-0x0000000000000000-mapping.dmp

Download
memory/1588-54-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp

Filesize
8KB

Download
memory/1688-57-0x0000000000170000-0x00000000001F0000-memory.dmp

Filesize
512KB

Download
memory/1688-58-0x0000000010000000-0x00000000101DC000-memory.dmp

Filesize
1.9MB

Download
memory/1688-56-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1688-55-0x0000000000000000-mapping.dmp

Download
memory/1764-74-0x0000000000000000-mapping.dmp

Download
memory/1764-79-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1896-68-0x0000000000000000-mapping.dmp

Download
memory/1896-72-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1964-78-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads